Loading story…
Following coordinated US-Israeli airstrikes on Iran, reporting described a rapid escalation in state information controls, including a near-total internet blackout that cut the country off from external communications. Journalists and civil society actors were described as disproportionately impacted, facing a choice between attempting to circumvent restrictions—at personal risk—or losing the ability to report and document events; the blackout was framed as consistent with Iran’s prior crisis playbook of throttling or severing connectivity during unrest and security crackdowns.
On-chain analysis also reported a sharp spike in cryptoasset outflows from major Iranian exchanges in the immediate aftermath of the strikes, totaling roughly $10.3M over a multi-day window. The activity was assessed as consistent with prior patterns in which Iranian crypto movements surge around geopolitical shocks and domestic instability, with potential drivers including citizen self-custody withdrawals, exchange infrastructure changes, or state-linked activity; attribution was described as premature pending follow-on tracing of onward fund flows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-03, WIRED reported how journalists and activists were working around Iran’s internet blackout using encrypted messaging, SMS, international calls, and smuggled media. The report also noted the use of satellite imagery and, in some cases, Starlink to compensate for the loss of connectivity.
On 2026-03-03, Chainalysis published an analysis linking a sharp rise in Iranian exchange outflows to the hours after the airstrikes. The company said more time and wallet-level analysis would be needed to determine whether the movements were driven by retail users, exchanges, or state-controlled actors.
Between 2026-02-28 and 2026-03-02, major Iranian exchanges recorded about $10.3 million in crypto outflows. Chainalysis said the spike could reflect self-custody withdrawals, exchange fund movements, or state-aligned laundering and sanctions-evasion activity, but attribution remained unclear.
Following the 2026-02-28 airstrikes, Iran implemented a near-total internet shutdown that largely cut the country off from the outside world. Reporting described the move as consistent with Iran’s past crisis response and damaging to journalists, activists, and families trying to communicate.
On 2026-02-28, coordinated US and Israeli strikes hit a military compound in Tehran. The strikes became the trigger for subsequent internet restrictions and unusual crypto outflows from Iranian exchanges.
In 2025, Iran’s largest crypto exchange, Nobitex, was hacked and more than $90 million was stolen. The incident was later cited as part of the heightened cybersecurity and operational pressure facing Iranian exchanges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
koreatimes.co.kr
Open sourcechainalysis.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting on Iran’s domestic instability and state pressure indicates **cryptocurrency usage has expanded sharply** as both a financial outlet for citizens and a funding channel for regime-linked actors. Chainalysis assessed Iran’s crypto ecosystem at **~$7.78B in 2025**, with activity correlating to political events and conflict; it also reported that **IRGC-linked on-chain activity represented ~50% of Iran’s total crypto activity in Q4 2025** and has been increasing over time. The same analysis noted that during recent mass protests, Iranians **increased Bitcoin withdrawals to personal wallets**, consistent with capital flight behavior amid currency collapse and political instability. Separately, AlphaHunt reported telemetry consistent with an **intentional national internet shutdown** in Iran on **2026-01-08** (traffic falling to near-zero), alongside indicators such as a **~98.5% drop in IPv6 routing announcements** observed by Cloudflare earlier that day. Based on prior patterns of Iran-linked operations (e.g., **APT42**), the post-blackout period is assessed as higher risk for **rapid phishing, credential theft, and account takeovers** targeting officials, journalists, and dissidents—driven more by “regime security” requirements (identification, monitoring, intimidation) than by novel technical exploitation.
Jun 29, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026