The Column – Cyber Security Week
The cloud has always had something ethereal, described as a real cloud: intangible, light, abstract. Something that is above our heads, far from traffic, dust and sheet metal. Then on an AWS (Amazon) site in the Emirates it is subject to an attack, a fire, power and connectivity problems, and the metaphor crumbles. The cloud returns to earth and we discover that it has walls, cables, uninterruptible power supplies, fences, coordinates and, above all, that it can be hit.
The best-documented episode occurred on March 1, 2026, with Amazon Web Services infrastructure hit or damaged between the United Arab Emirates and Bahrain. It is not a technical detail, nor a color note for specialists, but a moment of understanding. For years we have thought of data centers as a digital industrial backdrop: anonymous like a back room, invisible like the boiler room of an apartment building. But no. If the facts reported by multiple media outlets are correct, the data center enters the visible field of conflict. No longer a simple online life support, but a target. This is the first point that matters. The second is even more interesting, because it concerns language. After the damage suffered by AWS, public threats arrived attributable to environments close to the Pasdaran and the progressive expansion of the perimeter of the targets: large US technology companies operating in the Middle East, sites, offices, infrastructures. Here the leap is not just operational, it is mental. The idea is established that technology is not neutral, that its infrastructure is not a simple civil service, but a part of the strategic theater. It’s a change of view. As if where you see a power station you now recognize a main switch. In the first case you observe a plant; in the second you understand that someone might want to shut down a city.
The Pasdarn threats of March 31 and April 1 should be read exactly like this. Not as automatic proof of a successful new attack, but as an indicator of intent, target selection and campaign continuity. It is an important distinction, almost boring, and for this very reason precious. In these events the public narrative often stumbles upon a childish vice: putting claim, desire, propaganda and real damage in the same bag. A confirmed attack is one thing. An operational warning is another. Disputed news is yet another. This is also why the alleged bombing between 2 and 4 April on an AWS center in Bahrain deserves caution. The reported damage may be plausible and consistent with the previous sequence, but if the confirmation is incomplete there is no need to force your hand. Even more instructive is the case of April 3rd on Oracle in Dubai: an alleged claim, relaunches, official denial, divergent reconstructions, up to the possibility that it was debris falling on a building and not a confirmed direct attack against a data center. Here the data is not the episode itself, but the fog. And the fog, in the contemporary information landscape, is never an innocent background, but a weapon.
However, there is something more important than individual news stories. The cloud is by no means an ethereal entity moving in the marketing sky. It has addresses, dependencies, vulnerabilities and the fact is that even a digital infrastructure can be treated as essential nodes have always been treated: not for what they show, but for what they make work. It is the true maturity of the technological conflict, and also its most uncomfortable part. The moment you understand that the cloud has a foundation planted in the ground, you also understand that it can tremble. And everything we call immaterial suddenly takes shape and something much more prosaic than sophisticated malware can be used to attack.
