Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships

Lab Dookhtegan, a hacking group, allegedly disrupted the communications of 60 Iranian ships run by sanctioned firms National Iranian Oil Tanker Company and Iran Shipping Lines, hitting at least 39 tankers and 25 cargo ships. Hackers breached the satellite communications company Fannava, disabling the Falcon communications system and wiping core data, leaving the ships effectively blind.

They mapped Iran’s fleet modem by modem, gained root access to Linux terminals running iDirect satellite software (version 2.6.35), and maintained five months of persistence before crippling ships in August. The attack coincides with new U.S. sanctions on Iranian oil and is described as a precise operation that could keep vessels idle for weeks or months, with each affected vessel requiring a complete system reinstall.

The article cites screenshots and claims presented from a Nariman Gharib blog, and notes this is the second attack by Lab‑Dookhtegan this year after a March disruption of 116 ships; according to Nariman Gharib blog.