{"id":5895,"date":"2026-04-02T11:58:02","date_gmt":"2026-04-02T11:58:02","guid":{"rendered":"https:\/\/filter.watch\/english\/?p=5895"},"modified":"2026-04-02T14:26:53","modified_gmt":"2026-04-02T14:26:53","slug":"cyber-threat-intelligence-report-july-2025-to-march-2026","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2026\/04\/02\/cyber-threat-intelligence-report-july-2025-to-march-2026\/","title":{"rendered":"From Massacre to War; Escalation of Cyber and Transnational Repression Amidst Digital Blackout"},"content":{"rendered":"

Executive Summary and Trends<\/b><\/h4>\n

The third installment of the Iran Cyber Threats report series has been published following a delay caused by the rapid developments of the <\/span>Dey protests (late December 2025\u2013January 2026)<\/b> and escalating military tensions. Given the sensitivity of this period and the emergence of new threat patterns, the data collection for this report was exceptionally expanded to cover an eight-month window from <\/span>July 2, 2025, to March 21, 2026<\/b>. This report is being released while Iranian users\u2019 right to internet access has been <\/span>violated<\/span><\/a> for more than 25 consecutive days during the ongoing conflict involving Israel, the United States, and Iran.<\/span><\/p>\n

\"\"<\/a><\/p>\n

Data from July 2 to December 30, 2025, indicates a paradigm shift in digital repression, particularly regarding its transnational reach. During this period, the volume of cyber threats increased by 15% compared to the previous six months. At the same time, requests for digital security consultations surged by 67%, reflecting heightened anxiety among users\u2014including those not personally targeted\u2014both inside and outside of Iran.<\/span><\/p>\n

A critical turning point occurred during the nationwide <\/span>Dey protests<\/span><\/a> (late December 2025\u2013January 2026). Despite a total 10-day internet blackout, digital repression expanded beyond Iran\u2019s borders through various threats against activists abroad. Notably, digital rights violations during this month increased by 500% compared to the same period last year, demonstrating a powerful synergy between domestic and transnational repression tools.<\/span><\/p>\n

From Blackout to Whitelist: Iran\u2019s Evolving Internet Control Strategy<\/b><\/h4>\n

All of this is taking place under conditions where, from the protests in Dey (late December\u2013January) until today, the internet in Iran has been shut down for more than 39 days. Research by Filterwatch <\/span>indicates<\/span><\/a> that, given the Iranian government\u2019s new policies, there is no clear prospect of internet connectivity being restored. The government is rapidly expanding domestic services on the National Information Network (NIN). The website <\/span>Iran.ir<\/span><\/i> has become a central hub for this situation, with more services being introduced on it every day.<\/span><\/p>\n

\"\"<\/a><\/p>\n

The development of whitelist-based access is ongoing, and this strategic shift from traditional censorship to a whitelist model has caused significant side effects: many domestic services either do not function properly or do not work at all. The National Information Network is extremely slow, and people are increasingly being pushed toward domestic platforms.<\/span><\/p>\n

Severe censorship is being enforced on domestic search engines and all local platforms. Searching for keywords such as \u201cwar\u201d or \u201cceasefire\u201d on <\/span>https:\/\/gerdoo.me\/<\/span><\/a> yields no results in images, videos, or news sections\u2014as if no war exists, not only in Iran but anywhere in the world.<\/span><\/p>\n

\"\"<\/a><\/p>\n

In the <\/span>https:\/\/zarebin.ir<\/span><\/a> search engine, searching for the name \u201cMojtaba Khamenei\u201d returns only results that focus on his power and wealth outside Iran. Similarly, searching for the keyword \u201cwar\u201d produces content that presents a narrative of Iran\u2019s decisive victory in the conflict.<\/span><\/p>\n

\"\"<\/a><\/p>\n

Each gigabyte of VPN access that can connect users to the internet\u2014whether via whitelisted servers or Starlink\u2014is being sold for between 1 and 3 million tomans (approximately 6\u201324 USD), a cost <\/span>5\u201320 times higher than the global average for one gigabyte<\/b>, effectively turning internet access into a luxury commodity that many people cannot afford.<\/span><\/p>\n

At the same time, the price of internet packages offered by telecom operators has also increased, although this traffic does not provide access to the global internet and can only be used to access services on the National Information Network.<\/span><\/p>\n

Most Significant Events:\u00a0<\/b><\/p>\n