The digital disruptions included the hacking of multiple Iranian news websites, which were defaced with political messaging, as well as a breach of BadeSaba — a widely used religious calendar application with more than five million downloads. Users of the app were reportedly shown messages declaring “It’s time for reckoning” and urging members of the armed forces to lay down their weapons and join the public.
Reuters said it was unable to reach BadeSaba’s chief executive for comment. A spokesperson for United States Cyber Command also did not immediately respond to requests for clarification.
Internet Connectivity Disruptions
Internet access inside Iran appeared to suffer sharp interruptions during the morning hours. Doug Madory, director of internet analysis at Kentik, said in a post on X that connectivity dropped precipitously at 0706 GMT and again at 1147 GMT, leaving only minimal levels of access nationwide for a period of time.
While the precise cause of the outages remains unclear, cybersecurity observers said such disruptions are consistent with either defensive state-imposed shutdowns or external cyber interference aimed at limiting communications during a period of heightened military tension.
Hamid Kashfi, founder of cybersecurity firm DarkCell, described the targeting of BadeSaba as strategically significant. The app is popular among more religious and government-aligned users, making it an effective channel for psychological messaging during moments of political strain.
Reports of Broader Cyber Targeting
The The Jerusalem Post reported Saturday that cyber operations also struck a range of Iranian government services and military targets in an effort to constrain Tehran’s ability to coordinate a response. Reuters said it could not independently verify those claims.
Security analysts cautioned that the digital dimension of the conflict could expand in the coming days. Rafe Pilling, director of threat intelligence at Sophos, warned that as Iran evaluates its response options, proxy groups and hacktivist collectives may launch retaliatory cyberattacks targeting Israeli or U.S.-affiliated military, commercial, or civilian infrastructure.
Such activity could range from the recirculation of previously leaked data framed as new breaches, to relatively unsophisticated attempts to infiltrate exposed industrial control systems, and potentially more direct offensive cyber operations.
Cynthia Kaiser, a former senior cyber official at the Federal Bureau of Investigation and now a senior executive at anti-ransomware firm Halcyon, said her firm has observed heightened activity across the Middle East. She noted renewed calls to action from known pro-Iranian cyber personas that have previously engaged in hack-and-leak campaigns, ransomware deployments, and distributed denial-of-service (DDoS) attacks — a tactic that floods online services with traffic to render them inaccessible.
Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, said his firm is already detecting reconnaissance activity and early-stage DDoS efforts consistent with Iranian-aligned threat actors and affiliated hacktivist groups.
Meanwhile, cybersecurity company Anomali said in an analysis shared with Reuters that state-backed Iranian hacking groups had begun carrying out so-called “wiper” attacks — destructive operations designed to erase data — against Israeli targets ahead of the reported strikes.
A Pattern of Measured Digital Response?
Although U.S. cyber officials often cite Iran alongside Russia and China as a significant threat to American networks, Tehran’s previous digital retaliation following kinetic strikes on its territory has sometimes been more restrained than anticipated.
After U.S. strikes on Iranian nuclear targets in June, for example, there was little evidence of the large-scale disruptive cyberattacks frequently referenced in discussions of Iran’s capabilities. Media reports at the time noted only a brief service disruption in Tirana, the capital of Albania.
Whether the current surge in cyber activity represents the opening phase of a broader escalation — or remains limited to symbolic and disruptive operations — will likely depend on Tehran’s strategic calculus in the days ahead. For now, analysts say the digital battlefield is active, fluid, and closely intertwined with developments on the ground.