96% of a Nation's Internet — Gone in Hours
On February 28, 2026, as military strikes hit Iranian Revolutionary Guard command centers during Operation "Roar of the Lion," a parallel assault unfolded in cyberspace that dwarfed any previous cyber operation in scale and impact.
NetBlocks, the internet monitoring organization, confirmed that internet connectivity across Iran plunged to just 4% of normal traffic — an almost total nationwide blackout. For a country of over 88 million people, this represents the largest coordinated cyberattack in recorded history.
The Multi-Domain Attack
The cyber operation combined multiple attack vectors simultaneously:
| Vector | Target | Effect |
|---|---|---|
| Electronic warfare | Communications systems | Disrupted military and civilian radio/satellite links |
| DDoS attacks | Internet infrastructure | Reduced nationwide connectivity to 4% |
| Deep intrusions | Data systems and networks | Compromised government and military networks |
| Website defacement | State media outlets | Subversive messages displayed on regime sites |
This wasn't a single attack — it was a coordinated multi-domain operation designed to create a digital fog of war at precisely the moment Iran's leadership needed communications the most.
What Went Dark
Government and Military
- Critical infrastructure control systems stopped functioning
- Security communications systems went offline
- Government coordination networks were disrupted
- Leadership was left in a communications blackout both domestically and internationally
State Media
- IRNA (Islamic Republic News Agency) — taken offline for an extended period
- Tasnim News Agency (IRGC-affiliated) — experienced severe disruptions, with hackers reportedly displaying subversive messages against Supreme Leader Ali Khamenei
Civilian Impact
- Nationwide internet access dropped from normal levels to 4%
- Banking, telecommunications, and digital services were disrupted
- The general population was cut off from both domestic and international information
Scale in Context
To understand what "4% connectivity" means in practice:
| Scenario | Internet Connectivity |
|---|---|
| Normal operations | 100% |
| Major DDoS attack (typical) | 70-85% |
| Government-imposed shutdown (e.g., Iran 2019) | 5-15% |
| Operation Roar of the Lion | 4% |
| Complete blackout | 0% |
Even Iran's own government-imposed internet shutdowns during the 2019 protests didn't achieve this level of disruption. The 4% figure represents near-total isolation of an entire nation's digital infrastructure.
The Cyber-Kinetic Convergence
What makes this operation historically significant is the simultaneous coordination of kinetic military strikes with cyber operations at this scale. While cyber operations have accompanied military actions before (Georgia 2008, Ukraine 2022), the Iran operation represents a new threshold:
- Timing: Cyber and kinetic operations were synchronized to maximize confusion
- Scale: Affecting an entire nation's internet infrastructure
- Scope: Targeting military, government, media, and civilian systems simultaneously
- Effect: Creating complete information isolation during a crisis
This demonstrates that cyber capabilities are no longer a supporting element of military operations — they are a co-equal domain capable of strategic-level effects.
Implications for Cybersecurity
For Nation-State Defenders
- Internet resilience planning must account for near-total disruption scenarios
- Offline command and control capabilities are essential for crisis operations
- Diversified communications (satellite, mesh networks, HF radio) need to be pre-positioned
- State media infrastructure is a high-value target — redundancy is critical
For the Broader Community
- This operation sets a new benchmark for what state-level cyber capabilities can achieve
- Critical infrastructure isolation from the public internet is more important than ever
- Multi-domain operations (cyber + EW + kinetic) will become the norm in future conflicts
- Organizations in geopolitically sensitive regions should review their business continuity plans against scenarios of prolonged national internet disruption