‘Help Has Arrived:’ Hackers Use Prayer App to Speak to Iranian People as Strikes Occurred
Iranian citizens awoke to mysterious push notifications from a hacked prayer app urging military personnel to surrender as Israel and the United States launched coordinated strikes on Tehran and other Iranian cities Saturday morning.
Wired reports that in an unexpected development as the Iran strikes began, Iranian citizens began receiving a series of unusual notifications on their mobile devices. The messages came from “BadeSaba Calendar,” an Islamic prayer-timing application that has been downloaded over 5 million times through the Google Play Store and appears to have been compromised by hackers.
The notifications arrived in rapid succession over approximately 30 minutes, beginning at 9:52 a.m. Tehran time with a message stating “Help has arrived,” which appeared shortly after the first explosions were heard. As of the time of reporting, no organization or group has taken credit for the cyber intrusion.
Documentation obtained by Wired reveals that the messages specifically targeted Iranian military personnel, encouraging them to relinquish their weapons in exchange for promised amnesty. The notifications also called upon armed forces members to align themselves with what the messages termed “the forces of liberation” and to protect their fellow citizens.
One notification received at 10:02 a.m. stated: “The time for revenge has come. The regime’s repressive forces will pay for their cruel and merciless actions against the innocent people of Iran. Anyone who joins in defending and protecting the Iranian nation will be granted amnesty and forgiveness.”
A subsequent message delivered at 10:14 a.m. read: “For the freedom of our Iranian brothers and sisters, this is a call to all oppressive forces—lay down your weapons or join the forces of liberation. Only in this way can you save your lives. For a free Iran.”
Cybersecurity professionals have verified that users of the BadeSaba application received these notifications during the timeframe of the military strikes, though investigators have not yet determined the source of the security breach. Narges Keshavarznia, a digital rights researcher at the Miaan Group, stated that attribution remains unclear at this stage. “At this point, we genuinely do not know who is behind them, whether it was Israel or other anti-government Iranian groups,” Keshavarznia explained, noting that no hacker collective has claimed responsibility. “Attribution in cases like this is always complex, and it’s still too early to draw conclusions.”
However, Morey Haber, chief security adviser at BeyondTrust, suggested that such a sophisticated cyber operation would require advance planning. “The compromise of assets [likely] happened some time ago, and these messages of ‘help’ were timed” strategically, Haber stated. “This is not a smash-and-grab style of attack. It is nation-state versus nation-state and is being executed with intent and precision.”
The Iranian population has already been dealing with internet blackouts and significantly diminished connectivity for several weeks as the conflict has developed. “The country has been experiencing a widespread internet disruption, and access to the internet has significantly decreased in several parts of the country, including Tehran,” Keshavarznia confirmed.
Internet monitoring service NetBlocks reported that overall network traffic has plummeted to just four percent of normal levels. Information from ArvanCloud’s Radar monitoring system, operated by an Iranian cloud service provider, shows that numerous major data centers and domestic Point of Presence sites throughout the country have either lost international internet connectivity entirely or are experiencing severe disruptions, as Keshavarznia highlighted.
Communications infrastructure has also suffered extensive damage, with telephone line and SMS service outages reported alongside severe degradation of both mobile data and fixed broadband connections. “Incoming international calls to Iran are also reportedly affected. Even using VPNs has become extremely difficult,” Keshavarznia noted.
Read more at Wired here.
Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship.
