Cyber Incident Victim: Islamic Republic of Iran Broadcasting
Date:
Oct 2022
Location:
Iran
Summary
Hackers supporting nationwide protests in Iran disrupted a state television broadcast, displaying an image of Supreme Leader Ayatollah Ali Khamenei in gun-sight crosshairs alongside flames and anti-regime messages including "The blood of our youths is on your hands" and calls to "rise up." The intrusion, claimed by group Edalat-e Ali, featured images of Mahsa Amini—whose death in police custody sparked demonstrations—and other women killed during unrest. The hack occurred amid violent clashes between security forces and protesters challenging dress code enforcement, with activists altering public billboards to condemn authorities. Broadcast disruptions coincided with reports of internet restrictions and widespread street demonstrations marked by chants against the government and memorials for victims of state violence.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 8, 2022, hackers disrupted a live broadcast by Islamic Republic of Iran Broadcasting (IRIB), Iran’s state television network, displaying an image of Supreme Leader Ayatollah Ali Khamenei superimposed with gun-sight crosshairs and flames. The intrusion occurred during a Saturday evening news segment and included on-screen messages stating, “The blood of our youths is on your hands” and “Join us and rise up.” The hack, claimed by the group Edalat-e Ali (Ali’s Justice), also featured images of Mahsa Amini—a 22-year-old Kurdish woman whose death in police custody on September 16 sparked nationwide protests—and three other women killed during subsequent unrest. Footage of the broadcast interruption circulated widely online despite government-imposed internet restrictions blocking major social media platforms. This incident coincided with escalating street demonstrations across Tehran and other cities, where protesters chanted anti-regime slogans such as “Woman, Life, Freedom” and clashed with security forces deploying tear gas. According to state news agency IRNA, demonstrators damaged public property, including setting fire to a police booth, while Norway-based Iran Human Rights reported at least 95 civilian fatalities in the crackdown.
The broadcast hack amplified existing protest tactics targeting state infrastructure and messaging. Activists altered public billboards in Tehran, spray-painting “Death to Khamenei” and modifying a government slogan from “The Police are the Servants of the People” to “The Police are the Murderers of the People.” Protesters shared videos of schoolgirls in Saqez—Amini’s hometown—marching without hijabs and swinging headscarves in defiance of morality police enforcement. Security forces suffered casualties, with IRNA confirming the deaths of 14 personnel, including a Revolutionary Guards member killed in Sanandaj and a Basij paramilitary fatally injured in Tehran. The government dismissed reports of activists dyeing Tehran’s fountains blood-red as false, while state media attributed protest-related fatalities to “anti-revolutionary forces.” Iranian authorities blamed external actors for instigating unrest, coinciding with international sanctions imposed by the U.S., EU, and others. A state forensic report released on October 7 claimed Amini died from preexisting medical conditions, contradicting eyewitness accounts and her father’s assertion that she sustained fatal injuries during detention.