“We will continue to work with our intelligence community and cybersecurity partners to monitor Iranian cyberactivity, share information and take steps to keep America and our allies safe,” Mr. Krebs said.

Such intrusions by Iran do more than just steal data and money — they also seek to delete data or take down entire networks. “What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you’ve lost your whole network,” Mr. Krebs warned.

Beyond the online operation, American military and intelligence officials also are trying to devise other operations that would not escalate tensions with Iran but would try to deter further aggressions and prod Tehran to stop, or dial back, its shadow war, according to current and former officials.

The downing of an American drone on Thursday underlined the already tense relations between the countries after Mr. Trump’s recent accusations that Iran was to blame for explosions this month that crippled two oil tankers near the vital Strait of Hormuz. Iran has denied that accusation.

Mr. Trump’s decision on Thursday to call off military strikes — even as planes were in the air and ships were in position — has given Tehran a chance to try to de-escalate the situation. But if Iran instead targets additional oil tankers or fires missiles at other aircraft, the United States will need to take actions to try to re-establish deterrence, current and former officials said.

Scrambling to extend a reprieve in the Iran crisis on Saturday after President Trump’s aborted military strike, Britain, France and other European countries reached out to the Iranians for dialogue and urged restraint on all sides.