Skip to content
Iran Accuses US of Cyberattacks via Backdoors in Networking Equipment

Iran Accuses US of Cyberattacks via Backdoors in Networking Equipment

First seen 21 Apr 2026, 07:58 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •April 22, 2026 at 07:35 UTC
  • •Iran claims US cyberattacks disabled networking equipment from major vendors.
  • •Chinese state media is amplifying Iran's allegations, framing the US as a cyber aggressor.
  • •The situation is complicated by Iran's ongoing internet blockade, hindering verification.

Iranian media has alleged that the United States used backdoors and botnets to disable networking equipment during the ongoing conflict, with claims that devices from Cisco, Juniper, Fortinet, and MikroTik experienced disruptions. These allegations suggest that a hidden backdoor in the firmware or bootloader could allow for remote sabotage, potentially activated by a satellite signal or at a predetermined time. The Iranian government has maintained a significant internet blockade for over 50 days, complicating verification of these outages. Chinese state media has amplified these claims, framing the US as a cyber aggressor while portraying China as a pacifist in cyberspace. The US has previously acknowledged its capability for cyber operations, particularly in military contexts, but specifics regarding these allegations remain undisclosed. The situation highlights the geopolitical tensions between the US, Iran, and China, with accusations of cyber warfare and manipulation of technology. The extent of the impact on Iranian infrastructure is currently unclear due to the ongoing internet restrictions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 177d ago How this analysis works

Timeline

2026-04-21
Iranian media reports US cyberattacks on networking equipment.
2026-04-21
Chinese state media amplifies Iran's allegations.
2026-04-21
Iran maintains internet blockade for over 50 days.

More articles in this cluster (5)

Following this threat?

Track Volt Typhoon and Cisco in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed