As President Donald Trump confirms that the U.S. military has commenced “major military operations in Iran,” something that the Department of Defence has called Operation Epic Fury, confirmed reporting has revealed that Iran has been plunged into a near-total internet blackout, with nationwide connectivity running at just 4%.
NetBlocks, an independent internet watchdog monitoring cybersecurity and internet governance in real-time, reports on government-imposed internet shutdowns using network measurement data and web analytics. Its Internet Observatory platform can show, in real time, when entire regions go offline. And that is what appears to have happened beginning 07:00 UTC, February 28. “Confirmed: Network data show Iran is now in the midst of a near-total internet blackout with national connectivity at 4% or ordinary levels,” NetBlock posted to X, adding that “the incident comes amid U.S. and Israeli combat operations and matches measures used during last year’s war with Israel.”
According to another reliable network monitor, Cloudflare Radar, which also provides real-time data regarding global internet traffic, internet traffic is currently “close to zero across all major regions,” with Tehran, Fars, Isfahan, Alborz Province, and Razavi Khorasan, experiencing a “near-complete shutdown.”
There is no evidence to suggest that this is a cybersecurity attack by either Israeli or American cyber forces, but rather would appear to be an escalation of the internet shutdowns that the Iranian regime implemented, beginning January 8, following national domestic protests and unrest within the country.
The BBC has reported that it was able to briefly connect with Iranian contacts using SpaceX’s Starlink satellite internet, but it is currently unclear if, or when, such connectivity will reappear.
What is clearer, considering that the small amount of connectivity that has been reported in Iran, 4% is at the top end of the data, is likely to belong to government, military and official sources. And that will have an impact upon cybersecurity, but not perhaps in the way you might imagine. As Evan Schuman, a reporter for CSO Online, predicted during the earlier Iranian internet shutdowns, “the signal to noise ratio in that country is flipped, which could allow digital fingerprinting of the key paths that Iranian state actors use.” And that is important because Iran is a major player when not comes to offensive cybersecurity operations. As Kaveh Ranjbar, CEO of Whisper Security, said. “Advanced Persistent Threat groups routinely co-opt benign government infrastructure to launch attacks,” but when these boring servers become the only route to use, they no longer hide, but reveal, true intent. “A connection from the Ministry of Agriculture might not be a farmer. It’s likely a tunnel for a state actor who needs an exit node.”
Lisa Forte, partner at Red Goat Cyber Security, told me that “typically we see a spike in cyber attacks when any conflicts erupt. This can be from nation states, but often we see a sharp rise in cyber hacktivist activity.” So, it’s worth bearing in mind that the likely cyber-impact will go beyond actions of war itself. “Hacktivists from around the world, supporting either side, can cause disruption to services, unavailability and even defacement of websites and even data theft,” Forte warned.
Iran, on the other hand, will not only be considering the restriction of a news narrative contrary to its own by shutting down internet access, but could also be doing this as a cyber-defense measure to limit both reconnaissance and actual cyberattacks against infrastructure. This is a breaking story, and no doubt more information will emerge in the coming hours and days.