Executive Summary

Cardinal Hackers announced the launch of Operation “Arrow of God,” a declared operation against Israel with a second phase scheduled for 00:00 Moscow time.

The statement claims that the group had remained publicly inactive for 70 days while conducting observation and mapping activities. According to the actor, an alleged component named Apollon-Virus penetrated IDF command networks in April, enabling the collection of information related to military operations, logistics and communications between Tel Aviv, Baku and Ankara.

To date, there is no independent evidence confirming the alleged access, the authenticity of the documents mentioned or the concrete existence of the compromises described.

Key Judgments

• Cardinal formalizes an operation with a specific name, an explicit state-level target and a defined time window.
• The publication combines a cyber threat with a geopolitical narrative centered on Israel, Azerbaijan and Turkey, using proximity to Iran as an element of regional sensitivity.
• The announcement projects infiltration capability, persistent access and alleged possession of sensitive documentation.
• There is no verifiable evidence confirming an intrusion into IDF networks or the authenticity of the material announced.
• The operation may function as narrative preparation for a potential leak, although it could also reflect an information-pressure strategy without sufficient technical backing.

What Happened

Cardinal published a visual piece and a statement declaring the launch of Operation “Arrow of God” against Israel.

The actor claims to have identified alleged compromised targets, including military command networks, centers associated with Mossad, drone hubs, logistics channels and documentation related to communications between Israel, Azerbaijan and Turkey.

The publication presents the operation in phases. The first appears as completed under the phrase “The bow is drawn,” while the second is announced as imminent for 00:00 MSK.

At this stage, the message does not include technical samples, downloadable documents, verifiable indicators or sufficient evidence to confirm the scope of the statements.

Operational Assessment

Cardinal is not only announcing a potential cyberattack action, but also constructing a narrative framework of strategic exposure. The operation is presented as a revelation of alleged covert Israeli activities coordinated with Azerbaijan and Turkey, with direct implications for Iran’s regional environment.

The choice of those countries does not appear casual. The Israel–Azerbaijan–Turkey axis allows the announcement to be inserted into sensitive geopolitical tensions and to increase its resonance among anti-Israel audiences or communities aligned with narratives of regional confrontation.

The use of expressions such as “communication intercept,” “internal protocols,” “supply chain manifests” and “communication logs” seeks to reinforce an image of deep access. However, the absence of verifiable evidence requires keeping the assessment at a preliminary level.

For now, it is not possible to determine whether Cardinal possesses authentic material, is preparing an actual leak or is using the operation as a mechanism for reputational pressure and positioning.

Intelligence Significance

Operation “Arrow of God” introduces an announced campaign with a state-level target and a narrative of high political value. If the actor publishes consistent documentation or verifiable technical evidence, the operation could become relevant as an exposure of sensitive information or as an attempt at information interference in a volatile regional scenario.

If the second phase does not provide substantive evidence, the announcement will still remain useful as a positioning indicator. Cardinal seeks to project capability, regain visibility after a period of silence and associate its activity with a narrative of strategic confrontation against Israel.

In both scenarios, its potential impact also depends on the actor’s ability to shape perceptions around access, covert alliances and institutional vulnerability.

Analytical Closing

Cardinal uses Operation “Arrow of God” to announce an action against Israel and project a narrative of strategic infiltration with regional implications.

Until technical or documentary evidence becomes available for verification, iQBlack assesses the publication as a preliminary campaign indicator and not as confirmation of an effective compromise.