Armed conflicts in the 21st century no longer unfold solely on the physical battlefield. Today, military operations are combined with actions in the digital realm, where the disruption of computer systems, information manipulation, and control of technological infrastructure have become top-level strategic tools. The so-called cyberwar is now a consolidated reality in international geopolitics.
A clear example of this evolution occurred in late February and early March 2026, when a series of cyberattacks affected various applications and websites in Iran shortly after the bombings carried out by the United States and Israel against strategic targets in the country. Within hours, multiple digital platforms used by millions of Iranian citizens were hacked or altered, while the country also experienced disruptions in its internet connectivity.
These incidents not only highlighted the vulnerability of digital systems in war contexts but also showed how cyberattacks can be used as part of a broader military strategy. The digital offensive that accompanied the airstrikes reflected an increasingly evident trend: in modern conflicts, controlling cyberspace can be as important as controlling territory.
This ITD Consulting article analyzes the conflict context, the details of the cyberattacks against Iranian platforms, the affected applications, possible motivations behind the intrusions, and the strategic implications of cyberwarfare on the international stage.
The Geopolitical Context: Escalation Between the United States, Israel, and Iran
The wave of cyberattacks against Iranian applications and websites occurred amid a serious escalation of tensions in the Middle East. For months, relations between Iran, the United States, and Israel had deteriorated due to regional disputes, accusations regarding military programs, and indirect confrontations through regional allies.
In this context, the increase in cyberattacks began to emerge as a strategic tool within the conflict, turning cyberspace into a new battlefield. These cyberattacks not only targeted digital infrastructure but also demonstrated how modern wars include coordinated cyber campaigns to weaken adversaries.
The critical point came at the end of February 2026, when the United States and Israel launched coordinated attacks against strategic facilities in Iranian territory. The operations included bombings of military infrastructure and centers considered key to the country’s defensive capabilities.
The offensive represented one of the most intense episodes of direct confrontation between these powers in recent years and was simultaneously accompanied by a growing wave of cyberattacks targeting digital systems and technological platforms. In this scenario, cyberattacks began multiplying against online services, digital media, and popular applications within Iran.
In parallel with physical attacks, operations were also carried out to disrupt Iranian communication and control systems. Various military analysts noted that actions in cyberspace, including multiple cyberattacks, were part of a coordinated strategy aimed at weakening the country’s response capacity. These cyberattacks targeted both technological infrastructure and platforms used by the population, demonstrating that cyberattacks can play a key role in the digital destabilization of a state.
In modern warfare, this type of digital operation, including cyberattacks, usually precedes or accompanies traditional military actions. By disrupting the adversary’s communications or affecting their technological systems through cyberattacks, it is possible to reduce their ability to coordinate defenses or respond quickly to attacks. For this reason, cyberattacks have become an increasingly used strategic tool in international conflicts, where cyberattacks can be as influential as conventional military operations.
The Wave of Cyberattacks Against Iranian Digital Platforms
Shortly after the bombings, cyberattacks began to be reported against several digital services used in Iran. Cybersecurity experts detected intrusions in mobile applications, websites, and news platforms that are part of the country’s digital ecosystem.
These cyberattacks affected different types of technological services and highlighted how cyberattacks can become a key tool in modern conflicts. As events unfolded, more reports confirmed new cyberattacks targeting Iranian digital infrastructure.
The cyberattacks included content manipulation on news portals, alterations to application functionality, and the dissemination of political messages through systems that normally serve completely different purposes. These cyberattacks occurred simultaneously across different digital services, suggesting that they were part of a coordinated campaign.
The scale of the cyberattacks showed that they were not isolated incidents but part of a broader strategy based on the systematic use of cyberattacks to affect the country’s digital infrastructure. In many cases, hackers replaced legitimate content with messages containing clear propaganda through these cyberattacks.
This type of cyberattack, known in the field of cybersecurity as defacement, seeks to demonstrate that systems have been compromised while also transmitting a political or ideological message. Through these cyberattacks, attackers not only compromise system security but also use cyberattacks as a tool for digital propaganda.
In addition to news portals, some applications used by millions of users were also affected by cyberattacks. This significantly increased the impact of the attacks, as it allowed messages to reach directly the mobile phones of a large portion of the population.
In this way, cyberattacks not only disrupted the operation of digital services but also extended the reach of the cyber campaign by directly targeting users’ personal devices.
The BadeSaba Case: The Hacked Prayer Application
One of the most notable incidents in this wave of cyberattacks was the attack on the BadeSaba Calendar application, a platform used by millions of Muslims in Iran to check prayer times, religious dates, and other reminders related to the practice of Islam.
This episode became one of the most talked-about cyberattacks in the digital conflict, as the affected application is part of the daily life of a large number of users. As a widely used religious tool, the cyberattack on this application had a particularly significant impact within the general context of cyberattacks recorded in the country.
The application has over five million downloads and is especially popular among users who wish to organize their daily routine around religious schedules. Due to its large user base, it became an especially attractive target within the campaign of cyberattacks affecting various digital platforms in Iran. For those responsible for these cyberattacks, compromising an application with so many users allowed them to amplify the reach of their actions and demonstrate the potential of cyberattacks to reach the population directly.
During the cyberattack, numerous users began receiving unexpected notifications on their mobile phones. These messages, which were not part of the application’s normal operation, appeared as a direct result of the cyberattack that compromised the platform’s notification system.
Through this cyberattack, attackers were able to send messages with political content and calls directed at members of the Iranian security forces, demonstrating how cyberattacks can also be used as communication and propaganda tools. Some of the messages disseminated through the cyberattack suggested that the time for accountability had come or encouraged the armed forces to lay down their weapons.
Other messages sent via this cyberattack referred to the idea of helping “brothers” or joining alleged liberation forces. This type of content shows how cyberattacks can be used to spread political narratives or influence specific sectors of society.
The use of a religious application as a target for cyberattacks suggests a deliberate psychological warfare strategy. By leveraging a widely used platform associated with spiritual practices, those responsible for the cyberattack could maximize the reach of their message. In this way, cyberattacks not only sought to compromise technological systems but also to generate a greater emotional impact on users and reinforce the psychological effect of the cyber campaign.
Cyberattacks on Digital Media and News Websites
In addition to mobile applications, several Iranian news portals were also victims of cyberattacks. In some cases, the homepages of these sites were temporarily modified as a result of cyberattacks to display messages that were not part of their usual editorial content. These types of cyberattacks highlighted that digital media have also become targets in cyber campaigns accompanying modern conflicts.
These cyberattacks not only disrupted users’ access to information but also sought to discredit the affected media by demonstrating that their systems could be compromised. In conflict contexts, manipulating digital media through cyberattacks can have a significant effect on public perception of events and on trust in information sources.
Information warfare has become a key dimension of contemporary conflicts, and cyberattacks play an important role in this scenario. Controlling the flow of news, altering narratives, or casting doubt on the accuracy of sources through cyberattacks can influence public opinion both inside and outside the affected country.
For this reason, media outlets and information platforms are often priority targets in cyber campaigns during periods of political or military tension. Through these cyberattacks, attackers seek to amplify their message, generate informational confusion, and increase the strategic impact of cyber campaigns in the digital environment.
Internet Disruptions in Iran
While cyberattacks on applications and websites were occurring, Iran also experienced a significant drop in internet connectivity. Network monitoring data showed a notable reduction in digital traffic from the country in the hours following the bombings and during the wave of cyberattacks affecting multiple services. This situation led several analysts to consider that the cyberattacks could be related to a partial disruption of the country’s digital infrastructure.
Internet disruptions can have multiple causes in crisis situations, especially when coinciding with cyberattacks and military conflicts. In some cases, they may result from damage to technological infrastructure or cyberattacks targeting service providers. In others, they may be the result of government decisions aimed at limiting information flow during tense episodes or amid cyberattacks affecting digital systems.
Iran has a history of temporary internet restrictions during periods of political instability or protests. These measures are usually justified as part of strategies to maintain national security or prevent the dissemination of sensitive information, particularly during times when cyberattacks or disinformation campaigns occur.
However, in the context of a military conflict, the drop in connectivity may also be related to cyber operations and cyberattacks intended to disrupt the adversary’s communications. In this way, cyberattacks can affect not only specific platforms but also the overall functioning of a country’s digital infrastructure.
Who Was Behind the Cyberattacks?
So far, no group has publicly claimed responsibility for the cyberattacks against Iranian platforms. However, several cybersecurity experts have noted that the timing of the cyberattacks in relation to the military bombings suggests some form of coordination. This temporal coincidence has led analysts to consider that the cyberattacks could be part of a broader strategy within the conflict.
Some analysts consider it possible that the intrusions and cyberattacks are linked to actors aligned with the United States or Israel, countries that possess advanced capabilities in cyber warfare. Israel, in particular, has been associated in the past with sophisticated digital operations and cyberattacks targeting Iranian infrastructure.
Another possibility is that some cyberattacks were carried out by hacktivist groups. These hacker collectives usually act for political or ideological motivations and, on occasion, participate in international conflicts by supporting one side through cyber campaigns.
Hacktivism introduces an additional dynamic in digital warfare, as it complicates the attribution of responsibility for cyberattacks and can increase the number of actors involved in a conflict where cyberattacks are becoming an increasingly frequent tool.
Digital Infrastructure as a Strategic Target
The events in Iran show to what extent digital infrastructure has become a strategic target in modern conflicts and cyber campaigns. In the past, military operations focused primarily on physical installations such as military bases, factories, or transportation systems. However, the increase in cyberattacks has demonstrated that digital infrastructure can also become a priority target within a cyber strategy.
Today, the computer systems that sustain a country’s economy and communications are equally important and vulnerable to cyberattacks. Disrupting digital networks through cyberattacks can affect essential services, paralyze economic sectors, and create chaos in everyday life. For this reason, cyberattacks have become a strategic tool used to weaken an adversary without physically destroying infrastructure.
For this reason, many countries have begun investing significant resources in protecting their critical infrastructure against cyberattacks. The growing threat of cyberattacks has driven the development of more advanced cybersecurity systems, as governments consider preventing cyberattacks a fundamental priority to ensure national stability.
The cyberattacks against applications and websites in Iran following the bombings by the United States and Israel illustrate how digital warfare has become fully integrated into contemporary military strategies. Intrusions into platforms used by millions of people, such as the religious application BadeSaba, demonstrated the potential of cyberattacks to influence populations and spread political messages.
At the same time, attacks against digital media and internet disruptions highlighted the vulnerability of technological infrastructure in conflict contexts. In an increasingly interconnected world, cyberattacks show that IT security has become a core element of national security, and protection against cyberattacks is a strategic priority for any country or organization.
The combination of traditional military attacks with cyber operations demonstrates that future conflicts will likely be fought across multiple dimensions simultaneously, with cyberattacks playing a central role. The case of Iran in 2026 is a clear example of how the modern battlefield extends beyond physical territory and into the digital universe, highlighting the importance of being prepared for cyberattacks.
To protect your digital infrastructure and prepare for cyberattacks, ITD Consulting offers comprehensive cybersecurity and IT management solutions. Learn more about our services and how to strengthen your organization’s security by writing to [email protected].
EN 
ES