Cybersecurity law & regulation in Iran (2026)

CISA and partner agencies confirmed that an Iranian-affiliated APT group has, since at least March 2026, disrupted programmable logic controllers across US water, energy, government-facilities, and manufacturing sectors, causing operational outages and financial losses. The advisory marks Iran's escalation from opportunistic IT intrusions to sustained, disruptive OT campaigns.

The Ministry of Justice submitted the 'Bill on Combating the Spread of False News Content in Cyberspace' under double-urgency procedures requiring a parliamentary vote within 30 days, bypassing normal debate. Critics warn that the bill's sweeping definitions could criminalise virtually any online dissent or opinion.

CISA, NSA, FBI, and allied agencies published a joint advisory documenting Iranian cyber actors' systematic use of password spraying and MFA push-bombing to compromise healthcare, government, energy, and engineering targets since October 2023. Organisations were directed to enforce phishing-resistant MFA and audit privileged accounts.

OFAC designated two Iranian companies and four individuals linked to the IRGC Cyber-Electronic Command for spear-phishing and malware campaigns against more than a dozen US companies and government entities. The designations extended the accountability framework established in the February 2024 Unitronics-related sanctions.

OFAC sanctioned six senior IRGC Cyber-Electronic Command officials in direct response to the November 2023 compromise of Israeli-made Unitronics PLCs in US water and wastewater systems. These were the first US designations to name IRGC-CEC leadership personally for operational-technology attacks on civilian infrastructure.

The IRGC-affiliated group CyberAv3ngers compromised at least 75 Unitronics PLC devices at US water and wastewater facilities, defacing operator interfaces with political messaging. CISA issued Advisory AA23-335A; the incident was the most publicly confirmed IRGC attack on civilian operational technology to date and prompted the subsequent Treasury sanctions.

Following Mahsa Amini's death in morality-police custody, authorities imposed nationwide restrictions on Instagram and WhatsApp and severed mobile internet connectivity; deep-packet inspection was deployed to defeat VPNs at the network layer. The episode demonstrated Iran's real-time ability to weaponise its National Information Network architecture for domestic repression.

Without parliamentary approval, the Supreme Council of Cyberspace issued a directive implementing three articles of the Cyberspace User Protection Bill, consolidating armed-forces control over Iran's internet gateways and enabling tiered bandwidth throttling. The move created a de facto regulatory regime bypassing the legislature entirely.

The Iranian parliament voted to advance the Cyberspace User Protection Bill under Article 85, granting a Supreme Regulatory Commission authority to manage domestic and international bandwidth and effectively criminalise VPN use. The bill was never fully ratified but was partially enacted through SCC directives in September 2022.

The Shamoon disk-wiper erased data on approximately 30,000 computers at Saudi Aramco, replacing files with an image of a burning US flag; US officials attributed the operation to Iran. It was Iran's first large-scale destructive offensive cyber operation and demonstrated the country had moved beyond espionage to disruptive attacks on critical economic infrastructure.

Supreme Leader Khamenei established the Supreme Council of Cyberspace (SCC) by decree, designating it as Iran's apex internet-governance body with authority over all state agencies and mandate to create the National Cyberspace Center, develop the National Information Network, and set all cyberspace policy. The SCC is the central institution through which Iran's dual offensive-and-censorship cyber strategy is coordinated.

Iran formally stood up its Cyber Police unit (FATA) under the Islamic Republic of Iran Police on 23 January 2011, empowering it to investigate cybercrimes, monitor online content, and conduct surveillance operations. By 2018 FATA had arrested nearly 75,000 people, making it a primary instrument of domestic digital enforcement under the Computer Crimes Law.

The Stuxnet worm, attributed to the US and Israel, was publicly identified in June 2010 after destroying an estimated 1,000 centrifuges at Iran's Natanz facility. The attack directly catalysed Iran's national cyber strategy: the regime responded by establishing the Supreme Council of Cyberspace, the Cyber Defence Command, and cultivating state-sponsored APT groups (APT33, APT34, APT35, APT42).

Iran's Computer Crimes Law, approved by parliament in January 2009 and entering force in June 2009, established criminal penalties for unauthorised access, data interference, fraud, interception of communications, and publication of illegal or 'immoral' content online across 55 articles. The law also created the multi-agency Computer Crimes Detection and Operations Committee (CCDOC) for content oversight and remains the bedrock of Iran's domestic cybersecurity legal framework.