Cyber Incident Victim: Iran
Date:
Sep 2022
Location:
Iran
Summary
Anonymous hackers targeted Iranian government websites, including those of the central bank, national portal, and state media, causing intermittent outages amid widespread protests following the death of Mahsa Amini in police custody. The hacktivist group claimed destructive attacks such as database deletions, though evidence remained unverified, while nationwide demonstrations—sparked by disputed official accounts of Amini's death—featured violent clashes, casualties, and public defiance of hijab laws. Authorities warned of potential internet disruptions citing national security concerns as unrest persisted.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around September 20, 2022, hacktivists associated with the Anonymous collective launched cyberattacks against multiple Iranian government websites amid widespread protests following the death of 22-year-old Mahsa Amini. Amini, a Kurdish woman also known as Jhina Amini, died on September 16 while detained by Iran's morality police for alleged improper hijab usage. Authorities claimed she suffered a heart attack, but her family disputed this account, citing unexplained bruises and no prior cardiac history. Her death triggered domestic and international outrage, with protests erupting across Iran featuring women burning headscarves and crowds chanting anti-government slogans, including "death to the dictator." Three protesters were killed and numerous others injured in clashes with police, while one police officer was reported dead. Anonymous claimed responsibility for disrupting websites including Iran's central bank, national government portal, and state-owned media platforms, rendering them intermittently inaccessible. Some affiliated accounts asserted destructive actions such as deleting databases from the government spokesperson's site, though no evidence substantiated these specific claims.
The cyberattacks coincided with severe internet disruptions acknowledged by Iran's ICT minister as potential "national security" measures during the unrest. State-affiliated Fars News Agency documented protesters openly criticizing Supreme Leader Ayatollah Ali Khamenei, while videos of demonstrations circulated on Twitter and Telegram despite connectivity issues. The hacktivist operations were characterized by digital rights researchers as symbolic acts of international solidarity aimed at sustaining protester morale against state suppression tactics. Iranian authorities did not issue formal statements addressing the cyber intrusions. Concurrent physical protests saw police deploying violent force against demonstrators, particularly women, as verified by human rights groups like Hengaw. The incidents collectively highlighted coordinated dissent across physical and digital domains, with cyber disruptions amplifying global attention on the government's response to civil unrest.