Loading story…
French broadcaster TV5Monde was knocked off the air after attackers seized control of its broadcast and IT systems, disrupted programming across multiple channels, defaced its websites and social media accounts, and posted material claiming allegiance to the so-called CyberCaliphate. The intrusion also exposed personal information linked to relatives of French soldiers and triggered emergency meetings across French media organizations, which treated the incident as an unprecedented attack on a national broadcaster.
Subsequent reporting said the operation was far more destructive than the initial pro-ISIS branding suggested, with French officials and investigators later attributing the attack to a Russian state-linked group rather than Islamic State supporters. The breach became a high-profile example of cyber-enabled sabotage against media infrastructure, and TV5Monde drew further scrutiny after a televised interview inadvertently revealed internal credentials, underscoring weak operational security during the response.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
By 2016-10-10, French investigators had concluded the TV5Monde attack was likely carried out by the Russian-linked APT28 group rather than ISIS sympathizers. The case became a notable example of false-flag cyber attribution using a jihadist cover identity.
On 2015-04-09, during television coverage of the aftermath, TV5Monde staff were filmed in front of a whiteboard displaying what appeared to be internal account passwords. Security observers warned this disclosure could create additional risk while the broadcaster was recovering from the breach.
On 2015-04-09, French media organizations planned or held an emergency meeting in response to the unprecedented attack on TV5Monde. The incident prompted broader concern about the cyber resilience of French broadcasters.
During the 2015-04-08 attack, the compromised TV5Monde platforms were used to post personal information purportedly linked to relatives of French soldiers and messages protesting France's military actions against ISIS. The disclosures heightened concern about the attack's psychological and propaganda impact.
On 2015-04-08, French broadcaster TV5Monde suffered a major cyberattack that knocked multiple television channels and digital services offline. Attackers claiming to be the 'CyberCaliphate' also defaced the network's websites and social media accounts.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcebbc.co.uk
Open sourcearstechnica.com
Open sourcetelegraph.co.uk
Open sourceindependent.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected cyberattack disrupted services at **La Poste**, France’s state-owned postal operator, affecting both postal operations and its banking subsidiary, **La Banque Postale**. The incident caused outages across customer-facing systems and internal services, prompting the company to activate response measures while working to restore operations and assess the scope of the intrusion. Two days after the disruption became public, a **pro-Russian hacking group** claimed responsibility for the attack, escalating concerns that the incident may have been politically motivated rather than ordinary cybercrime. French authorities and the company continued investigating the breach and its impact, while the claim added to broader worries about hostile cyber activity targeting critical national services in France.
Jul 12, 2026
The French Interior Ministry confirmed a cyberattack that compromised its email servers, allowing attackers to access certain document files. In response, the ministry implemented enhanced security protocols and access controls, while an investigation was launched to determine the origin and scope of the breach. Authorities have not yet confirmed whether any data was stolen, and are considering multiple possible motives, including foreign interference, hacktivism, or cybercrime. The Interior Ministry, which oversees police, internal security, and immigration, is considered a high-value target for both state-sponsored and criminal actors. The incident was reported in several news roundups, highlighting its significance within the broader context of European cybersecurity threats. While attribution has not been established for this specific attack, previous campaigns against French government entities have been linked to Russian state-sponsored groups such as APT28. The breach underscores ongoing concerns about the vulnerability of critical government infrastructure to sophisticated cyber threats and the need for robust incident response and investigation procedures.
Jun 29, 2026
A cyberattack against Iran's state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), briefly hijacked live programming and deployed a destructive malware toolkit inside the broadcaster's environment. During the intrusion, broadcasts were interrupted to display images of **Maryam and Massoud Rajavi** and a message calling for the assassination of Supreme Leader **Ayatollah Ali Khamenei**, indicating the operation combined political messaging with sabotage of media operations. Check Point's investigation said the attackers used multiple custom components, including backdoors, batch scripts, configuration files, and a wiper designed to corrupt files, erase the **master boot record (MBR)**, clear Windows Event Logs, delete backups, kill processes, and change user passwords. The attackers also deleted the executable for the **TFI Arista Playout Server** and forced a malicious video file, `TSE_90E11.mp4`, to loop on air; researchers said they could not confirm attribution or the initial access vector, but assessed the operation showed detailed knowledge of IRIB's broadcast infrastructure and may have involved insider assistance or coordination between groups.
Aug 15, 2026