Sweden’s domestic intelligence agency, Säkerhetspolisen, has identified Iranian-backed hackers as the culprits behind a significant cyberattack designed to sow division within the country. This attack occurred last year following a Quran-burning demonstration led by far-right political figure Rasmus Paludan, which sparked outrage and controversy across Sweden.
The cyberattack, orchestrated by a group linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), targeted a Swedish SMS service and aimed to frame Sweden as an Islamophobic nation. In a move intended to provoke further unrest, the hackers sent approximately 15,000 messages urging recipients to take revenge on those responsible for Quran burnings. This coordinated cyber strike was an attempt to manipulate public opinion and inflame tensions within Swedish society.
The incident that triggered this response took place in Stockholm, where Paludan, a Danish-Swedish dual citizen notorious for his anti-Islam provocations, set a copy of the Quran alight in front of the Turkish embassy. His actions, widely condemned, were followed by the Iranian hackers’ breach of the SMS service, amplifying the unrest that ensued from the stunt.
According to senior prosecutor Mats Ljungqvist, Swedish authorities successfully identified the individuals responsible for the breach. However, due to geopolitical limitations, the investigation has been closed, as the hackers are unlikely to face prosecution or extradition from Iran. Still, the Swedish Prosecutor’s Office emphasized that the case could be reopened at any time, provided the crime is not time-barred.
The cyberattack by the IRGC-linked group was not the only digital assault exploiting the Quran burning incident. Anonymous Sudan, believed to be part of a Russian information operation rather than a genuine Sudanese entity, launched attacks on Danish hospital websites and Scandinavian Airlines in a broader effort to destabilize the region. These actions, coordinated alongside Russian media coverage and likely pre-planned, further demonstrated the far-reaching impacts of Paludan’s actions.
This cyber campaign comes on the heels of earlier warnings from Säkerhetspolisen, which highlighted Iran’s growing use of criminal networks within Sweden to execute violent acts targeting individuals or entities seen as threats by the Iranian regime. Such tactics echo incidents elsewhere, such as in the United States, where an Iranian drug trafficker allegedly recruited a Hells Angels member to carry out an assassination against an Iranian defector.
This event underscores a troubling trend where state-sponsored cyber warfare and criminal networks are increasingly used to manipulate and destabilize other nations, demonstrating the complex and far-reaching implications of global conflicts in today’s digital age.


They’ll be the UK in another few years.
Thanks for your comment, Darryl! You might be right about that — it’s important for all countries to stay vigilant against these kinds of threats.