A hacker group called Lab Dookhtegan said it has disrupted the communication networks of 116 ships belonging to two major Iranian shipping companies in one of the biggest attacks against Iranian maritime operations, critical to the country's oil sales.
“In an unprecedented move, we successfully disrupted the communication network of two Iranian companies that, among various terrorist activities, are responsible for supplying munitions to Houthis,” the group wrote on Telegram.
The attack, which the group says was timed to coincide with US military operations against the Iran-backed Yemeni Houthis, severed the ships' connections to each other, their ports, and external communication channels.
“As part of this operation, we targeted the communication network of 116 ships belonging to two major Iranian companies sanctioned by the US Department of the Treasury, the United Kingdom, and the European Union: 50 ships belonging to the National Iranian Tanker Company (NITC) and 66 ships belonging to the Islamic Republic of Iran Shipping Lines (IRISL)."
According to the group, these companies facilitate the sale of Iranian oil at reduced prices, with China as a key buyer, while also allegedly supplying munitions to the Houthis in Yemen.
By disrupting ship communications, Lab Dookhtegan says it has significantly hindered operations, adding that full restoration of the affected systems could take weeks. "Ship personnel can no longer communicate with one another, and their connection to the ports and outside world has been severed," the statement read.
There is limited publicly available information on the specific communication systems used by Iranian shipping fleets. However, open-source data and industry analysis suggest that Iranian commercial and military vessels employ a combination of satellite, radio, and encrypted digital networks.
Some reports indicate that NITC's fleet relies on VSAT (Very Small Aperture Terminal) satellite technology for offshore coordination. The attack's success suggests that vulnerabilities may exist in these systems, despite previous efforts to safeguard them.
Lab Dookhtegan, known for previous cyber activities against Iran’s military and intelligence operations, framed the attack as part of a broader strategy to weaken Iranian-backed forces in the region.
Iranian authorities have yet to comment on the attack. In past incidents, state media and officials have either denied cyber intrusions or attributed them to foreign intelligence services. If confirmed, this latest operation would mark one of the most significant cyber disruptions targeting Iran’s maritime sector.
With global attention focused on Iran's regional activities and US military strikes against the Houthis, the implications of the attack extend beyond immediate logistical disruptions. If sustained, communication failures could affect oil exports, insurance risks, and maritime security assessments for Iranian-flagged vessels navigating international waters.
The full extent of the damage remains unclear, but Lab Dookhtegan has indicated that this is only the "tip of the iceberg," suggesting that further operations may follow.
