Despite Iran's rulers blocking internet access for 99 per cent of residents, the country's cyber crime efforts have not been affected, experts say.
Ever since US and Israeli air strikes started on February 28, cyber security analysts have warned of an increase in potential cyber attacks from Iran and groups seeking to take advantage of the situation.
Last week, the American medical technology company Stryker was hit with a cyber attack from a group calling itself Handala, which claimed to be connected with and sympathetic to those opposing US and Israeli strikes on Iran.
Videos and photos taken by Stryker employees showed company computers and smartphones locked, only displaying the logo and a brief message from Handala.
“We have now fully contained the attack and are in the restoration phase,” said Stryker's chief executive Kevin Lobo in a social media post.
A few days later, Handala said it had infiltrated US government computers and published the names, photos and job titles of what it said were senior US Navy officials.
“While you tremble in fear, unable to even approach our powerful waters, know that none of your secrets remain hidden any more,” a Telegram message from the group read.
Another example of the country’s cyber efforts surfaced in February, when anti-regime demonstrations began to gain momentum in various parts of Iran.
Cyber security experts outside the country warned about malware called “Crescent Harvest” that was directed at overseas supporters of the protests in Iran.
For those familiar with Iran's efforts to overcome sanctions the affinity for cyber strikes is no surprise.
“They have a lot of smart and dedicated scientists and engineers, very capable people,” said a US-based Iranian data scientist, who works for a Fortune 500 company. He asked not to be identified to protect his family in Iran from reprisals.
“They know they can’t match the US military directly, so they’ve built their entire system around surviving."
He explained that, over the last decade, Iran’s rulers have doubled down on nefarious cyber activity as a way to promote fear abroad and within Iran.
“Otherwise, they wouldn’t be able to rule a country of 90 million people despite being so unpopular,” he added.
In August, FBI assistant director Brett Leatherman said a cyber attack from Iran affecting US technology systems, data and infrastructure would likely be considered an act of war. Several months ago, Microsoft's security division warned that the country shows no sign of slowing its cyber attack efforts.
“The volume of Iranian state-linked cyber activity remains consistently high,” the company's 2025 digital defence report read.
The US and Israeli strikes on Iran have left the country's rulers with little to lose, hence the proliferation of cyber attacks.
After the strikes began, the country's rulers cut off internet access for almost everyone in the country, apart from the leadership and other officials.
"HTTP, DNS and total traffic from the country continue to be at near-zero levels," Cloudflare Radar, which routinely monitors internet outages around the world, posted on X.
While Tehran has beefed up its cyber attack capabilities in recent years, Mohammed Soliman, a technology analyst and senior fellow at the Middle East Institute, said that Iran has also become proficient at eliminating internet access quickly and at a wide scale throughout the country.
"The regime has engineered a two-tiered internet: unfiltered access for loyalists and propagandists who 'convey the voice of the nation', while ordinary people wake to failed VPNs and enforced silence," he said.
Some pundits and technology experts have pressed the country's rulers to relinquish control of internet access in recent days as Iranian officials seek to prove that the country is rallying behind the current regime.
“The regime doesn't seem to have that confidence for its own people,” Alp Toker, director of NetBlocks, which tracks global internet access and digital governance policies, told The National. “The fact that they've deemed it [an internet blackout] necessary really stands out."
During an appearance on Sunday on CBS's Face The Nation, Iranian Foreign Minister Abbas Araghchi said that the internet is still blocked largely because the country is under many forms of attack. He also defended blocking the internet for millions while officials like him can use it largely unfettered.
"Why ... because I'm the voice of Iranians," he said. "This is why I have access, so that our voice can be heard by the international community." He added that most Iranians in the country were used to accepting certain measures "for the sake of war".
