Opposition TV Breached in Iranian State Linked Cyber Attack

Iran Inter­na­tion­al, the Lon­don-based oppo­si­tion TV net­work, was attacked by a state-linked Iran­ian hack­er group, result­ing in a mas­sive data breach, with hack­ers claim­ing to have extract­ed infor­ma­tion on 71,000 con­tacts while Iran­ian author­i­ties cel­e­brat­ed the attack. On 11 July 2025, Amwaj Media report­ed that the hack­ing group Han­dala alleged­ly accessed Iran Inter­na­tion­al’s servers, inter­nal com­mu­ni­ca­tions, and con­trib­u­tor data, while Tehran pros­e­cu­tors warned of legal action against those who work with the chan­nel. The arti­cle begins:

The sto­ry: Hack­ers alleged­ly linked to Iran say they have breached Lon­don-based Iran Inter­na­tion­al’s sys­tems and extract­ed data on 71,000 con­tacts. Iran­ian state media have hailed the oper­a­tion against the TV net­work, which author­i­ties denounce as a pro­pa­gan­da vehi­cle for Israel’s Mossad spy agency. Mean­while, pros­e­cu­tors in Tehran have warned of legal action against those who work with the chan­nel. The inci­dent coin­cides with height­ened scruti­ny of alleged for­eign infil­tra­tion in the after­math of Israel’s recent attack on Iran. The cov­er­age: Iran­ian media on July 8 report­ed that a hack­ing group known as Han­dala had “ful­ly hacked” Iran International—allegedly access­ing servers, inter­nal com­mu­ni­ca­tions and con­trib­u­tor data.

          Read more: https://amwaj.media/en/media-monitor/iranian-opposition-news-network-hacked-as-calls-grow-for-crackdown

Key Points

• Han­dala hack­ing group claimed to extract data on 71,000 con­tacts from Iran Inter­na­tion­al’s sys­tems, specif­i­cal­ly tar­get­ing jour­nal­ist Mojta­ba Pour­mohsen with Mossad allegations
• Iran­ian hard­line media cel­e­brat­ed the breach as a “pre­cise strike” against a “net­work sup­port­ing Israel” and called for pun­ish­ment of alleged collaborators
• Iran Inter­na­tion­al con­firmed the breach but linked it to pri­or cyber­at­tacks by “Ban­ished Kit­ten,” which the net­work ties to Iran’s Intel­li­gence Ministry
• Tehran pros­e­cu­tor Ali Sale­hi warned of legal action against net­work col­lab­o­ra­tors while con­ser­v­a­tive out­lets demand­ed exe­cu­tions sim­i­lar to the 1988 mass pris­on­er killings

Iran’s Cyber Hacking Operations: Global Influence and Digital Warfare

Iran­ian cyber oper­a­tions have emerged as a mul­ti­fac­eted tool for geopo­lit­i­cal influ­ence, com­bin­ing state-backed hack­ing groups, AI-dri­ven dis­in­for­ma­tion cam­paigns, and covert net­works to desta­bi­lize adver­saries and shape glob­al nar­ra­tives. Recent intel­li­gence reports high­light ris­ing threats against UK dis­si­dents and jour­nal­ists, while covert net­works in Europe exploit aca­d­e­m­ic and cul­tur­al part­ner­ships to advance Tehran’s ide­o­log­i­cal agen­da. Iran­ian actors have pio­neered AI-gen­er­at­ed pro­pa­gan­da on plat­forms like Tik­Tok, fab­ri­cat­ing mil­i­tary imagery and ampli­fy­ing anti-Israeli sen­ti­ment across mul­ti­lin­gual audiences.

These efforts align with the activ­i­ties of groups like Charm­ing Kit­ten (APT35), which employs advanced phish­ing cam­paigns to com­pro­mise activists and pol­i­cy­mak­ers, and Elfin (APT33), known for crit­i­cal infra­struc­ture attacks in ener­gy and avi­a­tion sec­tors. Ana­lysts warn that as Iran faces increased mil­i­tary and eco­nom­ic con­straints, it is like­ly to inten­si­fy its reliance on cyber oper­a­tions and proxy actors to project pow­er, a pat­tern con­sis­tent with broad­er trends in asym­met­ric war­fare. Recent advi­sories from West­ern cyber­se­cu­ri­ty agen­cies high­light the esca­la­tion of these threats and the grow­ing sophis­ti­ca­tion of Iran­ian tac­tics, par­tic­u­lar­ly in tar­get­ing crit­i­cal infra­struc­ture and lever­ag­ing AI-dri­ven disinformation.

Exter­nal References:

1. Iran­ian Cyber Threat Escalation

2. A Mil­i­tar­i­ly Degrad­ed Iran May Turn to Asym­met­ri­cal Warfare

3. Iran­ian Cyber Threat Overview and Advisories

Disclaimer

The Glob­al Influ­ence Oper­a­tions Report (GIOR) employs AI through­out the post­ing process, includ­ing gen­er­at­ing sum­maries of news items, the intro­duc­tion, key points, and often the “con­text” sec­tion. We rec­om­mend ver­i­fy­ing all infor­ma­tion before use. Addi­tion­al­ly, images are AI-gen­er­at­ed and intend­ed sole­ly for illus­tra­tive pur­pos­es. While they rep­re­sent the events or indi­vid­u­als dis­cussed, they should not be inter­pret­ed as real-world photography.