In the early hours of February 28, 2026, as Operation Lion’s Roar — a coordinated U.S.–Israeli military offensive against Iranian strategic targets — unfolded across Tehran and other urban centers, a second battle was being waged in the digital domain. While fighter jets and missiles dominated headlines, cyberspace became an equally critical theater of conflict, with internet services collapsing and digital infrastructure under unprecedented strain.
This confrontation highlights a new paradigm in warfare: cyber operations are no longer secondary tools but core instruments of military strategy. Below, we explore what happened, how the attacks unfolded, and why this matters for global cybersecurity as a whole.
As military strikes began, independent internet-monitoring organizations reported what is effectively a nationwide internet blackout in Iran. Network measurements showed nationwide connectivity plummeting to less than 4 % of normal levels — a near-total disconnection from the global internet.
Connectivity dropped so dramatically that most external and internal communication systems became unreachable. Platforms such as mobile data, fixed broadband, and even some elements of the semi-isolated “National Information Network” (Iran’s internal digital ecosystem) were disrupted.
!
!
A blackout at this scale doesn’t just interrupt social media or entertainment — it cripples banking systems, cloud services, e-commerce, logistics, and real-time communication, with ripple effects across the economy and society.
IRNA (official agency) went offline for hours before resuming; Tasnim News (IRGC-linked) suffered hacks displaying anti-Khamenei messages. ISNA, Tabnak, Asr-e Iran, and Rokna also faced outages or defacements. Security comms, energy grids, and aviation systems halted. Local apps and government digital services failed in major cities.
The assault combined:
- DDoS Attacks: Flooded websites and online services with massive traffic, rendering them inaccessible to users.
- Electronic Warfare: Jammed GPS, navigation, and communication systems, disrupting operational coordination.
- Deep Intrusions: Breached data systems within critical sectors, impairing command, control, and response capabilities.
-
- Broadcast hijacking, potentially linked to earlier incidents reported in January.
Tehran imposed its own nationwide shutdown hours after strikes began, a pattern from the June 2025 12-day war. This silenced information flow, echoing prior media blackouts that fueled crackdowns on journalists and ambiguity amid civilian casualties.