On February 13, an Iranian cyber group Ghyamsarnegouni announced that it had breached data systems belonging to the Iranian parliament and obtained hundreds of documents detailing internal communications, lawmaker salaries, and more. Much of the data, reportedly gathered from across 600 servers, was promptly shared via the group’s channel on the messaging app Telegram, which is popular among activists in Iran and other countries where internet freedom is severely limited.
According to internal documents disclosed by the group, members of the Iranian parliament, or Majlis, are paid salaries exceeding 20 times the median salary for Iranian schoolteachers. The underlying breach of government systems was confirmed by state media.
Ghyamsarnegouni’s Telegram posts sparked widespread outrage on other channels and on other social media networks that are routinely accessed by the Iranian public in spite of government restrictions. Some of the resulting posts highlighted a broader social response which arguably added to the prospect of renewed popular unrest, roughly 15 months after the outbreak of a nationwide uprising that was widely described as the greatest challenge to Iran’s theocratic dictatorship since the 1979 revolution that brought it to power.
The Ghyamsarnegouni new revelation reflect as a sign of its growing penetration of various segments of Iranian society by opposition activists insofar as they appear to rely upon intimate access to government systems that are not connected to the internet.
On February 21, according to Tehran-based news agency Moej, on the previous week’s hack prominent Iranian MP, and former presidential candidate Mostafa Mirsalim said, “Since the network used by the parliament is an intranet, there could not have been access to it by external tools, unless operatives who have infiltrated into the parliament and had access to the system took out the information.”
A cyber-security expert who spoke on the condition of anonymity pointed out: “This is an alarming sign for the authorities in Tehran. No firewall can defend against insiders who have access to your system and an attack can happen anywhere, anytime.”
Ghyamsarnegouni, whose name translates to “Uprising Until Overthrow,” apparently supports the People’s Mojahedin Organization of Iran, the country’s leading opposition group and principal member of a pro-democracy coalition known as the National Council of Resistance of Iran. The group’s support for the PMOI, or MEK, has previously been expressed through hacks of government websites and state media broadcast signals, which resulted in the dissemination of slogans like, “Death to Khamenei” and “Hail to Rajavi,” in reference to the Iranian regime’s supreme leader and the leaders of the resistance, respectively.
The website for the office of the current, ultra-hardline president, Ebrahim Raisi was among those systems reportedly hacked by Ghyamsarnegouni in just the past year, as was the Foreign Ministry. The latter hack yielded another massive trove of documents and bought international attention to issues of Iranian foreign policy.
Access to the Majlis and releasing of the documents was evidently planned to take place ahead of Iran’s parliamentary elections, which are scheduled for March 1. Regime authorities have been working to promote widespread voter turnout, on the assumption that broad participation would demonstrate public support for the underlying system. This is typical of the regime’s attitude toward the electoral process, but voter turnout is no doubt viewed as especially important now, going into the first election since the September 2022 uprising.
Naturally, opponents of the regime are encouraging an electoral boycott, as they have done in previous years. The most recent parliamentary election, in 2020, saw historically low turnout.
It is generally assumed that the low turnout in that case was related, in large part, to public awareness of the regime’s crackdown on nationwide protests that took place less than four months earlier, in November 2019. According to multiple sources including officials in Iran’s Interior Ministry, around 1,500 protesters were killed in that crackdown.
To the extent that this discouraged Iranian citizens from supporting the ruling system through voting, it seems likely that the phenomenon will repeat in the wake of a similar crackdown on the 2022 uprising.
While many activists are still highlighting this phenomenon as part of their call for an electoral boycott, Ghyamsarnegouni appears to have adopted a different tactic with its latest breach of government systems, using salary figures to embarrass the regime in advance and to portray lawmakers and aspiring lawmakers as garishly wealthy and impossibly out of touch with beleaguered citizens.