In the early hours of Saturday morning, a significant surge in cyber operations coincided with a joint military offensive carried out by the United States and Israel against strategic locations within Iran. This digital offensive involved the hacking of numerous Iranian news websites, which were manipulated to display provocative messages aimed at undermining government authority and stirring public dissent. Among the most notable targets was BadeSaba, a widely used religious calendar application boasting over five million downloads, which was compromised to broadcast messages urging Iran’s armed forces to abandon their weapons and align themselves with the civilian population.
The breach of BadeSaba is particularly noteworthy because the app enjoys popularity among government supporters, many of whom are deeply religious. Cybersecurity expert Hamid Kashfi, founder of the firm DarkCell, described this move as a calculated effort to influence a demographic that traditionally supports the regime. The messages displayed on the app carried a strong tone of warning, declaring “It’s time for reckoning,” a phrase likely intended to fuel internal discord and challenge the loyalty of security personnel.
Alongside these cyber intrusions, Iran experienced severe disruptions in its internet connectivity. Doug Madory, director of internet analysis at Kentik, observed two significant drops in connectivity at 0706 GMT and again at 1147 GMT, leaving only minimal access to online services during these periods. These outages suggest a deliberate attempt to cripple communication channels, potentially to hinder Iran’s ability to coordinate a swift response to the military strikes.
Further cyber operations reportedly targeted a range of Iranian government services and military infrastructure, aiming to limit Tehran’s capacity for a coordinated counterattack. Although these claims have yet to be independently verified, reports indicate that the cyberattacks were part of a broader strategy to weaken Iran’s defensive posture on multiple fronts. The Jerusalem Post highlighted these developments, emphasizing the complexity and scale of the digital offensive accompanying the physical strikes.
Experts warn that the escalating situation may provoke retaliatory actions from Iranian proxy groups and hacktivists sympathetic to Tehran. Rafe Pilling, director of threat intelligence at cybersecurity firm Sophos, noted the increased likelihood of cyber reprisals targeting military, commercial, or civilian entities linked to the US and Israel. These counterattacks could range from resurfacing previously leaked data to launching unsophisticated but disruptive attempts to breach industrial control systems exposed to the internet.
Meanwhile, Cynthia Kaiser, a former senior FBI cyber official and current executive at anti-ransomware company Halcyon, pointed out a marked rise in cyber activity across the Middle East. She highlighted that pro-Iranian cyber actors have been mobilizing calls to action, encouraging hack-and-leak campaigns, ransomware assaults, and distributed denial-of-service (DDoS) attacks designed to overwhelm and disable targeted online services. Such preparatory moves may signal the onset of more aggressive cyber operations in the near future.
Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, confirmed that Iranian-aligned threat groups and hacktivists have already begun reconnaissance missions and initiated DDoS attacks. These activities align with patterns typically observed before larger-scale cyber offensives, suggesting a heightened state of alert and readiness among Iran’s digital adversaries.
Adding to the complexity, cybersecurity firm Anomali revealed that Iranian state-sponsored hacking groups have been conducting “wiper” attacks aimed at Israeli targets. These attacks involve erasing critical data, thereby disrupting operations ahead of the physical strikes. This tactic underscores the increasingly sophisticated and multi-layered nature of cyber warfare in the region.
It is important to recognize that while Iran is frequently cited alongside Russia and China as a significant cyber threat to American networks, its historical responses to attacks on its own infrastructure have often been restrained. For instance, following US strikes on Iranian nuclear facilities in June, Tehran’s cyber retaliation was limited to a brief disruption of internet services in Tirana, Albania, rather than a sustained or highly disruptive campaign. This pattern raises questions about how Iran might respond to the current wave of assaults and whether it will escalate its cyber activities in the coming days.
