Loading story…
A cyberattack against Iran's state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), briefly hijacked live programming and deployed a destructive malware toolkit inside the broadcaster's environment. During the intrusion, broadcasts were interrupted to display images of Maryam and Massoud Rajavi and a message calling for the assassination of Supreme Leader Ayatollah Ali Khamenei, indicating the operation combined political messaging with sabotage of media operations.
Check Point's investigation said the attackers used multiple custom components, including backdoors, batch scripts, configuration files, and a wiper designed to corrupt files, erase the master boot record (MBR), clear Windows Event Logs, delete backups, kill processes, and change user passwords. The attackers also deleted the executable for the TFI Arista Playout Server and forced a malicious video file, TSE_90E11.mp4, to loop on air; researchers said they could not confirm attribution or the initial access vector, but assessed the operation showed detailed knowledge of IRIB's broadcast infrastructure and may have involved insider assistance or coordination between groups.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
On January 27, 2022, attackers breached Iran's state broadcaster IRIB, briefly hijacked an on-air broadcast for about 10 seconds, and displayed images of Maryam and Massoud Rajavi with a message calling for the assassination of Ayatollah Ali Khamenei. The intrusion also involved multiple custom malware components and a wiper intended to disrupt broadcasting operations and damage infected systems.
Check Point published findings on the IRIB attack, detailing the malware toolkit, including backdoors, batch scripts, and a wiper, and describing how the attackers deleted the TFI Arista Playout Server executable and looped a malicious video file. The company said it could not formally attribute the attack or determine the initial access vector, while assessing that the operation showed strong internal knowledge of IRIB's environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran’s state broadcaster, **Islamic Republic of Iran Broadcasting (IRIB)**, suffered a brief satellite broadcast hijack that replaced regular programming with footage of anti-regime protests, messages from exiled Crown Prince **Reza Pahlavi**, and appeals for security forces to defect and support demonstrators. The intrusion reportedly lasted about 10 minutes before authorities restored the feed. Anonymous-linked social media accounts, including **@YourAnonTV**, claimed responsibility under the `#OpIran` banner in cooperation with Iranian hackers, but attribution remained unconfirmed. The disruption reportedly affected satellite transmissions carried via the **Badr** satellite and quickly spread online through opposition and social media channels. The incident echoed earlier periods of unrest in Iran, where authorities have tightly controlled communications, including a nationwide shutdown that cut access to foreign internet services while leaving domestically hosted sites reachable through Iran’s so-called **National Internet**. The broadcast hijack adds to a pattern of symbolic attacks on state media infrastructure during politically sensitive moments, though no confirmed link was established to more advanced actors such as **Predatory Sparrow**.
Jun 29, 2026
A cyberattack disrupted Iran’s railway system and defaced station displays with taunting messages that told stranded passengers to call the office number of Supreme Leader Ali Khamenei. Researchers later reconstructed the operation, dubbed **MeteorExpress**, and found it used a previously unseen wiper malware family named **Meteor** to cripple systems across the rail environment. The disruption was followed by reported attacks on the website and computer systems of Iran’s Ministry of Roads and Urban Development. SentinelOne said the attackers deployed the malware through **Group Policy** and a chain of **CAB** and **RAR** archives, batch scripts, and multiple payloads designed to wipe files, lock users out, disable recovery options, clear logs, and likely corrupt the **MBR**. The tooling combined destructive capabilities with configurable components that suggested the malware was built for reuse, while the operation itself indicated the actor likely had prior knowledge of the victim environment and conducted reconnaissance before launch. Researchers did not attribute the campaign to a known threat group, describing the operators as an apparently new actor with mixed signs of clumsy execution and notable sophistication.
Aug 15, 2026
**Handala Hack**, an online persona tied to **Void Manticore** and assessed by multiple researchers as linked to Iran’s **Ministry of Intelligence and Security (MOIS)**, is being tracked for destructive intrusions involving **wiper attacks** and related hack-and-leak activity against organizations in **Israel** and the **United States**. Public reporting cited by Unit 42 says attackers gained access to corporate networks using legitimate user credentials, while recent tradecraft includes phishing, identity compromise, and abuse of administrative access through **Microsoft Intune**. Israel’s National Cyber Directorate warned that several incidents involved deletion of servers and workstations to disrupt operations, reinforcing concern that the current regional conflict is increasing the likelihood of further destructive cyber activity. Technical reporting indicates the actor continues to favor **hands-on-keyboard** operations, multiple wiping methods, and a mix of custom and publicly available tooling. Check Point said newly observed techniques include use of **NetBird** for tunneling and an **AI-assisted PowerShell** script for wiping, while Blackpoint’s advisory highlighted a broader Iranian threat posture featuring credential theft, phishing, password spraying, remote management tools, and exfiltration utilities such as **Rclone**. The combined reporting points to a near-term risk of disruptive attacks focused on identity compromise, lateral movement, data theft, and system destruction, particularly for organizations with exposed services, weak privilege controls, or insufficiently protected administrative accounts.
Jun 29, 2026