The digital front: Iran’s internet down for second day amid reports of U.S.-Israel cyberattacks

Iran is experiencing a significant internet outage, now entering its second day, coinciding with ongoing U.S.-Israeli airstrikes. Data from the independent monitoring group NetBlocks revealed that connectivity has plummeted to roughly 1% of normal levels, indicating a severe nationwide blackout. This situation has been labeled a "regime-imposed" shutdown, although Iranian officials have yet to issue any statements regarding the blackout. Historically, the Iranian government has utilized internet blackouts as a strategy during periods of civil unrest, with a notable instance occurring in January that lasted several weeks and obscured serious human rights abuses. NetBlocks pointed out that such tactics have been a recurring method for the regime to control information during crises. Internet analyst Doug Madory noted on social media platform X that the limited online activity might stem from a government strategy of whitelisting, which allows a select few groups loyal to the regime to maintain access. Meanwhile, reports have surfaced indicating that U.S. and Israeli cyber actors have been targeting Iranian internet infrastructure alongside the airstrikes. According to a Reuters report, multiple Iranian news outlets have been compromised through hacking attempts. One particularly alarming incident involved the BadeSaba Calendar app, which has over 5 million downloads. Users reported receiving alarming messages prompting military personnel to abandon their weapons and join the civilian protests, with alerts declaring "It's time for reckoning." Attempts to obtain comments from U.S. Cyber Command and the owners of the BadeSaba app have been unsuccessful. In earlier incidents, Iranian state television faced a hack that featured speeches by former U.S. President Donald Trump, alongside calls for public uprisings from the exiled son of Iran’s last monarch. As tensions escalate, analysts warn that Iranian-backed groups may resort to cyberattacks in retaliation against U.S. and allied interests in the region. Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, stated that they are observing activities typical of Iranian-aligned threat actors and hacktivists, which often precede more aggressive cyber operations. He highlighted that in past conflicts, Tehran's cyber units have strategically aligned their actions with broader military objectives targeting critical sectors, including energy, infrastructure, finance, telecommunications, and healthcare.