Loading story…
Iran experienced a near-total nationwide internet blackout, with independent monitoring indicating national connectivity fell to roughly 4% of normal levels amid US and Israeli strikes. NetBlocks reported the sharp drop in connectivity, and Cloudflare telemetry similarly showed Iran’s internet traffic falling to effectively zero, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis.
Separate reporting tied the blackout to a large-scale cyberattack occurring in parallel with kinetic operations (described as part of Operation “Roar of the Lion”), alleging impacts to critical infrastructure, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a government-led, multi-layer takedown that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of Starlink—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Large-scale cyberattacks reported alongside the strikes disrupted critical infrastructure, official news websites, and security communications systems. Local media said key outlets including IRNA and ISNA were affected, contributing to a broader communications blackout.
Cloudflare reported that as of 18:45 UTC, Iran’s internet traffic had dropped to effectively zero, consistent with a complete shutdown and disconnection from the global internet. The observation reinforced reports of a nationwide blackout.
Amid reported Israeli and U.S. military strikes, Iran experienced a near-total nationwide internet disruption. NetBlocks said national connectivity fell to about 4% of normal levels, indicating an almost complete shutdown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
Iran remained under a **near-total government-imposed internet blackout** for more than 10 days, with Cloudflare Radar showing HTTP traffic falling by roughly **98%** from pre-shutdown levels to below **1% of normal** beginning around 07:00 UTC on February 28. Reporting indicates the disruption affected all major regions and the country’s largest networks simultaneously, including **MCCI (`AS197207`)**, **IranCell (`AS44244`)**, and **TCI (`AS58224`)**, supporting assessments that the outage was a centrally coordinated national shutdown rather than a cyberattack or physical infrastructure failure. At the same time, Iranian state and IRGC-linked messaging signaled an escalation of the wider conflict toward **economic targets**, warning that banks and commercial infrastructure tied to the U.S. and Israel could be considered legitimate targets after an alleged strike on a bank in Tehran. Iranian outlets reportedly named major technology firms including **Nvidia, Microsoft, Google, Oracle, IBM, and Palantir** in connection with facilities in Israel and the broader Middle East, while warning civilians to avoid areas near banks. Together, the reporting points to a broader campaign in which Iran is both restricting domestic connectivity and publicly threatening regional economic and technology infrastructure as the conflict expands.
Jun 29, 2026
Following coordinated **US-Israeli airstrikes** on Iran, reporting described a rapid escalation in state information controls, including a near-total **internet blackout** that cut the country off from external communications. Journalists and civil society actors were described as disproportionately impacted, facing a choice between attempting to circumvent restrictions—at personal risk—or losing the ability to report and document events; the blackout was framed as consistent with Iran’s prior crisis playbook of throttling or severing connectivity during unrest and security crackdowns. On-chain analysis also reported a sharp spike in **cryptoasset outflows from major Iranian exchanges** in the immediate aftermath of the strikes, totaling roughly **$10.3M** over a multi-day window. The activity was assessed as consistent with prior patterns in which Iranian crypto movements surge around geopolitical shocks and domestic instability, with potential drivers including citizen self-custody withdrawals, exchange infrastructure changes, or state-linked activity; attribution was described as premature pending follow-on tracing of onward fund flows.
Jun 29, 2026