Cybersecurity — 2026-04-22

Iran alleges coordinated mid-conflict shutdown of US-vendor networking equipment, accusing Cisco/Juniper/Fortinet/MikroTik of sovereign backdoors

Iranian state outlet Fars News Agency reported that hardware from Cisco, Juniper, Fortinet, and MikroTik experienced unexplained simultaneous shutdowns and reboots during the late-February to early-April US-Israeli strike campaign while Iran was disconnected from the global internet, The Register and TechRadar reported April 21. Tehran characterizes the failures as evidence of pre-installed sovereign backdoors and deep-seated sabotage. Independent verification has not surfaced; security analysts cited by The Register flag the pattern as more consistent with operational firmware faults under stress than backdoor activation. Chinese state media has amplified the Iranian framing, mirroring earlier Beijing claims about US vendor risk in critical infrastructure.

Analysis
Tehran's claim lacks released evidence and fits the pattern of operational firmware faults under stress, per skeptical analyst framing in The Register and TechRadar, but the strategic effect runs independent of truth value. Beijing's amplification is the sharper signal: China is using the war to relitigate the 2018–2020 Huawei restrictions, asking developing-world buyers to apply to US vendors the scrutiny Washington demanded of Chinese ones, and the accusation very likely accelerates PRC-aligned procurement substitution in third-country markets where US networking has held share through inertia. Whether Iranian network restoration generated forensic artifacts capable of substantiating or falsifying the claim may never surface publicly; Tehran is unlikely to release material that would expose its own network architecture.

3 sources

Iran claims US used backdoors in networking equipment - The Register
Iran alleges systematic sabotage of US-made networking infrastructure mid-conflict - TechRadar
Iran alleges secret backdoors in US networking infrastructure - China TechNews