Loading story…
Iran experienced a near-total internet blackout affecting roughly 90 million people, with monitoring indicating about a 99% drop in outbound traffic and only limited, likely whitelisted connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed US and Israeli strikes on February 28 that killed Iran’s Supreme Leader Ali Khamenei, and that the state continued to route domestic activity through its National Information Network (NIN), keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via Starlink gateways.
Separate open-source reporting using Planet Labs PlanetScope satellite imagery documented damage consistent with strikes on Iranian police stations, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
During the conflict and nationwide internet blackout, Holistic Resilience developed the Mahsa Alert app to help civilians identify threats and find hospitals, shelters, blood banks, and checkpoints. The group reportedly validated alerts using crowdsourced reports, open-source intelligence, Telegram messages, social media, and CCTV footage while facing hacking, misinformation, and accusations from Iranian authorities.
By March 20, NetBlocks characterized Iran's connectivity loss as a near-total blackout that had continued for 20 straight days. Reports said some Iranians were relying on Starlink, black-market VPNs, and custom circumvention tools, while authorities increased warnings, enforcement, and arrests tied to bypass services.
By March 6, Iran's nationwide outage had lasted more than six days, with researchers warning that both deliberate restrictions and wartime damage to power or internet infrastructure were likely contributing to the disruption. Observers also reported selective or tiered access for government and elite users while most of the public remained cut off from the global internet.
Open-source analysis and corroborating imagery indicate that multiple police stations in Tehran were hit between March 1 and March 3, including sites near Ferdowsi Square and the Grand Bazaar. The strikes appeared to extend beyond widely reported military targets, though satellite imagery alone could not attribute responsibility.
After the February 28 strikes, Iranian authorities sharply restricted internet access, with monitoring groups reporting connectivity fell by about 99% to below 1%. The blackout affected nearly 90 million people and was described as a near-total nationwide shutdown.
According to the referenced reporting, the United States and Israel began large-scale strikes on Iran on February 28. The same account says the attack killed Supreme Leader Ayatollah Ali Khamenei and caused hundreds of deaths, citing the Iranian Red Crescent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
foxbusiness.com
Open sourcemiddleeasteye.net
Open sourcewired.com
Open sourcebellingcat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026
Iran remained under a **near-total government-imposed internet blackout** for more than 10 days, with Cloudflare Radar showing HTTP traffic falling by roughly **98%** from pre-shutdown levels to below **1% of normal** beginning around 07:00 UTC on February 28. Reporting indicates the disruption affected all major regions and the country’s largest networks simultaneously, including **MCCI (`AS197207`)**, **IranCell (`AS44244`)**, and **TCI (`AS58224`)**, supporting assessments that the outage was a centrally coordinated national shutdown rather than a cyberattack or physical infrastructure failure. At the same time, Iranian state and IRGC-linked messaging signaled an escalation of the wider conflict toward **economic targets**, warning that banks and commercial infrastructure tied to the U.S. and Israel could be considered legitimate targets after an alleged strike on a bank in Tehran. Iranian outlets reportedly named major technology firms including **Nvidia, Microsoft, Google, Oracle, IBM, and Palantir** in connection with facilities in Israel and the broader Middle East, while warning civilians to avoid areas near banks. Together, the reporting points to a broader campaign in which Iran is both restricting domestic connectivity and publicly threatening regional economic and technology infrastructure as the conflict expands.
Jun 29, 2026
Following coordinated **US-Israeli airstrikes** on Iran, reporting described a rapid escalation in state information controls, including a near-total **internet blackout** that cut the country off from external communications. Journalists and civil society actors were described as disproportionately impacted, facing a choice between attempting to circumvent restrictions—at personal risk—or losing the ability to report and document events; the blackout was framed as consistent with Iran’s prior crisis playbook of throttling or severing connectivity during unrest and security crackdowns. On-chain analysis also reported a sharp spike in **cryptoasset outflows from major Iranian exchanges** in the immediate aftermath of the strikes, totaling roughly **$10.3M** over a multi-day window. The activity was assessed as consistent with prior patterns in which Iranian crypto movements surge around geopolitical shocks and domestic instability, with potential drivers including citizen self-custody withdrawals, exchange infrastructure changes, or state-linked activity; attribution was described as premature pending follow-on tracing of onward fund flows.
Jun 29, 2026