Dissident Group Claims Massive Cyberattack On Iranian Universities Amid Regional Tensions – JP
Please Follow us on Gab, Minds, Telegram, Rumble, Truth Social, Gettr, Twitter, Youtube, Instagram
A dissident student organization operating inside Iran has claimed responsibility for a large-scale cyber operation that disrupted web portals and online infrastructure at more than a dozen major universities across the country.
The group, identifying itself as Sarbedaran (“Those Bound for the Gallows”), said it targeted over 900 web portals belonging to 12 prominent higher education institutions. In statements emailed to Western news outlets and posted on its social media channels, the group explicitly aligned itself with the Mujahedin-e Khalq (MEK), also known as the People’s Mojahedin Organization of Iran (PMOI).
The operation was timed to coincide with the anniversary of the July 9–10, 1999, nationwide student uprisings, during which many students were killed by security forces under the clerical regime. It also fell on the final day of state-mandated funeral processions for former Supreme Leader Ali Khamenei, who was killed in an airstrike earlier this year.
High-Profile Targets and Defacements
Affected institutions include:
- Islamic Azad University (nationwide network)
- Iran University of Science and Technology
- Tarbiat Modares University
- K. N. Toosi University of Technology
- University of Isfahan
- Kharazmi University
- Imam Sadegh University
- Yasuj University
- Gonbad Kavous University
- Isfahan University of Art
- Isfahan University of Technology
- University of Judicial Sciences and Administrative Services
According to the group’s claims, homepage defacements replaced standard content with images of Iranian Resistance leaders Maryam and Massoud Rajavi. The altered pages featured anti-regime slogans condemning the clerical leadership and any potential dynastic succession, while calling for a fundamental political change in Iran.
Domestic Media Confirms Disruptions
Iranian state and semi-official media outlets, including the Iranian Students News Agency (ISNA) and Khabar Online, acknowledged widespread outages across academic networks. Multiple reports confirmed that technical teams were mobilized to restore services.
The Islamic Azad University’s nationwide online learning platform, Vadana — used for virtual classes and examinations — was among the most visibly impacted. Reports indicated the system briefly displayed a message attributing the disruption to MEK supporters before going fully offline. University officials have described the outages as “routine system updates,” without directly addressing the cyberattack claims.
Parallel Acts of Defiance
The cyber operation occurred alongside other reported acts of dissent. On July 9, during Khamenei’s funeral procession in Mashhad, Iran’s second-largest city, MEK-linked Resistance Units reportedly broadcast anti-regime slogans from loudspeakers at two locations despite heavy security.
Videos circulating on social media captured chants of “Damned be Khamenei, Khomeini, long live Rajavi” near Reza Bazaar around 5:00 p.m. local time and at 15 Khordad Square near Khorramshahr Street at 5:15 p.m.
Evolving Opposition Tactics
Analysts monitoring Iran note that the cyber campaign reflects a broadening and increasingly sophisticated approach by MEK-affiliated networks. While “Resistance Units” have previously conducted physical operations against Islamic Revolutionary Guard Corps (IRGC) and Basij facilities, this large-scale digital disruption of academic infrastructure marks a notable evolution in tactics.
The incidents come at a time of heightened tensions. A fragile ceasefire between Iran and the United States appears strained following recent mutual military strikes. Regional observers suggest that such coordinated actions by internal dissident groups could signal growing resilience among opposition networks, even under intense regime surveillance and repression.
As of Saturday, July 18, 2026, full services had not been restored at all affected institutions, and Iranian authorities had not issued a detailed official response on the scale or source of the breaches.