Once More Unto the Breach: Cyfluence Operations Hijack Iran’s State Media Amid Internet Shutdowns

What Happened

On 18 January 2026, at approximately 21:30 Tehran time, Iranian state television was briefly hijacked by anti-regime actors. A coordinated cyber-enabled attack compromised the Badr satellite network, allowing attackers to inject footage and subversive messaging into state broadcasts.

The illicit transmission featured content supporting exiled Crown Prince Reza Pahlavi, urging Iran’s security forces to cease repression and join the ongoing uprising.

Figure 1- Report on the 18 January broadcast hijack (X/Twitter)[i]

Multiple channels operated by the Islamic Republic of Iran Broadcasting (IRIB) were affected before normal programming was restored. This incident reflects a recurring pattern of cyfluence operations that exploit digital broadcast infrastructure to penetrate Iran’s otherwise tightly controlled information environment.[ii]

According to international reporting, the disruption involved content injection affecting IRIB’s satellite transmission, including:

• Video footage of exiled Crown Prince Reza Pahlavi

  
  

• Messaging urging domestic security forces to realign with opposition interests

  
  

• Graphics and imagery supportive of protest movements inside and outside Iran

Operational Execution

Available evidence suggests the attack exploited vulnerabilities in satellite broadcast distribution, rather than IRIB’s internal IT or production networks. Current assessments indicate a satellite uplink override as the most plausible attack vector.

In many DVB-S (Digital Video Broadcasting – Satellite) architectures, satellites rebroadcast signals without authenticating their source. An adversary with sufficient transmission power and access to the correct frequency can overwhelm a legitimate uplink, causing the satellite to relay the stronger rogue signal instead.

The apparent confinement of the disruption to satellite viewers, while terrestrial and cable feeds remained intact, further supports this assessment.

Actor Attribution

Public attribution remains inconclusive. Iranian authorities were quick to blame Israel, consistent with Tehran’s established narrative framing such incidents as foreign-led cognitive warfare.

However, various opposition groups or aligned hacktivist networks remain likely candidates. On 19 January, an X account named “Anonymous TV” claimed responsibility for the operation under the hashtag #OpIran.[iii]

Figure 2 - January 19 post by Anonymous TV claiming responsibility for the cyber operation (X/Twitter)[iv]

Based on the observed modus operandi, duration of the transmission, and messaging, collaboration between opposition-aligned groups and state-level actors remains a credible scenario. From an operational standpoint, the cyber-influence attack demonstrated offensive capabilities comparable to those typically associated with state-sponsored actors.

The attack’s relatively extended duration not only enabled delivery of targeted messages directly via regime-controlled media channels – effectively bypassing censorship – but also suggests simultaneous interruption of real-time remediation efforts. This, in turn, indicates a level of tactical sophistication higher than that of most hacktivist groups.

Information Flow and Online Amplification

At the time of the broadcast hijack, Iran was still subject to a nationally imposed internet blackout. Despite severe connectivity restrictions, reports of the incident spread rapidly.

Early indicators point to a familiar dissemination pattern: within minutes, individuals inside Iran managed to leak footage and documentation of the hijack to journalists abroad. These materials were subsequently posted to social media platforms (primarily Telegram, Instagram and X), with visible watermarks and links enabling source tracing.

Figure 3 - Examples of content posted shortly after the hijack by Telegram and Instagram accounts associated with journalist Amin Fardin. [V]

While the number of Iranians directly reached by the illicit broadcast remains difficult to assess, secondary amplification on social media proved substantial.

Notably, in the aftermath of the operation, a sequence of posts by the X account Reza Pahlavi Communications focused heavily on the IRIB breach, generating over one million impressions and engagements across related posts.[vi]

Internet Blackouts and the Information War

For over three weeks, Iran has experienced severe information suppression amid widespread protests and violent crackdowns. Authorities have implemented one of the most extensive internet shutdowns in recent history, with reports warning of plans to transition Iran toward a national intranet model designed to isolate citizens from global information ecosystems.[vii]

As mentioned in our latest blog, such blackouts create environments in which state-sanctioned media becomes the dominant – and often only – information source. These conditions drive adversaries to adapt their influence strategies, making satellite television infrastructure and its inherent vulnerabilities high-value targets for hybrid information operations (IOs) seeking to breach censorship barriers.

Recent Precedents: Iranian Media Under Attack

The latest January 2026 attack fits within an existing pattern of broadcast signal hacking targeting Iranian state media in recent years, especially during periods of heightened political tension and restricted internet connectivity.

Two previous cyfluence operations are noteworthy:

• June 2025: During the Iran-Israel war, IRIB’s satellite feed was compromised to broadcast footage from the 2022 “Woman, Life, Freedom” protests alongside calls for street demonstrations. Iranian officials attributed the disruption to hostile interference with satellite signals, while security analysts suggested links to foreign actors amid broader cyber and kinetic hostilities.[viii]

  
  

• October 2022: During the Mahsa Amini protests, Iranian state television was briefly interrupted with protest slogans and imagery. Opposition-linked hacker group Edaalat-e Ali took claimed responsibility.[ix]

Figure 4 – Left: Imagery from the October 2022 IRIB broadcast hijack, Courtesy of CNN[x]; Right:  X post showing imagery from the June 2025 IRIB broadcast hijack [xi]

In addition to cyber-enabled broadcast disruption, Iranian media infrastructure has also been targeted kinetically. On 16 June 2025, Israeli forces struck IRIB’s headquarters in Tehran during a live broadcast.[xii] The intended impact extended beyond physical damage to Iran’s strategic communication (StratCom) capabilities. The devastating strike carried significant symbolic weight by targeting a central propaganda apparatus of the Islamic Republic’s regime.[xiii]

Conclusion

The January 2026 breach of Iranian state television forms part of a persistent, multi-actor campaign targeting Iranian media outlets, shaped in part by the unique constraints imposed by the regime on alternative sources of information. It demonstrates the growing importance of agile, cyber-enabled information operations that exploit the full spectrum of digital and broadcast communication vectors.

As authoritarian regimes tighten control over internet access, domestic and external rivals adapt. By targeting critical information delivery systems, attackers can still challenge narrative dominance and influence target audiences.

For counter-cyfluence practitioners and stakeholders, this incident reinforces a key lesson: the struggle for information dominance is not fought solely through digital influence networks, synthetic propaganda or inauthentic narrative amplification, but also through the defense and control of strategic communication assets.

This operation constitutes a prime example of a strategically deployed cognitive threat, intended to shape public perception, erode regime resilience, and sustain internal dissent at a critical moment. Conducted under defined operational and strategic constraints, it highlights the dynamic and diversified nature of today’s cognitive battlespace.

 

---

[Footnotes:]

[i] X, Iran International English (@IranIntl_En), Reporting that several Iranian state TV channels carried on the Badr satellite were hacked on Sunday, broadcasting footage of protests. [online] Published 18 January 2026. Available at: https://x.com/IranIntl_En/status/2012971768202301549

[ii] Associated Press (AP), J. Gambrell, Hackers disrupt Iran state TV to support exiled crown prince as deaths from crackdown exceed 4,000. [online] Published 20 January 2026. Available at: https://apnews.com/article/iran-protests-hack-us-aircraft-carrier-crackdown-65a7a3ee84748531387b72fa15b61456

[iii] X, Anonymous TV (@YourAnonTV), Message to the brutal regime of Iran: We hijacked IRIB’s satellite broadcast feed and ripped your propaganda mask off in front of the people. [online] Published 19 January 2026. Available at: https://x.com/YourAnonTV/status/2013191538184954221

[iv] Ibid.

[v] Instagram, behindpersiantv (@behindpersiantv), Post dated 18 January 2026. [online] Published 18 January 2026. Available at: https://www.instagram.com/p/DTqfI_YgHBr

[vi] X, Pahlavi Communications (@PahlaviComms), Post reporting 428.8K views,was followed by numerous reposts. [online] Published 18 January 2026. Available at: https://x.com/PahlaviComms/status/2012971682034585739

[vii] The Guardian, A. Down, Iran plans permanent break from global internet, say activists. [online] Published 17 January 2026. Available at: https://www.theguardian.com/world/2026/jan/17/iran-plans-permanent-break-from-global-internet-say-activists

[viii] i24NEWS, Iranian TV hacked, protest footage aired; Israel blamed for cyber offensive. [online] Published 19 June 2025. Available at: https://www.i24news.tv/en/news/israel/defense/artc-iranian-tv-hacked-protest-footage-aired-israel-blamed-for-cyber-offensive

[ix] CNN, A. Moshtaghian & R. Razek & J. Deaton, Iran’s state broadcaster hacked during nightly news program. [online] Published 10 October 2022. Available at: https://edition.cnn.com/2022/10/09/middleeast/iran-state-broadcaster-hacked-intl-hnk

[x] Ibid. ; Source: Telegram, edalate_ali (account page). [online] Published 2026. Available at: https://t.me/edalate_ali

[xi] X, Jonathan Haroun (@JonathanHaroun1), Post showing imagery from the June 2025 IRIB broadcast hijack. [online] Published 18 June 2025. Available at: https://x.com/JonathanHaroun1/status/1935400866032304536

[xii] BBC News, D. Gritten, Israel bombs Iran state TV during live broadcast. [online] Published 17 June 2025. Available at: https://www.bbc.com/news/articles/c3w46pw2xn0o

[xiii] Middle East Forum, G. Roman, MEF Iran War Monitor Report: June 16, 2025. [online] Published June 2025. Available at: https://cdn-mef.meforum.org/ac/15/a5d8be144b48bcae8c0f99aff93e/mef-iran-war-monitor-report-june-16-2025.pdf