Cyber Operations Accompany U.S.-Israeli Strikes on Iran
Early Saturday, a series of cyberattacks unfolded alongside joint U.S.-Israeli military strikes targeting locations across Iran. Cybersecurity experts and observers reported disruptions, including the hacking of Iranian news websites and the compromise of BadeSaba, a widely used religious calendar app with over 5 million downloads. The app displayed messages urging users many of them government supporters to abandon weapons and join opposition movements.
Internet connectivity in Iran experienced sharp drops at 0706 GMT and again at 1147 GMT, according to Doug Madory, director of internet analysis at Kentik. The cyber operations also targeted Iranian government services and military systems, likely to hinder coordinated retaliation, though Reuters has not independently verified these claims.
Security researchers noted the strategic nature of the attacks. Hamid Kashfi, founder of cybersecurity firm DarkCell, highlighted the BadeSaba hack as particularly effective due to its user base among religious and pro-government circles. Meanwhile, cybersecurity firms warned of escalating activity from Iranian-aligned threat actors, including reconnaissance efforts, DDoS attacks, and data-wiping operations against Israeli targets.
Pro-Iranian hacktivist groups have historically conducted hack-and-leak campaigns, ransomware attacks, and disruptive DDoS operations. Analysts suggest the current activity may signal preparations for more aggressive cyber operations, though Iran’s past responses to strikes on its soil have been limited. In June, following U.S. attacks on Iranian nuclear facilities, cyber retaliation was minimal, with only brief service disruptions reported in Albania.
Source: https://arizonadigitalfreepress.com/hackers-hit-iranian-apps-websites-after-us-israeli-strikes/
Badesaba | بادصبا cybersecurity rating report: https://www.rankiteo.com/company/badesaba
"id": "BAD1772735632",
"linkid": "badesaba",
"type": "Cyber Attack",
"date": "9/2022",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '5M+ users (government '
'supporters and religious '
'circles)',
'industry': 'Religious/Utility',
'location': 'Iran',
'name': 'BadeSaba',
'size': '5M+ downloads',
'type': 'Mobile Application'},
{'industry': 'Public Sector',
'location': 'Iran',
'name': 'Iranian Government Services',
'type': 'Government'},
{'industry': 'Defense',
'location': 'Iran',
'name': 'Iranian Military Systems',
'type': 'Military'},
{'industry': 'News',
'location': 'Iran',
'name': 'Iranian News Websites',
'type': 'Media'}],
'attack_vector': ['Application Exploit',
'Website Defacement',
'Network Disruption'],
'date_detected': '2023-10-28T07:06:00Z',
'date_publicly_disclosed': '2023-10-28',
'description': 'A series of cyberattacks unfolded alongside joint '
'U.S.-Israeli military strikes targeting locations across '
'Iran. Disruptions included the hacking of Iranian news '
'websites and the compromise of BadeSaba, a widely used '
'religious calendar app. Internet connectivity in Iran '
'experienced sharp drops, and Iranian government services and '
'military systems were targeted to hinder coordinated '
'retaliation.',
'impact': {'brand_reputation_impact': 'High (for BadeSaba and Iranian '
'government entities)',
'operational_impact': 'Hindrance of coordinated retaliation '
'efforts',
'systems_affected': ['Government Services',
'Military Systems',
'News Websites',
'Mobile Applications']},
'investigation_status': 'Ongoing',
'motivation': ['Strategic Disruption',
'Psychological Warfare',
'Hindering Retaliation'],
'references': [{'date_accessed': '2023-10-28', 'source': 'Reuters'},
{'date_accessed': '2023-10-28',
'source': 'Kentik (Doug Madory)'},
{'date_accessed': '2023-10-28',
'source': 'DarkCell (Hamid Kashfi)'}],
'stakeholder_advisories': 'Cybersecurity firms warn of escalating activity '
'from Iranian-aligned threat actors, including '
'reconnaissance, DDoS, and data-wiping operations.',
'threat_actor': ['State-Sponsored (U.S./Israel)',
'Hacktivist Groups (Pro-Iranian)'],
'title': 'Cyber Operations Accompanying U.S.-Israeli Strikes on Iran',
'type': ['Cyberattack', 'Disinformation', 'DDoS']}