Loading story…
Multiple Iranian state television channels transmitted via the Badr satellite were reportedly hijacked, briefly interrupting normal programming to air protest footage and anti-regime messages. Circulating videos showed Farsi-language calls for demonstrators to continue protests, clips of solidarity rallies abroad, and an on-air appearance by exiled opposition figure Reza Pahlavi urging further demonstrations and calling on Iran’s military and security forces to side with protesters; the footage was shared by outlets including Iran International and Pahlavi’s media team. The unauthorized broadcast was reported to have lasted roughly 10 minutes, and the responsible party was not immediately identified; independent verification of the footage was not confirmed in reporting.
The incident occurred amid broader political and economic unrest in Iran, with reporting linking the context to recent protests driven by economic deterioration and allegations of corruption and mismanagement. Iranian authorities had not publicly commented at the time of reporting, and the event followed a period in which Iran imposed a near-total shutdown of internet and mobile communications during the unrest, with indications that restrictions might later be eased.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On January 18, NetBlocks reported that internet traffic in Iran dropped again after the brief, filtered restoration of some online services. The connectivity decline coincided with the broader period of unrest and restrictions.
During the same hijacked television segment, exiled Crown Prince Reza Pahlavi appeared with a message calling for further protests and urging Iran’s military and security forces to side with demonstrators. Footage of the incident was later shared by his communications team and other media outlets.
Around 9:30 p.m. on Sunday, anti-regime activists reportedly hijacked several Iranian state television channels carried on the Badr satellite for about 10 minutes. The unauthorized broadcast showed protest footage, solidarity rallies, and messages urging continued demonstrations.
Before January 18, some Google and messaging services were briefly restored in Iran, but access remained heavily filtered. This partial restoration was short-lived.
Following the unrest, Iranian authorities imposed a near-total shutdown of internet and mobile services for nearly two weeks. The disruption formed the backdrop to later broadcast and connectivity incidents.
Protests and unrest in Iran began in late December, driven by economic downturn, inflation, and rising food prices. The unrest was followed by a security crackdown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran’s state broadcaster, **Islamic Republic of Iran Broadcasting (IRIB)**, suffered a brief satellite broadcast hijack that replaced regular programming with footage of anti-regime protests, messages from exiled Crown Prince **Reza Pahlavi**, and appeals for security forces to defect and support demonstrators. The intrusion reportedly lasted about 10 minutes before authorities restored the feed. Anonymous-linked social media accounts, including **@YourAnonTV**, claimed responsibility under the `#OpIran` banner in cooperation with Iranian hackers, but attribution remained unconfirmed. The disruption reportedly affected satellite transmissions carried via the **Badr** satellite and quickly spread online through opposition and social media channels. The incident echoed earlier periods of unrest in Iran, where authorities have tightly controlled communications, including a nationwide shutdown that cut access to foreign internet services while leaving domestically hosted sites reachable through Iran’s so-called **National Internet**. The broadcast hijack adds to a pattern of symbolic attacks on state media infrastructure during politically sensitive moments, though no confirmed link was established to more advanced actors such as **Predatory Sparrow**.
Jun 29, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
Iran warned that countries and organizations supporting the exiled broadcaster **Iran International** could face military consequences, explicitly stating that facilities and infrastructure used to transmit the channel’s signal may be treated as potential targets. The broadcaster said the threat extends to infrastructure linked to the *TürkmenÄlem 52E / MonacoSAT* platform, which carries Iran International as well as other Persian-language services including the BBC and Radio Farda, and reported that direct warnings had previously been sent to **Turkmenistan** and **Monaco**. Iranian state and semi-official media framed the outlet as conducting “psychological warfare” on behalf of the U.S. and Israel. The threat was accompanied by broader Iranian moves against external information and communications channels. Iranian authorities also said they had seized hundreds of **Starlink** devices, describing them as part of foreign efforts to undermine the country. Other reported Iranian warnings about possible attacks on Gulf energy infrastructure reflect the same wider regional crisis, but they concern a separate military escalation rather than the specific campaign against broadcast and communications systems tied to Iran International and foreign connectivity services.
Jun 29, 2026