Loading story…
Iran’s state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), suffered a brief satellite broadcast hijack that replaced regular programming with footage of anti-regime protests, messages from exiled Crown Prince Reza Pahlavi, and appeals for security forces to defect and support demonstrators. The intrusion reportedly lasted about 10 minutes before authorities restored the feed. Anonymous-linked social media accounts, including @YourAnonTV, claimed responsibility under the #OpIran banner in cooperation with Iranian hackers, but attribution remained unconfirmed.
The disruption reportedly affected satellite transmissions carried via the Badr satellite and quickly spread online through opposition and social media channels. The incident echoed earlier periods of unrest in Iran, where authorities have tightly controlled communications, including a nationwide shutdown that cut access to foreign internet services while leaving domestically hosted sites reachable through Iran’s so-called National Internet. The broadcast hijack adds to a pattern of symbolic attacks on state media infrastructure during politically sensitive moments, though no confirmed link was established to more advanced actors such as Predatory Sparrow.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
After the January 18, 2026 IRIB broadcast intrusion, Anonymous, primarily through the @YourAnonTV account on X, claimed responsibility and said it acted with Iranian hackers under the #OpIran banner. The article notes that this attribution remained unconfirmed.
On January 18, 2026, around 9:30 PM Tehran time, Iran's state broadcaster IRIB suffered a brief satellite broadcast hijack that replaced normal programming with anti-regime protest footage, messages from Reza Pahlavi, and calls for security forces to defect. The intrusion reportedly lasted up to about 10 minutes before authorities reversed it.
During the November 2019 fuel protests, users in Iran lost access to websites and applications hosted outside the country, including Google and WhatsApp, while mobile internet was also unavailable. Domestically hosted Iranian sites remained reachable, effectively confining users to Iran's national intranet.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Iranian state television channels transmitted via the **Badr satellite** were reportedly hijacked, briefly interrupting normal programming to air protest footage and **anti-regime messages**. Circulating videos showed Farsi-language calls for demonstrators to continue protests, clips of solidarity rallies abroad, and an on-air appearance by exiled opposition figure **Reza Pahlavi** urging further demonstrations and calling on Iran’s military and security forces to side with protesters; the footage was shared by outlets including **Iran International** and Pahlavi’s media team. The unauthorized broadcast was reported to have lasted roughly **10 minutes**, and the responsible party was not immediately identified; independent verification of the footage was not confirmed in reporting. The incident occurred amid broader political and economic unrest in Iran, with reporting linking the context to recent protests driven by economic deterioration and allegations of corruption and mismanagement. Iranian authorities had not publicly commented at the time of reporting, and the event followed a period in which Iran imposed a near-total shutdown of internet and mobile communications during the unrest, with indications that restrictions might later be eased.
Jun 29, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026