Iran digital repression surged amid war and protests: Rights group

Follow our live coverage here.

PARIS - Cyberthreats against Iranians both in the country and abroad have surged during wars and protests over the past nine months, a rights group said on April 2.

Iranians have been seeing a “paradigm shift in digital repression” using a variety of techniques since July, the Miaan group said, adding that some activities bore clear signs of Tehran’s involvement.

Miaan, which provides legal and technical support to rights campaigners in and outside Iran, said cyberthreats referred to it in July to March jumped nearly 170 per cent over the previous six months.

July to March covered the aftermath of the 2025 12-day bombing campaign by the US and Israel, as well as street protests starting in December and renewed bombing since late February.

Cyberattacks can be difficult to attribute directly to the Iranian state or state-linked actors.

But “in several cases, there is significant evidence that strengthens the possibility of a connection”, Miaan said.

One example was a human rights group targeted by a direct denial of service (DDoS) attack, which floods internet servers with requests, crowding out legitimate traffic.

“This is one of the most important pieces of evidence in the entire collection, because... domestic telecommunications infrastructure inside Iran was also observed in the attack,” Miaan said.

The DDoS attack was just one element in a “multilayered, adaptive, and in some cases successful threat environment directed against high-risk Persian-speaking users and institutions”, the group said.

It said requests for help from people outside Iran were concentrated in Britain, the US, Sweden, Turkey, Germany and France.

Within Iran, the government imposed internet blackouts during the January protests and again during the new war.

Miaan said it saw a surge of referrals related to arrests and people having their devices confiscated during the December to January protests.

Requests also leapt for help with issues like being unable to access messaging services such as WhatsApp and Instagram, and fears that the authorities might have hacked people’s accounts or devices.

Ethnic minority and human rights organisations accounted for around half Miaan’s referrals between July and March, while cases involving media outfits quadrupled to 12 per cent of the total.

Documented cyberattacks included “phishing” attempts, in which attackers attempted to dupe or persuade people into giving up sensitive information.

Some used fraudulent messages purporting to be from trusted platforms like Facebook or Gmail, or fake accounts on messaging service Telegram.

Also on Telegram, Miaan reported distribution of a malicious information-gathering app targeting Android phones, disguised as a PDF document and designed to conceal itself once users mistakenly installed it. AFP