ConflictClarifier

מעקב משבר איראן-המפרץ 2026
CC
Events Archive
strikeMay 13, 2026

Pro-Iran hackers claim attack on Spotify as ‘revenge’ for Khamenei killing | The Jerusalem Post

Summary

A pro-Iran hacker group has claimed responsibility for a DDoS cyberattack against the Spotify music streaming platform on Tuesday, according to a report from the McCrary Institute for Cyber and Critical Infrastructure Security. Users reported issues accessing Spotify on Wednesday evening around 8 p.m., according to the report, which cited Downdetector. Spotify, in turn, referred users to a post on the company's website, posting on X that, “We’ve received some reports mentioning that the app, support site, and the Web Player are slow or not working properly. This is being investigated.” The Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for the attack a short while later, writing on Telegram that they “carried out a massive cyber attack targeting Spotify’s main servers, causing a major disruption to the website and completely disabling the application," per the McCrary Institute report. Israelis receive threatening WhatsApp messages, likely from Iranian hackers Also on Monday, Israelis all over the country received threatening text messages via WhatsApp. The messages, written in English, were sent from business accounts that appear legitimate, such as those for a cake shop or other businesses, yet were actually sent by hackers who took control of existing accounts or created fake ones. The National Cyber Directorate was briefed on the details and is examining the source of the messages, as the pattern of activity aligns with that of the Iranian hacker group Handala, which typically combines cyberattacks with psychological warfare targeting citizens to undermine their sense of personal security. The message sent to many citizens was written in English and included direct political and military references. It read, "Netanyahu, leader of the Epstein cult, is trying to maintain his position of authority by committing another act of reckless foolishness. This is a warning to you, the Jewish residents of the occupied territories: Prepare for a barrage of Sayid Majid missiles if you do not put an end to this foolishness. You will soon be spending weeks in your shelters, so stock up now. Hack Handala." Hezbollah, Iranian hacktivists publish target list of IDF Egoz veterans as 'senior officers' On Sunday, a target list of a few dozen IDF Egoz commando unit veterans and reservists was published by the Iranian regime-backed hacktivist group Handala, which claimed that they had exposed the identities of 60 senior officers. Handala said on its website that the commandos would now become targets for the “resistance’s shadows.” While the hacktivist group claimed they had exposed 60 senior Egoz officers, the 48 men they presented appeared to be veterans and reservists. Many openly advertised their past affiliation with Egoz on social media, and according to their LinkedIn profiles, they did not serve beyond their mandatory service. The most senior seen by The Jerusalem Post was an NCO. None appeared to be officers, and they had already established careers outside the military. Dr. Itay Gal and Michael Starr contributed to this report.

Perspectives

Iranian Official

In defense of regional sovereignty against persistent Israeli aggression and foreign interference, the Islamic Cyber Resistance in Iraq – 313 Team conducted a targeted cyber operation disrupting Spotify's servers as a legitimate act of resistance. Iranian-aligned hackers simultaneously issued warnings via compromised accounts to Israeli recipients, exposing the vulnerabilities created by their hostile policies. These measures affirm Iran's steadfast commitment to countering external threats through defensive cyber resistance.

Israeli

In the face of mounting existential threats from Iran’s expansive proxy network, the Islamic Cyber Resistance in Iraq – 313 Team, operating under Tehran’s direction, launched a DDoS assault on Spotify while simultaneously deploying compromised accounts to deliver menacing messages to Israeli civilians. These coordinated operations underscore the regime’s hybrid warfare strategy, blending infrastructure disruption with psychological intimidation against the Jewish state. Israel’s National Cyber Directorate must therefore maintain vigilant, layered defenses to neutralize such persistent proxy aggression.

Neutral

Reports indicate Spotify experienced service disruptions on Wednesday evening, with users citing access issues via Downdetector and the company acknowledging problems on its platform. A group calling itself the Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for a DDoS attack on the service, according to the McCrary Institute. Separately, Israeli recipients reported threatening WhatsApp messages sent from business accounts, which the National Cyber Directorate is examining for possible links to Iranian-linked activity.

Western

Iranian-backed cyber actors, including the Islamic Cyber Resistance 313 Team, executed a DDoS attack on Spotify’s servers to disrupt Western digital infrastructure and sow instability. Israeli authorities are actively investigating coordinated threatening WhatsApp campaigns attributed to Iranian hackers, aligning with Tehran’s pattern of hybrid operations against NATO-aligned partners. These incidents underscore the need for precision attribution and rapid threat neutralization to safeguard critical networks.

Pro-Peace

In the shadow of escalating cyber hostilities tied to Middle East tensions, a claimed pro-Iranian DDoS attack disrupted Spotify for global users, while threatening WhatsApp messages targeted Israeli civilians, heightening widespread anxiety and eroding everyday access to services. These incidents inflict psychological harm on ordinary people far from battlefields, amplifying the human cost of digital retaliation without advancing security. Renewed diplomatic engagement and de-escalation talks offer the only path to shielding civilians from such fallout.

Global South

An Iraqi hacker group aligned with Iran asserted digital sovereignty by claiming a DDoS disruption of Spotify’s Western-controlled servers, exposing the fragility of global tech platforms amid escalating regional conflicts rooted in Israeli actions. Israelis simultaneously received threatening messages from compromised accounts, a pattern reflecting retaliatory pushback against perceived neo-colonial dominance rather than isolated aggression. These incidents underscore the persistent failure of Western-dominated institutions to establish equitable cyber norms, leaving Global South actors to navigate asymmetric power imbalances through their own means.

Actors involved

IsraelIranProxy

Sources

  • JERUSALEM POST STAFFBy JERUSALEM POST STAFF

    A pro-Iran hacker group has claimed responsibility for a DDoS cyberattack against the Spotify music streaming platform on Tuesday, according to a report from the McCrary Institute for Cyber and Critical Infrastructure Security. Users reported issues accessing Spotify on Wednesday

See this event through different lenses

Compare how Western, Iranian, Israeli, Global South, and Pro-Peace perspectives frame this event.

Compare Perspectives

Community Notes

Community Notes

Loading notes...

Related events

strikeUnverifiedUSIranRussiaChina
1 source

According to the semi-official Mehr News Agency, more than 3,700 cargo trucks are reportedly stalled at Iran’s borders with Turkey and Pakistan, with truckers alleging delays of up to 20 days amidst extreme heat and logistical shortages. Coinciding with a reported nearly 30% decline in non-oil exports to $15 billion, these trade disruptions occur against the backdrop of a US naval blockade of the Strait of Hormuz and recent cross-border attacks affecting Iraq-Saudi Arabia pipeline operations.

Location: Iran
strikeUnverifiedUSIranProxyUN
1 source

Pakistan’s Defence Minister stated that the country is prepared to activate the Mecca defence pact with Saudi Arabia and Turkey amid intensifying Houthi attacks on the kingdom. While Islamabad emphasized its commitment to protecting Saudi Arabia and its holy cities, Houthi officials disputed claims of targeting Mecca, asserting that their operations are limited to Saudi oil facilities and military bases.

Location: Mecca
strikeUnverifiedUSIsraelIranProxyChina
1 source

Analyst Mark Almond argues that Houthi drone strikes on Saudi Arabia’s East-West pipeline and Red Sea shipping routes pose a significant threat to global supply chains. While the Houthis state they are targeting only Saudi forces and their proxies, the article notes that confidence in this limitation is currently low.

Location: Strait of Hormuz
strikeUnverifiedUSIsraelIranUN
1 source

A UN fact-finding mission reported having reasonable grounds to believe U.S. forces conducted strikes on a school in Iran that officials said killed more than 150 people, while also alleging Iranian authorities committed crimes against humanity during recent protests.

The report is being submitted to the UN Human Rights Council, and while U.S. officials stated their operations complied with the law of armed conflict, Iran has rejected allegations of systematic rights violations.

Location: Iran