Hackers seize Iran state TV satellite feeds to air Pahlavi appeal

Hackers disrupted satellite transmissions of Iran’s state broadcaster, Islamic Republic of Iran Broadcasting (IRIB), on the night of Jan. 18 into the early hours of Jan. 19, airing footage of exiled Crown Prince Reza Pahlavi and direct appeals to Iran’s security forces. The interruption, captured in videos circulating online, came as the country confronts widespread demonstrations and a near-total internet blackout.

The footage interrupted multiple IRIB satellite channels, according to social media clips that showed the same material rolling across different broadcasts. Some of the clips appeared to have been shared from abroad and circulated via satellite internet services, a tactic that has been used to bypass domestic shutdowns. Pahlavi’s campaign also disseminated the material online.

The hijacked material included two clips attributed to Pahlavi in which he addressed the armed forces as a distinct institution from the ruling system. The broadcast carried the message, “This is a message to the army and security forces,” and showed on-screen text urging, “Don't point your weapons at the people. Join the nation for the freedom of Iran.” In the footage ascribed to Pahlavi he said, “You are the national army of Iran, not the Islamic Republic army,” and “You have a duty to protect your own lives. You don’t have much time left. Join the people as soon as possible.” The clip also displayed images of men in what appeared to be police uniforms and asserted, without independent evidence, that some security personnel had “laid down their weapons and swore an oath of allegiance to the people.”

IRIB later acknowledged a momentary disruption, a statement quoted by the semiofficial Fars news agency that said the signal “in some areas of the country was momentarily disrupted by an unknown source.” Officials did not identify those responsible and no group immediately claimed credit for the intrusion.

The broadcast interruption occurred amid protests that began after calls for demonstrations from Pahlavi on Jan. 8, when he urged Iranians to rise against the authorities. The unrest has unfolded under pervasive communications controls; authorities have repeatedly shut down internet services during the disturbances, complicating independent verification of events inside the country. Activists cited in reporting allege the crackdown has killed at least 3,919 people; that figure is presented as activists’ claims and has not been independently verified.

The incident represents a striking escalation in information warfare against a tightly controlled state media environment. Iran’s monopoly over terrestrial television and radio has long been a pillar of the government’s information control. Similar breaches have precedent: covert airwave intrusions were employed in the 1980s and more recent interruptions in 2022 aired opposition material on state channels.

For those leading and monitoring the protests, the hijack carried symbolic and tactical significance. A direct appeal on state airwaves to security forces seeks to exploit potential fissures within the ranks of police and the military and to embolden demonstrators. For authorities, it is a reminder of vulnerabilities in broadcast infrastructure and of the difficulty of fully containing information in a connected world.

Many vital questions remain unanswered: who orchestrated the hack, from where it was executed, how long the breach lasted in different regions, and what measures Tehran might take in response. With protests ongoing and communications constrained, those answers are likely to emerge slowly and amid continued tension.