Overview
- Independent monitors including NetBlocks and Cloudflare report Iran’s connectivity has hovered near 1% of normal levels for more than 48 hours, with traffic drops first recorded around 07:06 and 11:47 GMT on February 28.
- Network analysts say the pattern resembles prior state‑ordered shutdowns with limited 'whitelisted' access, though public attribution for concurrent cyber disruptions remains unconfirmed.
- The widely used BadeSaba prayer app was compromised to push notifications urging security forces to surrender or defect, while state media sites such as IRNA and ISNA experienced outages or defacements.
- Cybersecurity firms including CrowdStrike, Sophos and Halcyon say Iranian‑aligned actors are conducting reconnaissance and DDoS activity and caution that wiper or ransomware operations could follow, with energy and other critical sectors at risk.
- The digital operations accompanied Operation Epic Fury’s kinetic strikes by the United States and Israel, and reports on the status of senior Iranian leaders remain contradictory across outlets.