In the midst of one of the most severe state-imposed internet shutdowns in recent history, Iranian-linked hackers are finding an unexpected lifeline: Starlink, the satellite internet network operated by Elon Musk’s SpaceX. The development highlights both the resilience and complexity of modern cyber conflict  where satellite communications intended to keep people connected are now being used by state-aligned cyber-operators to continue offensive activity online. 

‍

Starlink as an Internet Escape Hatch

‍

Since early January 2026, Iran has undergone a near-total internet blackout imposed by the government amid massive protests and internal unrest. Independent monitoring groups reported international internet traffic from Iran plunged to almost zero during the blackout, as authorities clamped down on traditional terrestrial networks and cracked down on independent communication channels. 

‍

Satellite internet services like Starlink initially remained a rare way for some users to bypass state controls and access the global internet. While conventional networks were unusable, a portion of Iranians with Starlink terminals were still able to send messages, videos and reports abroad - a thorn in the side of authorities who wanted complete isolation. 

‍

A Cyber Group with a Backdoor

‍

According to cybersecurity reporting by Forbes, one of Iran’s most notorious hacking crews widely linked to Tehran’s intelligence apparatus has been observed using Starlink connectivity to stay operational during the blackout. The group, often referred to in open-source reporting as Handala, leveraged Starlink IP addresses to continue launching cyber operations after the nationwide shutdown began. 

‍

Security analysts say Handala tends to focus on conspicuous “hack-and-leak” campaigns, targeting foreign networks and infrastructure for psychological impact. In the current context, those activities include probing remote systems and issuing threats via social media platforms. 

‍

Starlink: A Two-Edged Sword

‍

Starlink was not designed as a tool for cyber operational continuity, but its decentralized, satellite-based architecture makes it difficult for governments to block completely  even when terrestrial networks are taken offline. That resilience is a double-edged sword: while it helps civilians retain access during censorship, it can also be exploited by threat actors to sustain operations when other networks are unavailable. 

‍

Iran’s response to the threat has been aggressive: authorities have used military-grade jamming systems to interfere with Starlink signals, and in some regions have reportedly seized satellite terminals to prevent their use. The regime has also expanded its “national internet” infrastructure, a domestically controlled network separate from the global internet, to limit outside communication. 

‍

Starlink and the Geopolitical Backdrop

‍

The use of Starlink by Iranian hackers cannot be viewed in isolation. It overlaps with larger geopolitical tensions affecting the region, from ongoing protests and internal political instability in Iran to heightened cyber conflict with states like Israel. Specialists warn that satellite internet may increasingly become a contested domain in both censorship and cyber warfare scenarios. 

‍

SpaceX has previously taken steps to improve Starlink’s resilience and accessibility in sanctioned or cut-off regions, including rolling out software updates and temporarily making service free in extreme situations. But the spread of satellite internet in countries with strict controls keeps causing diplomatic and regulatory conflicts.

‍

_{Author: Olga Nasibullina, Co-Founder at THESIGN.MEDIA}

‍

‍