Tehran moves an unpublished internet bill as researchers say the last shutdown cost Iran its own hackers
A Cyberspace Regulation Bill sits before a parliamentary committee whose spokesman says its details will not be made public. ESET’s new APT report suggests Iran’s offensive operators recovered only as the blackout lifted.
Iran International reported on 28 October 2026 that lawmakers are reviewing a Cyberspace Regulation Bill that could expand the authorities' powers to restrict online access. Parliament received the proposal on 3 August 2026; the official text remains unpublished, and the story was originally broken by the Iranian outlet Jamaran. An unofficial 12-article draft circulating online resembles the Internet Protection Bill — the “Sianat” plan — that stalled in the previous parliament, though a committee member told local media the version under review differs from it. Rouhollah Abbaspour, spokesman for the parliamentary committee, said: “A decision has been made not to publicize the details of the Cyberspace Regulation Bill for the time being.” The sharpest internal dissent is economic, not rights-based: Mostafa Pourdehghan of the Industries and Mines Committee criticised repeated attempts to curb international connectivity, citing existing filtering, poor service quality and rising costs.
ESET published its APT Activity Report for April–September 2026 on 28 October. Middle East-aligned activity increased against the previous reporting period, the company said, driven mainly by the return of several established Iran-aligned groups, with Israel the principal focus across multiple sectors and a smaller number of US companies affected. The report describes a resurgence in September from actors including MuddyWater. The comparison is what matters: ESET’s previous report, released 28 May and covering October 2025 to March 2026, found a decline in Iran-aligned activity in its telemetry, which the company attributed to Iran’s own internet restrictions hampering its operators. ESET also disclosed activity by Arid Viper, a Hamas-affiliated actor, against what appears to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or an affiliated body — collection against Ramallah, not Tel Aviv.
Assessment: The two documents read against each other make an argument Tehran’s own officials will not make: censorship has a price the censor pays. If ESET’s telemetry is right, the nationwide shutdown degraded Iranian offensive operations roughly as much as it degraded Iranian commerce, and capability returned with connectivity. A bill that institutionalises the kill switch therefore institutionalises that cost. Two cautions. ESET measures what ESET sees; a drop in one vendor’s telemetry is not proof of a drop in activity. And the unresolved question in Tehran is not the bill’s text but who holds the switch — current and former officials have given differing accounts of that authority. Also unsettled: the blackout’s actual duration, which public records do not reconcile.