Users get 'Defend your brothers, Time for ...' and other notifications from BadeSaba app as Iranian apps and websites hit by hackers

A wave of cyber-enabled operations took place early Saturday morning alongside the joint US-Israeli attack on targets across Iran. Just minutes after the first set of explosions, Iranians reportedly received slew of notifications on their phones. These notifications were not from the government advising caution, but from the prayer timing app called ‘BadeSaba Calendar’. The app has 5 million-plus downloads on Google Play Store in the country. According to a report in Wired, which reportedly saw the messages, these messages arrived in quick succession over a period of 30 minutes, starting with the phrase ‘Help Has Arrived’ at 9:52 am Tehran time. All push notifications were titled “Help is on the way” and were in Farsi language.

Screenshots shared with WIRED Middle East show messages urging Iranian military personnel to surrender their weapons with the promise of amnesty. It also reportedly asked the army personnel to join “the forces of liberation” and to “defend your brothers”. “The time for revenge has come,” said another notification received at 10:02 AM read. “The regime's repressive forces will pay for their cruel and merciless actions against the innocent people of Iran. Anyone who joins in defending and protecting the Iranian nation will be granted amnesty and forgiveness.”




Cybersecurity analysts confirmed to the publication that users of the Bade Sabah had received notifications around the time of the strikes, but have not been able to identify the source of the hack. “At this point, we genuinely do not know who is behind them, whether it was Israel or other anti-government Iranian groups,” told Narges Keshavarznia, digital rights researcher at the Miaan Group. No group has so far claimed credit for these attacks.

Internet connectivity in Iran badly disrupted

According to Reuters, internet connectivity in Iran was majorly disrupted at 0706 GMT, and then again at 1147 GMT, with only minimal connectivity remains. Doug Madory, director of internet analysis at Kentik confirmed he same in a post on Twitter. Media reports also said that cyber operations struck a variety of Iranian government services and military targets to limit a coordinated Iranian response.

“As Iran considers its options, the likelihood increases that proxy groups and hacktivists may take action, including cyberattacks, against Israeli and U.S.-affiliated military, commercial, or civilian targets,” told Rafe Pilling, the director of threat intelligence with cybersecurity company Sophos to Reuters.

A former top FBI cyber official and current senior vice president at anti-ransomware firm Halcyon said that hacker activity in the Middle East has increased and that his company has also seen calls to action from known pro-Iranian cyber personas who in the past have carried out hack-and-leak operations, ransomware attacks and distributed denial-of-service attacks (DDoS).

The report says that although Iran is often mentioned by the American cyber officials alongside Russia and China as a threat to American networks, Tehran's recent responses to attacks on its soil have been muted. In June, after the U.S. struck Iranian nuclear targets, there was little sign of the disruptive cyberattacks.