Hacked prayer app sends ‘surrender’ messages to Iranians amid Israeli and US strikes

Residents all over Tehran Other Iranian cities woke up to the sounds of loud explosions in the early hours of Saturday morning, as Israel and the United States launched joint attacks on Iran.

The attacks, which the United States and Israel call “preemptive strikes,” come after a period of failed negotiations between the two countries, and follow mass protests in Iran earlier this year that saw at least 3,117 civilians killed, according to government statistics.

Shortly after the first set of explosions, Iranians received batches of notifications on their phones. They came not from the government advising caution, but from an apparently hacked prayer timing app called “BadeSaba Calendar” that has been downloaded more than 5 million times from the Google Play Store.

The messages arrived in rapid succession over a 30-minute period, beginning with the words “Help has arrived” at 9:52 a.m. Tehran time, shortly after the first set of explosions. No party has claimed responsibility for the hacks.

Screenshots shared with WIRED Middle East show messages urging Iranian military personnel to surrender their weapons with the promise of amnesty. They also urged army personnel to join the “liberation forces” and “defend your brothers.”

All notices are titled “Help is on the way” and call on Iranian military personnel to surrender.

Screenshot: WIRED Middle East

“It’s time for revenge,” one notification said at 10:02 a.m. (translated from Persian). “The regime’s oppressive forces will pay the price for their cruel and brutal actions against the innocent Iranian people. Anyone who joins in defending and protecting the Iranian nation will receive amnesty and forgiveness.”

“For the freedom of our Iranian brothers and sisters, this is a call to all oppressive forces – lay down your weapons or join the forces of liberation. Only in this way can you save your life. For a free Iran,” read another message sent at 10:14 a.m.

Cybersecurity analysts confirmed that BadeSabah users received notifications around the time of the strikes, but were unable to pinpoint the source of the hack. “At this point, we don’t really know who is behind them, whether it’s Israel or other anti-government Iranian groups,” says Narges Keshavarznia, a digital rights researcher at the Mayan Group, adding that no hacker group has claimed responsibility for these attacks.

“Attribution in such cases is always complex, and it is still too early to draw conclusions.”

However, Maury Haber, senior security consultant at BeyondTrust, noted that a cyber operation of this kind was almost certainly planned in advance.

“Assignment of assets [likely] “This happened some time ago, and these ‘help’ messages were strategically timed,” he claims. “This is not a smash-and-grab attack. It’s a smash-and-grab.” “It is nation state versus nation state and it is executed with intent and precision.”

On Saturday, Iran launched retaliatory kinetic attacks targeting major military bases across the Middle East. Explosions were reported in Bahrain, Kuwait, the United Arab Emirates and Qatar on Saturday, including the interception of several missiles.

Digital blackout, cyber warfare

As the war continues, the Iranian people have already faced internet outages and weeks of severely reduced connectivity. “The country is experiencing widespread internet outages, and internet access has decreased dramatically in several parts of the country, including Tehran,” says Keshavarznia.

According to Internet monitoring tool NetBlocks, total network traffic dropped to 4 percent. Keshavarznia noted that data from ArvanCloud’s radar monitoring system, a cloud service run by Iran, indicates that many of the country’s major data centers and local PoP sites have either lost connection to the international Internet or are experiencing severe outages.

Telecommunications networks were also disrupted due to the disruption of phone lines and SMS services, and the severe deterioration of both mobile data and fixed broadband connections. “International calls to Iran are also reportedly affected,” she says. “Even using VPNs has become very difficult.”