A group of Iranian dissidents, self-described as “GhyamSarnegouni” (meaning “Rise to Overthrow” in Farsi), has claimed responsibility for taking control of and defacing several Iranian presidency-linked websites on Monday. The dissidents have taken down these heavily protected websites, replacing images of Iranian regime Supreme Leader Ali Khamenei and President Ebrahim Raisi with those of Massoud Rajavi, the Leader Iranian Resistance, and Maryam Rajavi, the President-elect of the Iranian opposition coalition National Council of Resistance of Iran (NCRI). Other websites showed images of Khamenei and Raisi crossed out.
One of the sites even displayed the slogan “Death to Khamenei/Raisi! Hail to Rajavi!” This incident follows a previous disruption by the same group that targeted websites associated with the regime’s Foreign Ministry earlier this month. “GhyamSarnegouni” had reported they were able to obtain over 50 terabytes of data from the regime’s Foreign Ministry servers.
The regime has been the target of a series of damning and embarrassing hacks in recent times, including those targeting its nuclear program, state television signal, and even government surveillance cameras.
The dissident group has provided extensive details about today’s disruption and defacing of Iranian presidency-linked websites. These include access to top secret documents and defacings, such as:
Images of Iranian Resistance leadership and anti-regime slogans were sent to reporters and media outlets from the main email account of the regime’s presidency
The group gained control over 120 servers of the presidency’s internal network, central databases
The group obtained control over the government’s server management network and server controllers
The group obtained control over the presidency’s network of technical administrators
The group obtained control over the “Users Internal Network” and access to more than 1,300 computers of the presidency’s internal network
The group obtained security footage of the presidency’s communication network hardware
The group obtained access to systems of the classified internal communications associated to the presidency and the government
The group extracted and decrypted classified and encrypted messages related to recent years
The group obtained access to tens of thousands of classified, top secret, and secret documents associated to the presidency, including the appointment of Ali Akbar Ahmadian as the new Secretary of the regime’s Supreme National Security Council
The group obtained access to the presidency’s websites and dozens of internal applications
The group obtained access to other classified documents, such as the building design of Raisi’s office and sleeping quarters, the fiber-optic cable network linking the presidency and Khamenei’s headquarters, the government cabinet, the judiciary, Interior Ministry, Intelligence Ministry, Foreign Ministry, the IRGC paramilitary Basij Force, the Majlis (parliament), state TV and radio apparatus, Tehran’s airports, and other entities of the mullahs’ regime
The group obtained 19 pages of the technical infrastructure of the presidency’s computer network, the fiber-optic network map, and the buildings’ patch panel; 21 pages of the presidency’s technical network, including IP addresses, 104 pages of telephone numbers, internal phone systems, and the direct lines connecting all rooms of the presidency building
The group obtained classified documents of Raisi’s planned trips abroad for 2023 to Iraq, Syria, Pakistan, Indonesia, Kyrgyzstan, Oman, Uganda, Zimbabwe, Kenya, Venezuela, Cuba, Nicaragua, Uzbekistan, South African, India, the Shanghai summit, the Caspian Sea summit, Tajikistan, Kazakhstan, UN General Assembly in New York, Uzbekistan, and Gambia
The group obtained the names of the 25-member security team of Iranian regime First Vice President Mohammad Mokhber
Top secret letters from the IRGC command in Tehran involving at least five meetings of the Joint Security-Intel Committee presiding over the crackdown of the country’s universities