Loading story…
Iran has extended a near-total internet shutdown into a fourth day amid nationwide protests, cutting off fixed-line connectivity, mobile data, and even calls for much of the country’s roughly 90 million residents. Internet monitoring organizations including Cloudflare, NetBlocks, and Kentik reported sustained outage conditions consistent with a centrally executed “kill switch,” with NetBlocks describing it as the fastest protest-linked shutdown they have observed in Iran, following earlier attempts at more localized blackouts in restive cities.
In addition to terrestrial networks, monitoring data and reporting indicate Iranian authorities have also targeted satellite connectivity, including Starlink, with claims that tens of thousands of receivers inside Iran have been disrupted—potentially through military-grade jamming technology possibly sourced from Russia or China. Reporting also indicates the government may move toward a whitelist model allowing only limited, approved sites, suggesting the blackout could persist; separately, U.S. President Donald Trump said he would speak with Elon Musk about restoring internet access via Starlink.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
Researchers told TechCrunch that the nationwide outage had exceeded 170 hours, making it one of Iran’s longest and most comprehensive shutdowns. Although some official and economic sectors regained limited connectivity, most of the population remained offline.
Iranian authorities reportedly conducted physical raids, including in western Tehran, to confiscate Starlink equipment and criminalized possession of the terminals. Officials also jammed neighborhoods where devices were believed to be in use.
Starlink and affiliated support efforts reportedly introduced technical countermeasures against Iranian interference, reducing packet loss from initial levels of roughly 30–80% to about 10% in some cases. Service remained unstable as both sides continued a cat-and-mouse struggle.
NasNet said that after discussions with Starlink and U.S. authorities, it had arranged free Starlink service for users in Iran who already possessed terminals. The group also issued operational security guidance to help users avoid detection.
U.S. President Donald Trump said he would speak with Elon Musk about helping restore internet access for people in Iran, including via Starlink. U.S. reporting also said the administration was considering broader responses to the crisis.
By January 12, monitoring groups said Iran's near-total shutdown had continued into a fourth day, with officials indicating restoration would occur only in coordination with security authorities. The blackout severely limited reporting on clashes and casualties during the protests.
Some government-aligned services and select networks, including state media, approved Telegram channels, universities, and certain official entities, began coming back online under a progressive whitelist model. Most of the public remained offline while approved sectors regained limited access.
As the national blackout continued, Iranian authorities reportedly used "military-grade" radio-frequency jamming against Starlink, disrupting service and particularly degrading uploads. Researchers said the interference affected a large share of Starlink traffic but did not fully eliminate access.
Cloudflare observed a short-lived restoration of internet traffic from Iran before the blackout resumed. No significant improvement was reported after the following day.
Iran cut fixed-line, mobile internet, and phone connectivity nationwide, leaving the country largely disconnected from the global internet. Monitoring data from Cloudflare, NetBlocks, and Kentik showed external connectivity falling to around 1% of normal levels and at times effectively to zero.
Internet monitors reported that Iranian authorities first attempted localized connectivity disruptions before escalating to a nationwide shutdown during economy-focused anti-government protests. NetBlocks later described the response as Iran’s fastest protest-related "kill-switch" deployment to date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
hackers-arise.com
Open sourcetechcrunch.com
Open sourcesecurityonline.info
Open sourcearstechnica.com
Open sourcetomshardware.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
Iran imposed a near-total nationwide internet blackout that lasted for weeks, with rights groups and network monitors saying the shutdown was used to suppress information and dissent while preserving tightly controlled access for selected businesses, vetted users, and regime-linked insiders. Reports described a developing two-tier system in which most people were left on a degraded domestic intranet while some users received limited or privileged connectivity through state-approved packages and so-called white SIM cards, even as the blackout inflicted heavy economic damage and became one of the longest nationwide shutdowns in recent years. Despite the restrictions, Iranians continued communicating through censorship-resistant tools and alternative channels including **Psiphon**, **Lantern**, **Tor Browser** with **Snowflake**, shortwave radio, landline calls, satellite filecasting via **Toosheh**, and limited **Starlink** access. Usage surged during the blackout, with Psiphon reportedly reaching nearly 9.6 million daily users in Iran and up to 26 million daily Conduit connections, while researchers and advocates warned that access remained costly, risky, and subject to surveillance, raids, arrests, and severe penalties as Tehran appeared to move toward a more permanent whitelisted internet model.
Jun 29, 2026