Iran has throttled internet access in the country in a purported attempt to hamper Israel’s ability to conduct covert cyber operations, days after the latter launched an unprecedented attack on the country, escalating geopolitical tensions in the region.
Fatemeh Mohajerani, the spokesperson of the Iranian Government, and the Iranian Cyber Police, FATA, said the internet slowdown was designed to maintain internet stability and that the move is “temporary, targeted, and controlled, to ward off cyber attacks.” Data shared by NetBlocks shows a “significant reduction in internet traffic” around 5:30 p.m. local time.
The development comes amid deepening conflict, with Israel and Iran trading missile attacks since Friday. These attacks have spilled over into cyberspace, as security experts warned of retaliatory cyber operations by Iranian state actors and hacktivist groups.
The digital conflict unfolding behind the scenes goes two ways. Earlier this week, a pro-Israeli group known as Predatory Sparrow claimed responsibility for a cyber attack on Iran’s Bank Sepah, crippling access to its website and ATMs.
“‘Bank Sepah’ was an institution that circumvented international sanctions and used the people of Iran’s money to finance the regime’s terrorist proxies, its ballistic missile program, and its military nuclear program,” the group said in a public statement posted on X.
Predatory Sparrow also said it sabotaged the bank’s infrastructure with help from “brave Iranians,” adding “This is what happens to institutions dedicated to maintaining the dictator’s terrorist fantasies.” Israel has a storied history of sophisticated cyber operations, most notably the Stuxnet attack targeting Iran’s nuclear program.
Tel Aviv-based cybersecurity firm Radware said it has observed heightened activity from threat actors affiliated with Iran across public and private Telegram channels.
Some of the groups, including Mysterious Team Bangladesh and Arabian Ghost, have warned neighboring countries Jordan and Saudi Arabia against supporting Israel and claimed to have shut down Israeli radio stations.
Furthermore, the Iranian government has also urged citizens to delete WhatsApp, one of the country’s most popular messaging platforms, stating without giving any evidence that the Meta-owned app has been weaponized by Israel to spy on its users.
WhatsApp has denied the allegations. In a statement to the Associated Press, the company said it does not track users nor does it provide “bulk information to any government.”
The cyber conflict also follows an announcement from the U.S. Department of State that they were seeking information on Iranian hackers who they accused of targeting critical infrastructure in the U.S., Israel, and other countries using the IOCONTROL (aka OrpaCrab) malware to breach Industrial Control Systems (ICS).
“Cyber Av3ngers, which is associated with the online persona Mr. Soul, has launched a series of malicious cyber activities against U.S. critical infrastructure on behalf of Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC),” the department’s Rewards for Justice (RFJ) program said.
“Cyber Av3ngers actors have utilized malware known as IOCONTROL to target ICS/SCADA devices used by critical infrastructure sectors in the United States and worldwide.”
