Iran claims US exploited networking equipment backdoors during strikes

Hacker News Top News

Summary

Iran claims US exploited backdoors in Cisco, Juniper, Fortinet and MikroTik gear to sabotage networks during recent strikes, saying devices failed despite Iran’s Internet blackout.

No content available
Original Article Export to Word Export to PDF
View Cached Full Text

Cached at: 04/22/26, 12:08 PM

# Iran claims US exploited networking equipment backdoors during strikes — says devices from Cisco and others failed despite blackout in attack that 'indicates deep sabotage' Source: [https://www.tomshardware.com/tech-industry/cyber-security/iran-claims-us-exploited-networking-equipment-backdoors-during-strikes](https://www.tomshardware.com/tech-industry/cyber-security/iran-claims-us-exploited-networking-equipment-backdoors-during-strikes) ![Network cables and hub](https://cdn.mos.cms.futurecdn.net/3MENKrnKHBskAG4vmFGju5.jpg)\(Image credit: Getty\) Iranian state media has[alleged](https://www.entekhab.ir/fa/news/917640/%D9%81%D8%A7%D8%B1%D8%B3-%D8%B7%DB%8C-%D8%A7%D8%AA%D9%81%D8%A7%D9%82%DB%8C-%D8%B9%D8%AC%DB%8C%D8%A8-%D9%88-%D9%87%D8%B4%D8%AF%D8%A7%D8%B1-%D8%AF%D9%87%D9%86%D8%AF%D9%87-%D8%AC%D8%B9%D8%A8%D9%87%E2%80%8C%D9%87%D8%A7%DB%8C-%D8%B3%DB%8C%D8%A7%D9%87-%D8%A2%D9%85%D8%B1%DB%8C%DA%A9%D8%A7%DB%8C%DB%8C-%D8%AF%D8%B1-%D8%B3%D8%A7%D8%B9%D8%AA-%D8%B5%D9%81%D8%B1-%D8%AD%D9%85%D9%84%D9%87-%D8%A8%D9%87-%D8%A7%D8%B5%D9%81%D9%87%D8%A7%D9%86-%D8%A7%D8%B2-%DA%A9%D8%A7%D8%B1-%D8%A7%D9%81%D8%AA%D8%A7%D8%AF%D9%86%D8%AF-%D8%A7%DB%8C%D9%86-%D8%A7%D8%AE%D8%AA%D9%84%D8%A7%D9%84-%D8%AF%D8%B1-%D8%B4%D8%B1%D8%A7%DB%8C%D8%B7%DB%8C-%D8%B1%D8%AE-%D8%AF%D8%A7%D8%AF-%DA%A9%D9%87-%DA%AF%DB%8C%D8%AA%E2%80%8C%D9%88%DB%8C%E2%80%8C%D9%87%D8%A7%DB%8C-%D8%A8%DB%8C%D9%86%E2%80%8C%D8%A7%D9%84%D9%85%D9%84%D9%84-%D8%B9%D9%85%D9%84%D8%A7%D9%8B-%D9%85%D8%B3%D8%AF%D9%88%D8%AF-%D8%A8%D9%88%D8%AF%D9%86%D8%AF-%D8%A8%D9%86%D8%A7%D8%A8%D8%B1%D8%A7%DB%8C%D9%86-%D9%81%D8%B1%D9%88%D9%BE%D8%A7%D8%B4%DB%8C-%D9%85%D8%B0%DA%A9%D9%88%D8%B1-%D9%86%D8%B4%D8%A7%D9%86-%D8%A7%D8%B2-%DB%8C%DA%A9-%D8%AE%D8%B1%D8%A7%D8%A8%DA%A9%D8%A7%D8%B1%DB%8C-%D8%B9%D9%85%DB%8C%D9%82-%D8%AF%D8%A7%D8%B1%D8%AF-%D8%B3%D9%86%D8%A7%D8%B1%DB%8C%D9%88%DB%8C-%D8%AE%D8%B7%D8%B1%D9%86%D8%A7%DA%A9-%D8%AF%D8%B3%D8%AA%DA%A9%D8%A7%D8%B1%DB%8C-%D8%AF%D8%B1-%D9%85%D8%A8%D8%AF%D8%A3-%D8%AA%D9%88%D9%84%DB%8C%D8%AF-%D8%A7%D8%B3%D8%AA-%D8%A7%DA%AF%D8%B1-%D9%81%D8%A7%DB%8C%D9%84%E2%80%8C%D9%87%D8%A7%DB%8C-%D9%86%D8%B5%D8%A8%DB%8C-%D9%82%D8%A8%D9%84-%D8%A7%D8%B2-%D9%88%D8%B1%D9%88%D8%AF-%D8%A8%D9%87-%D8%A7%DB%8C%D8%B1%D8%A7%D9%86-%D8%A2%D9%84%D9%88%D8%AF%D9%87-%D8%B4%D8%AF%D9%87-%D8%A8%D8%A7%D8%B4%D9%86%D8%AF-%D8%AD%D8%AA%DB%8C-%D8%AA%D8%B9%D9%88%DB%8C%D8%B6-%D8%B3%DB%8C%D8%B3%D8%AA%D9%85-%D8%B9%D8%A7%D9%85%D9%84-%D9%87%D9%85-%D9%85%D8%B4%DA%A9%D9%84-%D8%B1%D8%A7-%D8%AD%D9%84-%D9%86%D9%85%DB%8C%E2%80%8C%DA%A9%D9%86%D8%AF)that equipment from Cisco, Juniper, Fortinet, and MikroTik failed during U\.S\. and Israeli military operations against Iran\. The report, which claims that “American ‘black boxes’ failed at zero hour of the attack on Isfahan,” concerns devices that Iran claims either rebooted or dropped offline despite the country having already been disconnected from the global Internet, a fact it says "indicates deep sabotage\." Iranian media speculates that[hidden firmware or backdoors](https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html)allowed remote sabotage, possibly triggered by satellite or at a pre\-set time\. None of the claims has been independently verified, and given that the claims originate from state media, some skepticism is merited\. Meanwhile, the U\.S\. hasn’t addressed Iran's specific allegations, but has publicly confirmed that it conducted cyber operations against Iran's communications infrastructure\. Chairman of the Joint Chiefs of Staff, General Dan Caine, said during a March 2nd Pentagon briefing that U\.S\. Cyber Command and U\.S\. Space Command were the “first movers” in so\-called Operation Epic Fury, the military campaign launched against Iran at the end of February\. Caine said coordinated space and cyber operations disrupted Iranian communications and sensor networks before strikes began\. Article continues below Chinese state media seized the opportunity to pile on Iran’s claims, with the country’s National Computer Virus Emergency Response Center, which has repeatedly claimed that the U\.S\. fabricated the Volt Typhoon hacking campaign to deflect from its own cyber operations, promoted the allegations as further evidence of American backdoors in networking hardware\. Five Eyes intelligence agencies have attributed Volt Typhoon to Chinese state\-sponsored actors targeting Western critical infrastructure\. Get Tom's Hardware's best news and in\-depth reviews, straight to your inbox\. [![Google Preferred Source](https://cdn.mos.cms.futurecdn.net/7cUTDmN2PHNRiNBVqbKf56.png)](https://news.google.com/publications/CAAqLAgKIiZDQklTRmdnTWFoSUtFSFJ2YlhOb1lYSmtkMkZ5WlM1amIyMG9BQVAB)*Follow*[*Tom's Hardware on Google News*](https://news.google.com/publications/CAAqLAgKIiZDQklTRmdnTWFoSUtFSFJ2YlhOb1lYSmtkMkZ5WlM1amIyMG9BQVAB)*, or*[*add us as a preferred source*](https://google.com/preferences/source?q=)*, to get our latest news, analysis, & reviews in your feeds\.* Luke James is a freelance writer and journalist\. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory\.

Similar Articles

Disrupting a covert Iranian influence operation

OpenAI Blog

OpenAI disclosed the disruption of a covert Iranian influence operation (Storm-2035) that used ChatGPT accounts to generate political content targeting the 2024 U.S. election and other topics across social media and fake news websites. The operation achieved minimal audience engagement and was identified through collaboration with Microsoft's threat intelligence.

GNU IFUNC is the real culprit behind CVE-2024-3094

Hacker News Top

The article argues that GNU IFUNC and design decisions linking OpenSSH to SystemD were the primary enablers of the CVE-2024-3094 xz-utils backdoor, rather than the malicious code itself.