Loading story…
Twitter’s website was briefly hijacked after attackers using the name “Iranian Cyber Army” compromised the company’s DNS records and redirected visitors to a black defacement page carrying political messages, an Iranian flag, and contact details. The outage lasted about an hour, and users attempting to reach Twitter.com were sent to the spoofed page instead of the service.
Reporting indicated the redirection was carried out with a valid Twitter username and password, suggesting the incident stemmed from compromised internal credentials rather than a vulnerability at DNS provider Dyn. Twitter said the DNS issue was fixed quickly and that its API and platform applications continued operating during the disruption, while the attack drew added attention because of Twitter’s role in communications around Iran’s disputed election protests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
By about 7:40 a.m. on 2009-12-18, Twitter said the DNS issue had been fixed and service to Twitter.com was restored. The company stated that its DNS records had been temporarily compromised and said it would provide more details after further investigation.
Around 10 p.m. on 2009-12-17, attackers used valid Twitter credentials to alter the company's DNS records, taking Twitter.com offline for about an hour and redirecting visitors to a page claiming responsibility as the 'Iranian Cyber Army.' The defacement displayed political messaging and an Iranian flag, while Twitter's API and applications reportedly continued to function.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcewired.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran’s state broadcaster, **Islamic Republic of Iran Broadcasting (IRIB)**, suffered a brief satellite broadcast hijack that replaced regular programming with footage of anti-regime protests, messages from exiled Crown Prince **Reza Pahlavi**, and appeals for security forces to defect and support demonstrators. The intrusion reportedly lasted about 10 minutes before authorities restored the feed. Anonymous-linked social media accounts, including **@YourAnonTV**, claimed responsibility under the `#OpIran` banner in cooperation with Iranian hackers, but attribution remained unconfirmed. The disruption reportedly affected satellite transmissions carried via the **Badr** satellite and quickly spread online through opposition and social media channels. The incident echoed earlier periods of unrest in Iran, where authorities have tightly controlled communications, including a nationwide shutdown that cut access to foreign internet services while leaving domestically hosted sites reachable through Iran’s so-called **National Internet**. The broadcast hijack adds to a pattern of symbolic attacks on state media infrastructure during politically sensitive moments, though no confirmed link was established to more advanced actors such as **Predatory Sparrow**.
Jun 29, 2026
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026
Military strikes by the United States and Israel against Iranian targets on **February 28, 2026** were followed within hours by a sharp escalation in cyber activity across the Middle East. Reporting describes widespread **DDoS attacks, website compromises, defacements, and breach claims**, with more than 150 hacktivist incidents reportedly claimed in the first two days of the crisis. Iranian connectivity was heavily disrupted, including outages affecting **IRNA**, while **Tasnim News** was reportedly compromised and displayed anti-regime messaging. The most affected sectors were identified as **government, aerospace and defense, and technology**, and regional states including **Israel, Kuwait, Jordan, Bahrain, Qatar, and the UAE** saw elevated cyber pressure. The surge also expanded beyond immediate regional targets, with security reporting warning that the conflict was driving attacks against global commercial sectors such as **travel, hospitality, and energy**. One cited example was a **March 11** claim by **Handala**, a hacktivist group alleged to have ties to Iranian intelligence, that it had conducted a large-scale **data-wiping attack** against medical technology company **Stryker**, allegedly destroying several terabytes of data. Additional reporting noted unconfirmed concerns that Iranian-linked actors could target the physical and digital infrastructure of major U.S. technology firms. The activity reflects a broader pattern of **geopolitically motivated cyber operations** acting as a force multiplier alongside kinetic conflict, rather than a standalone marketing or advisory narrative.
Jun 30, 2026