Loading story…
Iran remained under a near-total government-imposed internet blackout for more than 10 days, with Cloudflare Radar showing HTTP traffic falling by roughly 98% from pre-shutdown levels to below 1% of normal beginning around 07:00 UTC on February 28. Reporting indicates the disruption affected all major regions and the country’s largest networks simultaneously, including MCCI (AS197207), IranCell (AS44244), and TCI (AS58224), supporting assessments that the outage was a centrally coordinated national shutdown rather than a cyberattack or physical infrastructure failure.
At the same time, Iranian state and IRGC-linked messaging signaled an escalation of the wider conflict toward economic targets, warning that banks and commercial infrastructure tied to the U.S. and Israel could be considered legitimate targets after an alleged strike on a bank in Tehran. Iranian outlets reportedly named major technology firms including Nvidia, Microsoft, Google, Oracle, IBM, and Palantir in connection with facilities in Israel and the broader Middle East, while warning civilians to avoid areas near banks. Together, the reporting points to a broader campaign in which Iran is both restricting domestic connectivity and publicly threatening regional economic and technology infrastructure as the conflict expands.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By April 11, Iran's nationwide internet shutdown had exceeded 1,000 hours and more than 43 days, making it one of the longest country-scale outages measured by NetBlocks. Reporting said authorities were sustaining the blackout through whitelisting on the National Information Network while also using military-grade jamming and severe criminal penalties to deter Starlink use.
On the 12th day of the conflict, Iranian state and IRGC-affiliated media said Iran would target economic centers and banks tied to the US and Israel after an alleged Israeli strike on a Tehran bank branch that reportedly killed employees. Tasnim published a list of alleged new targets linked to US military technology, naming companies including Nvidia, Google, Microsoft, Oracle, IBM, and Palantir, while Khatam al-Anbiya warned people to stay at least one kilometer away from banks.
Since the conflict began, Middle East data centers were reportedly affected by drone attacks, with Iran claiming it targeted AWS regional data centers in the UAE and Bahrain because they host US military workloads. The reporting framed these strikes as part of a broader expansion into infrastructure-related conflict.
Cloudflare Radar showed Iranian HTTP traffic staying below 1% of normal levels through at least March 10, indicating a centrally coordinated, near-total national blackout. Access was reportedly restricted to approved services on Iran's domestic National Information Network.
Around 07:00 UTC, Iran's nationwide internet traffic collapsed by about 98% as joint US and Israeli military strikes began. NetBlocks assessed the outage as a government-enforced shutdown rather than the result of cyberattack or physical infrastructure damage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcecybersecuritynews.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
Regional conflict following **U.S.–Israeli strikes on Iran** has been accompanied by heightened cyber and electronic-warfare activity affecting both military operations and civilian infrastructure. U.S. officials publicly acknowledged that **U.S. Cyber Command**, alongside space capabilities, conducted “non-kinetic” operations to **disrupt Iranian communications and sensor networks** in support of *Operation Epic Fury*, describing effects intended to degrade Iran’s ability to coordinate and respond; reporting also noted follow-on hack-and-leak style activity against Iranian-facing online properties (e.g., news sites and an app) and warned of potential retaliatory cyber activity by Iranian-aligned actors. In parallel, maritime intelligence reporting described a sharp increase in **GPS/AIS disruption (jamming/spoofing)** impacting shipping around the Strait of Hormuz, with vessels appearing in false locations and maritime authorities warning of elevated risk to navigation and safety. Iran’s domestic crypto ecosystem also showed signs of stress consistent with conflict conditions and connectivity constraints: observers reported **internet outages**, exchanges moving into risk-containment modes (e.g., batching/suspending withdrawals), and temporary restrictions on the **USDT–toman** trading pair under central bank direction—collectively reducing liquidity and market activity rather than clearly indicating capital flight. Separate reporting on Pakistan’s TV broadcast hijacks and a DDoS incident affecting Russian government sites appear unrelated to the Iran conflict-driven activity described above.
Jun 29, 2026