• Hacked Iranian app urges armed forces to disarm
• ‘Wiper’ attacks deleting Israeli data

TORONTO: A wave of cyber-enabled operations took place early on Saturday morning alongside the joint US-Israeli attack on targets across Iran, according to cybersecurity experts and observers.

The operations included the hacking of multiple news websites to display various messages and the hack of BadeSaba, a religious calendar app with more than 5 million downloads, which displayed messages telling users Its time for reckoning and urging armed forces to give up weapons and join the people.

Reuters could not establish contact with BadeSabas chief executive.

A spokesperson for US Cyber Command did not immediately respond to a request for comment.

Meanwhile, Cybersecurity firm Anomali said in an analysis shared with Reuters on Saturday that state-backed Iranian hacking groups were already carrying out “wiper” attacks that erase data on Israeli targets ahead of the strikes.

Internet connectivity in Iran dropped repeatedly, with only minimal connectivity remaining, Doug Madory, director of internet analysis at Kentik, said in a post on X.

The cyberattack on BadeSaba was a smart move because government supporters use it and they tend to be more religious, said Hamid Kashfi, a security researcher and founder of cybersecurity firm DarkCell.

Cyber operations also struck a variety of Iranian government services and military targets to limit a coordinated Iranian response, the Jerusalem Post reported on Saturday. Reuters has not been able to independently verify the claims.

As Iran considers its options, the likelihood increases that proxy groups and hacktivists may take action, including cyberattacks, against Israeli and US-affiliated military, commercial, or civilian targets, said Rafe Pilling, the director of threat intelligence with cybersecurity firm Sophos.

The attacks could include the amplification of old data breaches presented as new, unsophisticated attempts to compromise internet-exposed industrial systems, and potentially direct offensive cyber operations, Pilling said.

Activity in the Middle East has increased, said Cynthia Kaiser, a former top FBI cyber official and current senior vice president at anti-ransomware firm Halcyon.

Kaiser said the firm has also seen calls to action from known pro-Iranian cyber personas who in the past have carried out hack-and-leak operations, ransomware attacks and distributed denial-of-service attacks (DDoS), which flood internet services rendering them inaccessible.

The current cyber activity may precede more aggressive operations, said Adam Meyers, senior vice president of counter adversary operations with CrowdStrike.

“CrowdStrike is already seeing activity consistent with Iranian-aligned threat actors and hacktivist groups conducting reconnaissance and initiating DDoS attacks,” he said.

Although Iran is often mentioned by US cyber officials alongside Russia and China as a threat to American networks, Tehran’s previous responses to attacks on its soil have been muted.

Published in Dawn, March 2nd, 2026