Cyber-attacks in Iran heighten speculations about internal power play

The story: The recently appointed head of Iran’s state broadcaster (IRIB) may already be in danger of losing his job. This follows the alleged hacking of several TV channels, which briefly aired images of the leaders of an exiled opposition group. But while the official narrative is that the broadcaster was breached, some speculate that it was an inside job designed to end Peyman Jebelli’s term as head of IRIB.

Meanwhile, self-described hacker group “Justice of Ali” has played an anti-Islamic Republic video on a popular streaming site where IRIB content can be accessed, and also leaked alleged secret minutes of a meeting among top security officials. This has raised speculations about a domestic power play amid transition in the country’s political leadership.

The coverage: For several seconds, pictures of Mojahedin-e Khalq (MEK) leaders Maryam Rajavi and her husband Masoud interrupted regular programming on Iranian state television on Jan. 27. An image of Supreme Leader Ayatollah Ali Khamenei in which his face was crossed out was also aired.

• In a statement issued shortly after the incident, IRIB said two television channels and two radio stations had been affected. It maintains that it was the victim of a “complex” hacking operation and has not commented on speculations about an inside job.
  
  
• A spokesman for the MEK, which is blacklisted by Iran, on Jan. 27 asserted that the Albania-based group was not involved in the hacking.

Some pro-reform media and commentators in Iran argue that the IRIB breach may spell the end of Jebelli’s tenure as the head of Iran’s most powerful media organization. Yet, there are speculations that there was no foreign hacking and that the operation is meant to weaken Jebelli’s standing and push him out.

• Arman-e Melli daily alleged in a Jan. 31 report that the same group of hardliners that had undermined former IRIB chief Mohammad Sarafraz to the point of his resignation in 2016 was now after Jebelli.
  
  
• Quoting experts, the semi-official ILNA news agency on Jan. 29 said the MEK did not have the technology to hack a fortress such as IRIB and that the state broadcaster had thus been “infiltrated.”

Reformist commentator Mehdi Yamini on Jan. 28 also charged that hardliners may have been involved in the hacking of IRIB channels.

• Yamini wrote on his Telegram channel that “evidence shows that the incident… had nothing to do with the [MEK] and was carried out as part of a power play” among hardliners.
  
  
• The Iranian commentator argued that Jebelli was not conservative enough for some of the more fringe elements of Iran’s hardline camp.

Only days after the IRIB hack, on Feb. 1, “Justice of Ali” apparently infiltrated popular streaming site Telewebion. The hacker group posted a video message showing masked figures who slammed the Islamic Republic and warned of further operations to incite unrest. The streaming platform notably provides access to IRIB channels.

The day after, “Justice of Ali” leaked alleged confidential minutes of a Nov. 2020 gathering of top security officials. The commanders in attendance are claimed to have expressed concern over unrest due to high inflation.

• The alleged meeting was chaired by Hossein Nejat, deputy commander of the crucial Sarallah headquarters of the Islamic Revolutionary Guard Corps (IRGC), tasked with protecting Tehran from threats against the state. Of note, Nejat between 2016 and 2019 served as a deputy to Hossein Taeb, head of the IRGC Intelligence Organization.

The context/analysis: Supreme Leader Khamenei only appointed Jebelli as the head of IRIB in Sept. 2021, replacing Abdolali Ali-Asgari whose five-year term was not renewed. Jebelli’s appointment was welcomed by conservative media, who saw him as an “experienced executive” who could bring much-needed restructuring to IRIB.

• Except for Sarafraz and Ali-Asgari, every head of Iran’s state broadcaster since 1989 has been reappointed for a second consecutive five-year term by Khamenei.
  
  
• After stepping down, Sarafraz accused the IRGC of interfering with IRIB’s work and blamed senior Khamenei advisor Gholamali Haddad-Adel for his resignation.

• Jebelli’s appointment was seemingly pushed by the secretariat of the Supreme National Security Council (SNSC), where he served as media director between 2008 and 2010. The secretariat is notably headed by Ali Shamkhani.

IRIB has stated that advanced technology was used in a complex operation to target it. However, the MEK—which says it had nothing to do with the incident—does not appear to be capable of carrying out such a cyber-attack. Therefore, suggestions that the alleged hack was an inside job seem plausible, particularly given the controversy surrounding former IRIB chief Sarafraz’s resignation.

As for “Justice of Ali,” the self-described hacker group has claimed responsibility for a series of cyber-attacks.

• In Aug. 2021, the group released internal feeds from surveillance cameras in Tehran’s notorious Evin Prison, where many political prisoners and dual nationals are held. The videos showed major prisoner abuse, leading Prisons Organization chief Mohammad Mehdi Haj-Mohammadi to apologize for the “unacceptable behavior.”
  
  
• In late Oct. 2021, another cyber-attack led many gas stations in Iranian cities to stop working. Of note, conservative President Ebrahim Raisi declared that the authorities had through prompt and diligent action minimized the damage—hinting at his rhetoric on good governance.

Speculations about the origins of “Justice of Ali” can be broadly divided into two categories. On the one hand, some observers charge that a foreign government may be involved, implicitly pointing the finger at Israel. Meanwhile, some analysts believe that the cyber-attacks may rather be part of an internal power play amid leadership transition in the Islamic Republic.

• Khamenei is 82 years old and has previously suffered from cancer. The top decision maker has emphasized the need for generational change in the country’s management under the concept of the “Second Step” of Iran’s Islamic Revolution. Against this backdrop, Khamenei’s son Mojtaba is considered by many observers to be a powerful figure, enjoying close ties with Taeb and Nejat of the IRGC.

The future: Jebelli is unlikely to lose his job so soon after being directly appointed by Khamenei. If the speculations about an inside job being behind the IRIB breach are true, however, there may be more attempts to undermine Iran’s top media executive.

As for “Justice of Ali,” Iranian authorities have so far been unable to stop cyber-attacks targeting everything from railways to gas stations. In this context, and particularly if the hacker group is tied to adversarial foreign governments, breaches will likely continue.