Loading story…
Several of Pakistan’s most-watched TV news channels—Geo News, ARY News, and Samaa TV—had their broadcasts disrupted when attackers hijacked parts of the distribution chain and inserted unauthorized on-screen text messages targeting the Pakistan Armed Forces. The interruptions occurred during peak evening viewing (including the 9pm bulletins) and were reported to involve compromise of satellite beams and live feeds, causing regular programming to be replaced with politically charged anti-military messaging.
Geo News stated it had been facing hacking attempts for roughly 24 hours before the intruders succeeded, and emphasized the aired content was not affiliated with the channel while calling for authorities to take action. Reporting also cited early speculation about attribution (including claims of an Afghan-linked actor in relation to ARY) but noted the scale suggested a more coordinated operation; separate claims indicated the activity may have extended beyond TV disruption to unauthorized Google advertisement campaigns affecting websites across multiple countries, and that Pakistan Cyber Force allegedly conducted retaliatory DDoS activity against Indian channels and websites.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Pakistani authorities were reported to be investigating the incident and measures to prevent a recurrence. No official statement from the Ministry of Information and Broadcasting or PEMRA was cited at the time of reporting.
In the aftermath of the broadcast intrusion, local reports alleged that a group calling itself Pakistan Cyber Force conducted retaliatory cyber activity against Indian targets, including ABP News and the Food Odisha website, with some reports also describing DDoS attacks.
Reporting said the incident extended beyond TV broadcasts through unauthorized Google advertising campaigns affecting websites in 19 countries. This suggested a broader coordinated operation beyond the channel hijackings.
The unauthorized messages criticized the Pakistan Armed Forces and urged citizens to oppose the military. Geo News publicly stated the content was not affiliated with the channel.
On March 1, 2026, Geo News, ARY News, and Samaa TV were among the channels whose evening programming was interrupted by unauthorized on-screen messages. Reports said attackers took over satellite beams and live feeds during high-viewership news bulletins shortly after Iftar.
Geo News said it faced hacking attempts for roughly 24 hours before attackers successfully gained control. The activity preceded the later broadcast intrusion affecting major Pakistani news channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran’s state broadcaster, **Islamic Republic of Iran Broadcasting (IRIB)**, suffered a brief satellite broadcast hijack that replaced regular programming with footage of anti-regime protests, messages from exiled Crown Prince **Reza Pahlavi**, and appeals for security forces to defect and support demonstrators. The intrusion reportedly lasted about 10 minutes before authorities restored the feed. Anonymous-linked social media accounts, including **@YourAnonTV**, claimed responsibility under the `#OpIran` banner in cooperation with Iranian hackers, but attribution remained unconfirmed. The disruption reportedly affected satellite transmissions carried via the **Badr** satellite and quickly spread online through opposition and social media channels. The incident echoed earlier periods of unrest in Iran, where authorities have tightly controlled communications, including a nationwide shutdown that cut access to foreign internet services while leaving domestically hosted sites reachable through Iran’s so-called **National Internet**. The broadcast hijack adds to a pattern of symbolic attacks on state media infrastructure during politically sensitive moments, though no confirmed link was established to more advanced actors such as **Predatory Sparrow**.
Jun 29, 2026
Multiple Iranian state television channels transmitted via the **Badr satellite** were reportedly hijacked, briefly interrupting normal programming to air protest footage and **anti-regime messages**. Circulating videos showed Farsi-language calls for demonstrators to continue protests, clips of solidarity rallies abroad, and an on-air appearance by exiled opposition figure **Reza Pahlavi** urging further demonstrations and calling on Iran’s military and security forces to side with protesters; the footage was shared by outlets including **Iran International** and Pahlavi’s media team. The unauthorized broadcast was reported to have lasted roughly **10 minutes**, and the responsible party was not immediately identified; independent verification of the footage was not confirmed in reporting. The incident occurred amid broader political and economic unrest in Iran, with reporting linking the context to recent protests driven by economic deterioration and allegations of corruption and mismanagement. Iranian authorities had not publicly commented at the time of reporting, and the event followed a period in which Iran imposed a near-total shutdown of internet and mobile communications during the unrest, with indications that restrictions might later be eased.
Jun 29, 2026
A cyberattack against Iran's state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), briefly hijacked live programming and deployed a destructive malware toolkit inside the broadcaster's environment. During the intrusion, broadcasts were interrupted to display images of **Maryam and Massoud Rajavi** and a message calling for the assassination of Supreme Leader **Ayatollah Ali Khamenei**, indicating the operation combined political messaging with sabotage of media operations. Check Point's investigation said the attackers used multiple custom components, including backdoors, batch scripts, configuration files, and a wiper designed to corrupt files, erase the **master boot record (MBR)**, clear Windows Event Logs, delete backups, kill processes, and change user passwords. The attackers also deleted the executable for the **TFI Arista Playout Server** and forced a malicious video file, `TSE_90E11.mp4`, to loop on air; researchers said they could not confirm attribution or the initial access vector, but assessed the operation showed detailed knowledge of IRIB's broadcast infrastructure and may have involved insider assistance or coordination between groups.
Aug 15, 2026