Iran's state-owned TV broadcaster was hacked Wednesday night to interrupt regular programming and air videos calling for street protests against the Iranian government, according to multiple reports.
It's currently not known who is behind the attack, although Iran pointed fingers at Israel, per Iran International.
"If you experience disruptions or irrelevant messages while watching various TV channels, it is due to enemy interference with satellite signals," the broadcaster was quoted as saying.
The breach of state television is the latest in a string of cyber attacks inside Iran that have been attributed to Israel-linked actors. It also coincides with the hack of Bank Sepah and Nobitex, Iran's largest cryptocurrency exchange.
The Nobitex breach led to the theft of more than $90 million, a brazen escalation in the cyber war that has simmered between Israel and Iran for more than a decade.
"Iranian entities have experimented with virtual assets as both a financial workaround and as a strategic asset to support broader geopolitical ambitions — including the proliferation of advanced weapons technology," TRM Labs said. "This latest incident highlights how crypto exchanges, once peripheral to conflict, are increasingly becoming strategic targets for geopolitical actors."
The latest development also follows the revelation from Israeli officials that Iran is hijacking private security cameras installed in Israel to gather real-time intelligence, mirroring a similar tactic used by Russia after its invasion of Ukraine in 2022.
"We know that in the past two or three days, the Iranians have been trying to connect to cameras to understand what happened and where their missiles hit to improve their precision," Refael Franco, the former deputy director general of the Israel National Cyber Directorate, said.
 |
| Groups claiming DDoS attacks targeting Israel between June 13 and June 18, 2025 | Source: Radware |
Cybersecurity firm Radware said nearly 40% of all hacktivist DDoS activity has been directed against Israel since the onset of the latest flare-up. On June 17, the hacktivist group DieNet warned it would launch cyber-attacks at the United States should it join the conflict against Iran.
The message has since been amplified by other groups like Arabian Ghosts, Sylhet Gang, and Team Fearless, suggesting that these entities are forming a potential collaboration in cyberspace as battle rages on the ground.
"Companies are urged to take maximum vigilance. The warning signs are clear. Critical infrastructure, supply chains, and even global businesses could become collateral targets if the cyber crossfire intensifies," said Pascal Geenens, director of threat intelligence at Radware.
"The Israel-Iran conflict of 2025 is a stark illustration of modern hybrid warfare, where bytes and narratives are as much a part of the fight as bombs and missiles."
In a two-part analysis, CloudSEK said more than 35 distinct pro-Iranian groups have launched coordinated attacks against Israeli infrastructure, as opposed to only less than half-a-dozen pro-Israeli groups engaging in hacktivist activity.
"The attacks predominantly consisted of DDoS assaults, website defacements, and claimed data breaches targeting government sites, military systems, and critical infrastructure," security researcher Pagilla Manohar Reddy said.
"Most significantly, these recent attacks maintain the same pattern of exaggeration and disinformation that has characterized the broader hacktivist ecosystem, with groups continuing to take credit for unrelated service outages, recycle old data leaks, and inflate damage claims for media attention rather than achieving substantial operational impact."
