Anonymous hacks Iran government and state broadcasters following nationwide internet shutdown

Anonymous mask overlooking a bright keyboard in a pitch-black room
(Image credit: Getty Images)

The hacktivist collective Anonymous has claimed responsibility for numerous attacks on Iranian government websites and state-affiliated media organisations after the country restricted access to social media services WhatsApp and Instagram.

Global internet monitor NetBlocks confirmed on Wednesday that both Instagram and WhatsApp servers were restricted through internet service providers, and a number of Iranian mobile operators were also “largely shut down”.

It is believed the state limited access as a result of the mounting protests against the death of 22-year-old Mahsa Amini who died shortly after being arrested by Iran’s ‘morality police’ unit for allegedly having some hair protruding from her headscarf.

Local journalists also reported other women being shot by “security forces” while protesting Amini’s death.

Anonymous announced its ‘OpIran’ campaign earlier this week after the news of Amini’s death began to circulate. The hacktivist collective said its efforts would be directed against the Iranian government.

Members of Anonymous have claimed many attacks, including one on the website dedicated to the president of Iran, but this has since been restored to working order.

The Iranian state-affiliated news agency Fars News was also one of the targets the hacktivists claimed and its website remains unreachable at the time of writing.

Screenshot showing Anonymous' successful attack on the website of Iran's medical research centre, displaying pro-protest messages rather than the site's genuine content in a Google index page

Also unreachable is Iran’s Legal Medicine Research Centre. The hacktivists breached a small SQL database belonging to the organisation and have replaced the site’s content with its own messages in support of the ongoing protests.

According to local media reports, Anonymous also successfully disrupted the state-controlled IRIB broadcaster and has committed to the ongoing targeting of “smart services”.

The group has repeatedly encouraged Iran’s citizens to access internet services through the TOR deep web onion router to circumvent the state’s internet restrictions.

Both WhatsApp and Instagram were among the last remaining social media platforms operating in Iran. Residents who can access social media offered varying reports about their level of internet and social media access.

Some have reported being unable to send videos, only texts, on WhatsApp and a complete outage of Instagram. Others say Instagram can be reached while using a virtual private network (VPN) but overall internet access is weakening, with WhatsApp entirely blocked.


Cyber resiliency and end-user performance

Reduce risk and deliver greater business success with cyber-resilience capabilities


Iran has not yet publicly commented on the hacktivist campaign against it or its intervention with social media and wider internet access for citizens.

The last major activity from Anonymous was in connection to the ongoing conflict between Ukraine and Russia. The hacktivists claimed attacks on the Russian Space Research Institute and state-backed broadcasters, among other short-lived disruptions to Russian government websites.

The collective is known for making political statements in the form of targeted cyber attacks the material impact of which has never been considered effective or long-lasting.

Iran has been under scrutiny in recent weeks since it was deemed culpable for a prolonged attack on the Albanian government, an incident which was discovered to have extended beyond a year and involved numerous hacking squads.

The UK and US publicly condemned Iran's espionage campaign which culminated in a destructive attack involving ransomware and wiper malware, the latter of which has been used increasingly frequently this year, especially by Russia against Ukraine.

Connor Jones

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.