Loading story…
A cyberattack knocked thousands of gas stations across Iran out of service by disrupting the National Iranian Oil Products Distribution Company’s fuel distribution network and disabling the government-issued smart cards used to buy subsidized gasoline. The outage affected more than 3,500 stations, triggered long lines and delays for motorists, and forced some customers to pay unsubsidized prices while authorities worked to restore service.
Screens at pumps and electronic billboards in several cities displayed protest-style messages including “cyberattack 64411” and “Khamenei! Where’s our fuel?”, referencing a phone number associated with Supreme Leader Ali Khamenei’s office. Iranian officials said the operation appeared intended to spark public anger and disorder, and state media described it as a cyberattack likely originating from abroad, though no public attribution was confirmed; the messaging and tradecraft echoed a July attack on Iran’s railway system that used the same 64411 reference.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
On 2021-10-27, Iranian President Ebrahim Raisi said the cyberattack appeared intended to provoke chaos and anger among the public at gas stations. His remarks framed the incident as a deliberate attempt to destabilize the country through disruption of fuel access.
On 2021-10-26, Iranian state media and officials publicly described the fuel outage as a cyberattack. Iran’s Supreme Council of Cyberspace assessed it as likely state-sponsored, while other officials said it may have originated from abroad but did not publicly identify a perpetrator.
During the 2021-10-26 disruption, gas pump systems and electronic road billboards in multiple Iranian cities displayed protest-style messages including “cyberattack 64411” and references to Supreme Leader Ali Khamenei’s office number. The messaging echoed a similar pattern seen in the July 2021 Iranian railway cyberattack.
On 2021-10-26, a cyberattack hit the National Iranian Oil Products Distribution Company fuel distribution network, disrupting service at gas stations across Iran. The outage affected the government-issued electronic fuel card system used for subsidized gasoline and caused long lines and delays for motorists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
npr.org
Open sourcethreatpost.com
Open sourceapnews.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026
Reporting on Iran’s domestic instability and state pressure indicates **cryptocurrency usage has expanded sharply** as both a financial outlet for citizens and a funding channel for regime-linked actors. Chainalysis assessed Iran’s crypto ecosystem at **~$7.78B in 2025**, with activity correlating to political events and conflict; it also reported that **IRGC-linked on-chain activity represented ~50% of Iran’s total crypto activity in Q4 2025** and has been increasing over time. The same analysis noted that during recent mass protests, Iranians **increased Bitcoin withdrawals to personal wallets**, consistent with capital flight behavior amid currency collapse and political instability. Separately, AlphaHunt reported telemetry consistent with an **intentional national internet shutdown** in Iran on **2026-01-08** (traffic falling to near-zero), alongside indicators such as a **~98.5% drop in IPv6 routing announcements** observed by Cloudflare earlier that day. Based on prior patterns of Iran-linked operations (e.g., **APT42**), the post-blackout period is assessed as higher risk for **rapid phishing, credential theft, and account takeovers** targeting officials, journalists, and dissidents—driven more by “regime security” requirements (identification, monitoring, intimidation) than by novel technical exploitation.
Jun 29, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026