What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech.

For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting.

Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.

Yes, what you observe them doing is not all that impressive, but that is all that is needed to attack these systems. There is no need to send a cruise missile when a light shove is enough.

Essentially every deployed system is so littered with security defects in every facet of both design and implementation that successful attacks against them can be developed and deployed at a cost of just a few tens of thousands to maybe a million dollars for a really good attack at the high end. Any reasonably-sized state actor can deploy literally thousands of times that many resources against their adversaries without even blinking and we know that the NSA and CIA were independently running hacking programs capable of attacking essentially every publicly deployed system in the world. Offense is so easy and defense is so bad it is ridiculous.

If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.

Iran has been both victim and predator of several cyberwarfare operations. They clearly have the experience and they are spending a lot of resources for a long time.

A quick search about their operations:

- Shamoon malware was categorized as cyberwarfare and it was used against Saudi Aramco, allegedly by Iran.

https://en.wikipedia.org/wiki/Shamoon

- A blackout in Turkey was also linked to Iran

https://observer.com/2015/04/iran-flexes-its-power-by-transp...

- Iran is also (allegedly) active in Information Warfare, which is much more complicated than technical cyber attacks.

https://www.cnbc.com/2021/03/16/russia-and-iran-tried-to-int...

- Israel and Iran are actively attacking each others infrastructure for a while.

https://foreignpolicy.com/2020/06/05/israel-and-iran-just-sh...

- Operation Newscaster. Cyber espionage and social engineering targeted senior U.S. military and diplomatic personnel, congresspeople, journalists, lobbyists, think tankers and defense contractors.

https://en.wikipedia.org/wiki/Operation_Newscaster

- Operation Cleaver. targeted the military, oil and gas, energy and utilities, transportation, airlines, airports, hospitals and aerospace industries organizations worldwide.

https://en.wikipedia.org/wiki/Operation_Cleaver

The observer article on the blackout in Turkey caused allegedly by Iran is just an opinion piece and claims to be one.