Iran’s internet has been plagued by slow speeds, frequent outages, and restricted access to online services, frustrating millions of users. While many attribute these issues to outdated infrastructure or restrictive filtering policies, a new narrative has emerged. Fars News Agency, affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC), claims that these disruptions signal a “large-scale cyber war” targeting the country’s communication infrastructure. This article explores the validity of this claim, the nature of cyber warfare, its impact on Iran’s internet, and the challenges of distinguishing between external attacks and internal issues.
What is Cyber Warfare and How Does It Affect Iran’s Internet?
Cyber warfare involves using digital tools to attack a country’s infrastructure, steal data, or disrupt services. In Iran, communication networks—data centers, fiber optic cables, and DNS systems—are prime targets due to their critical role in connectivity. Fars News Agency describes these attacks as a “hidden battle,” suggesting that ordinary users may not realize the extent of the cyber conflict behind their daily internet struggles.
Types of Cyber Attacks Targeting Communication Infrastructure
Several types of cyber attacks can disrupt internet stability and speed:
- Distributed Denial-of-Service (DDoS) Attacks: These overwhelm servers or networks with fake traffic, slowing or blocking access. In June 2025, Iran faced a surge in DDoS attacks during Israel’s “Operation Rising Lion,” contributing to a 54% drop in internet connectivity on June 13.
- BGP Hijacking: Attackers manipulate the Border Gateway Protocol (BGP) to misroute internet traffic, causing delays or outages. Such attacks can disrupt access to global services.
- DNS Attacks: By targeting Domain Name System servers, attackers prevent users from accessing websites. This can mimic the effects of filtering or infrastructure issues.
- Critical Infrastructure Attacks: Physical or digital attacks on routers, data centers, or SCADA systems can cripple networks. For example, pro-Israel group Predatory Sparrow claimed responsibility for attacking Iran’s Bank Sepah and Nobitex crypto exchange in June 2025, disrupting services.
These attacks align with Fars News Agency’s claim of a coordinated cyber war, particularly amid escalating tensions with Israel and the U.S.
Fars News Agency’s Claim: A Hidden Cyber War?
Fars News Agency asserts that Iran’s internet slowdown is a direct result of organized cyber attacks targeting communication infrastructure. This narrative frames disruptions as part of a broader geopolitical conflict, potentially involving state-sponsored actors like Israel or the U.S. In June 2025, Iran imposed a near-total internet blackout, citing the need to counter Israeli cyberattacks during military escalations. The government reported over 20,000 cyberattacks during this period, some causing significant damage.
Evidence of Cyber Warfare in Iran
Recent events support the plausibility of cyber warfare:
- Israeli Cyber Operations: Israel’s “Operation Rising Lion” in June 2025 targeted Iran’s nuclear facilities, accompanied by cyberattacks on Bank Sepah and Nobitex, attributed to Predatory Sparrow. These attacks disrupted banking and crypto services, with Fars News warning of further impacts on gas stations.
- Iran’s Response: Iran’s Cyber Security Command ordered officials to abandon internet-connected devices to prevent Israeli sabotage. The government also urged citizens to delete WhatsApp, claiming it was used for Israeli espionage, though WhatsApp denied these allegations.
- U.S. Warnings: U.S. agencies, including CISA and the FBI, warned of Iranian retaliatory cyberattacks targeting U.S. critical infrastructure, indicating a broader cyber conflict.
However, the lack of transparent technical reports makes it difficult to confirm the extent to which cyberattacks are responsible for internet disruptions.
Internal Factors: Infrastructure, Filtering, and Management
While cyberattacks are plausible, internal factors likely contribute significantly to Iran’s internet issues:
- Outdated Infrastructure: Iran’s communication networks suffer from underinvestment, with limited bandwidth and aging equipment unable to handle growing demand.
- Filtering and Censorship: Extensive filtering of websites and services, including CDNs and cloud platforms, creates network overhead, slowing access. Iran’s “national internet” policies further restrict global connectivity.
- Network Management: Poor traffic routing and inefficient management can cause bottlenecks, especially during peak usage.
- Power Outages: Frequent power disruptions affect data centers and network equipment, exacerbating outages.
Distinguishing between these factors and cyberattacks is challenging without independent audits. For example, DDoS attacks can mimic the effects of overloaded networks, while filtering can resemble DNS attack symptoms.
Cyber Warfare vs. Domestic Issues: A Complex Puzzle
Fars News Agency’s narrative shifts blame to external enemies, potentially deflecting criticism from domestic policies. However, experts question the effectiveness of internet shutdowns in preventing cyberattacks. Military and critical infrastructure systems typically operate on separate networks, meaning shutdowns primarily limit civilian access to information.
Challenges in Verifying Cyber Warfare Claims
- Lack of Transparency: Iran’s government provides limited technical details, making it hard for users or experts to verify claims. Independent organizations like NetBlocks reported a 97% drop in internet traffic during the June 2025 blackout, but the exact causes remain unclear.
- Geopolitical Context: Iran’s history of cyberattacks, both as a target and perpetrator, supports the plausibility of cyber warfare. Groups like APT35 and CyberAv3ngers have targeted Israeli and U.S. infrastructure, while Iran has faced attacks like Stuxnet in the past.
- Public Impact: Regardless of the cause, users face slow speeds, outages, and restricted access, fueling distrust in official narratives.
Implications for Iranian Internet Users
The cyber warfare narrative has significant consequences:
- Eroded Trust: Persistent issues and vague explanations undermine confidence in government claims.
- Increased Restrictions: Cybersecurity concerns may justify tighter internet controls, as seen in Iran’s push for a “national internet” and bans on apps like WhatsApp.
- Privacy Risks: Internet shutdowns and monitoring raise concerns about user data security.
- Access to Information: Disruptions limit access to global news and services, impacting businesses, education, and communication.
How Can Iran Address Internet Disruptions?
To improve internet stability, Iran must adopt a multi-faceted approach:
- Strengthen Cyber Defenses: Invest in advanced firewalls, intrusion detection systems, and regular security audits to counter DDoS, BGP, and DNS attacks.
- Upgrade Infrastructure: Increase bandwidth, modernize equipment, and improve data centers to handle traffic surges.
- Reduce Filtering Overhead: Streamline filtering processes to minimize network strain while balancing security and access.
- Enhance Transparency: Publish independent technical reports to build trust and clarify the causes of disruptions.
- International Cooperation: Collaborate with global cybersecurity organizations to address state-sponsored threats.
Conclusion: Navigating Iran’s Internet Challenges
Iran’s internet slowdown, as claimed by Fars News Agency, may indeed be influenced by a “large-scale cyber war,” particularly given recent attacks during the Israel-Iran conflict in June 2025. However, internal factors like outdated infrastructure, aggressive filtering, and poor network management likely play a significant role. For users, the result is the same: unreliable internet access. A comprehensive solution requires balancing robust cyber defenses with infrastructure upgrades and greater transparency. Stay informed about Iran’s cyber landscape by following updates from trusted sources like NetBlocks or CISA.
Sources: WIRED, The Hacker News, Dark Reading, Bloomberg, POLITICO