BRF-04·
The Bear and the Lion in the Wires
How Russia, and to a lesser degree China, are building Iran's cyber arsenal against critical infrastructure, traced across all sixteen U.S. sectors.
The Bear and the Lion in the Wires investigates the transfer of offensive cyber capability into Iran’s arsenal, arguing that Russia — and, to a lesser degree, China — has materially accelerated Tehran’s ability to threaten critical infrastructure. The paper reads this as a deliberate pattern of capability diffusion among aligned states rather than a series of isolated, opportunistic exchanges.
The analysis traces the mechanisms of transfer: shared tooling and infrastructure, overlapping tradecraft, and the tacit permission that comes when a more capable state tolerates or enables a partner’s operations. It examines how these inputs raise the ceiling on what Iran-linked actors can attempt against energy, water, healthcare, financial, and communications systems.
To make the threat concrete, the brief maps exposure across all sixteen United States critical infrastructure sectors, identifying where Iran-linked activity is most plausible and most consequential. It distinguishes between symbolic or disruptive operations intended to signal resolve and the quieter pre-positioning that would matter most during a broader confrontation.
The paper concludes with recommendations for defenders: treat capability diffusion among aligned adversaries as a leading indicator, prioritize sectors where transferred tooling lowers the barrier to impact, and coordinate intelligence across allied nations facing the same convergent threat. It is published by the East West Strategic Research Collective on ResearchGate.