Cyber Incident Victim: Islamic Republic of Iran Broadcasting
Date:
Feb 2022
Location:
Iran
Summary
Iran's state-owned broadcaster experienced disruptions in two separate hacking incidents targeting its television services. Unknown actors initially hijacked a main channel's signal to display opposition leaders and an anti-government slogan. Subsequently, the hacktivist group Adalat Ali compromised a live sports web stream, repeatedly broadcasting a call for nationwide protests against the regime over several hours. The same group had previously breached an internal prison surveillance system, exposing alleged abuses. The broadcaster regained control after both intrusions, acknowledging the web stream incident publicly.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 1, 2022, the hacktivist group Adalat Ali (Ali's Justice) compromised the web stream of Telewebion, the online broadcasting platform operated by Iran's state-owned Islamic Republic of Iran Broadcasting (IRIB). The intrusion occurred during a live broadcast of a soccer match between Iran and the United Arab Emirates. Attackers replaced the scheduled content with a 50-second video containing an anti-government message urging nationwide protests against Supreme Leader Ali Khamenei’s regime. The video specifically called for demonstrations during the Fajr Decade, an annual celebration of Iran’s 1979 Revolution held from February 1 to February 11. The hijacked stream repeatedly displayed this message at intervals over several hours before Telewebion restored control. The platform acknowledged the breach publicly via Twitter later that day.
This marked the second disruption to IRIB’s broadcasts within a week. On January 27, 2022, unidentified hackers had briefly hijacked the primary IRIB television channel’s broadcast signal for approximately 10 seconds. During that intrusion, the attackers displayed images of Maryam and Masoud Rajavi, leaders of the Mujahideen Khalq Organisation (MKO), a group opposing Iran’s government. A voiceover accompanying the images declared, "Salute to Rajavi, death to Khamenei!" Adalat Ali, responsible for the February 1 incident, had previously targeted Iranian government infrastructure in August 2021 by breaching the internal CCTV system of Tehran’s Evin Prison, a facility housing political prisoners. The group leaked footage documenting prisoner abuse during that prior operation. The February attack exclusively disrupted Telewebion’s web-based streaming services, leaving traditional broadcast signals unaffected. No technical details regarding containment measures or broader operational impacts beyond the streaming interruption were disclosed.