On February 28, the day that bombs started falling on the Islamic Republic, a man’s voice began broadcasting in Farsi on a shortwave-radio frequency. He announced himself—“Tavajjoh! Tavajjoh!” (Attention! Attention!)—and then read a string of seemingly random numbers. Anyone with a shortwave radio could hear him. But the announcer’s intended audience was likely no more than a handful of people using a centuries-old system to decipher his otherwise incoherent message.
The eerie and still-unattributed radio transmission came from a numbers station. You don’t hear them much anymore. But when the CIA and the KGB needed to communicate with their spies working undercover, such broadcasts were convenient and safe ways to send orders around the world. The intended recipient turns on their radio at a set time to a specific station and writes down the numbers they hear. Using a technique called a “one-time pad,” they convert each number into a letter, eventually revealing a message. The transmission is out in the open. But if only the sender and the recipient have the pad—which is written down and destroyed immediately after the message is sent—only they can understand the message.
When used properly, this old-school method creates an unbreakable secret code. But numbers stations—which are recurring elements of Cold War–era spycraft in movies and TV shows—have been largely replaced by digital encryption and internet-based covert-communication systems. So why is a Persian-language numbers station broadcasting in the middle of a war in 2026?
Your browser does not support audio playback.
The mystery of the numbers station points to a murky shadow war with Iran under way long before the latest round of overt hostilities broke out a week ago. Both sides in this struggle have employed unconventional means. But the Iranian regime has been particularly reliant on asymmetric attacks, including against civilians.
For years, the Iranian government has used foreign agents, including those working undercover, to try to kidnap or kill government officials, activists, and journalists abroad. U.S. and European officials I spoke with this week are bracing for a return to that playbook as the regime fights for its survival in a war against adversaries that boast superior military capabilities. Within the past eight years, Iranian agents—some of whom were mercenaries recruited online—have allegedly tried to assassinate former National Security Adviser John Bolton in Washington, bomb a political rally near Paris, kidnap an Iranian American journalist from her home in New York, and kill Israeli business people in Colombia and Cyprus. On Friday, a Pakistani man was found guilty in New York of plotting with Iran to kill President Trump and other public officials.
Although some of these thwarted attacks were comically ham-handed, Western government officials have taken Iran’s plotting seriously enough to warn their citizens. In December 2022, the head of MI5, Britain’s domestic-security agency, announced publicly that authorities had uncovered at least 10 potential threats to kidnap or kill British nationals and people living in the United Kingdom.
Western officials feared that a successful Iranian attack would escalate tensions and potentially lead to armed conflict. Now that the war is here, officials told me Tehran likely believes that it has little to lose by attacking overseas, including by striking civilian targets. Under sustained attack by the U.S. and Israel, the regime may turn to asymmetric retaliation to try to maintain control.
Cyberattacks are another weapon in Iran’s asymmetric arsenal. The country has long had a sophisticated and diverse cyber force, which U.S. officials have linked to operations that have crashed bank websites and probed critical infrastructure, including the control systems of a dam in New York State. Iran is also accused of interfering in U.S. elections, though not on the scale of more sophisticated actors such as Russia.
So far in the war, experts have reported ideologically aligned “hacktivist” groups claiming to act on Iran’s behalf, including by defacing websites, but have not seen clear evidence of government actions. “The Iranian response thus far has been fairly muted,” Adam Meyers, an executive at the computer-security company CrowdStrike, said at a conference in California last week.
[Read: The one variable that could decide the war]
But, as with physical attacks, it’s the potential for Iran’s government to cause damage that has U.S. officials on guard. Iran has long viewed civilian targets as both legitimate and a high priority. Mohammad Hossein Tajik, a now-deceased former commander of an Iranian cyber unit, once told me that in the past decade, Iran was responsible for attacks on the electrical system in Turkey; a damaging assault on the computer systems of Saudi Arabia’s state oil company; and an innovative financial heist targeting SWIFT, a communications network used by the world’s banks. Tajik also told me that Iran had shared hacking techniques with Russia over many years. More recently, Iran has provided Russia with technology and expertise to build drones used against Ukraine. And on Friday, The Washington Post reported that Russia has given intelligence to Iran to help strike U.S. forces in the Middle East. The potential for joint Iranian-Russian cyberattacks cannot be ruled out.
Iran has a lot of potential to cause mayhem, so why hasn’t it? “It is to me the key question,” Nate Swanson, a former career State Department official who served as Iran director at the National Security Council, told me when we spoke on Friday morning. Swanson said he was surprised to see Iran strike Saudi Arabia, Qatar, and the United Arab Emirates, among other countries in the Gulf region, as soon as the war began rather than turn first to proxy attacks, assassinations, or cyberattacks abroad.
Iran’s capabilities could have been degraded in the initial assault, he said. (The Israel Defense Forces reportedly bombed agencies that play a role in domestic cybersurveillance and overseas attacks.) Another possibility, Swanson told me, is that Iran is holding these capabilities in reserve. The country’s behavior thus far suggests it is pursuing “a decentralized plan for a war of attrition,” he said. Iran’s military and intelligence leaders may not have begun asymmetric attacks yet because they’re waiting for the United States and Israel to draw down their own weapons stores.
Trump has said he expects the military campaign to take about four weeks. “If you take the president at his word, that means there will be multiple phases of this campaign,” Jonathan Panikoff, a former senior intelligence officer covering the Middle East, told me. “You could see the same thing from proxy organizations” such as Hezbollah in Lebanon, Panikoff said. “That may be in Phase 2 or 3.”
Shortly after we finished speaking came reports that Hezbollah had begun firing on Israel. Panikoff told me he was concerned that communities in northern Israel would again be threatened, as they were when Hezbollah attacked after the October 7 terrorist assault by Hamas. It’s not clear how much remains in Hezbollah’s arsenal after the extensive Israeli air campaign aimed at destroying its missiles and launchers, Panikoff said. But now that the proxy attacks have begun, one wonders if assassination plots and cyberattacks might soon follow.
And what about that weird business with the numbers station? What is its role, if any, in Iran’s plans? I admit that when I first heard the broadcast, I imagined Iran sending orders to clandestine agents abroad. Considering that Iran is overwhelmed by technologically superior forces, reverting to a tried-and-true communications system would not be outlandish.
But we don’t know where the broadcast originates, according to the amateur shortwave trackers with the international group Priyom, who welcomed me into their chat room. That makes it harder to know whether Iran is running the station. We do have indications that Iran’s government is jamming the signal, using techniques that the trackers have documented in the past. That suggests an even more intriguing potential twist: Perhaps Iran isn’t sending messages to agents abroad, but an adversary is sending messages to agents in Iran.
The government has imposed an internet blackout in the country, which could challenge, say, Israeli or American intelligence agencies trying to contact their agents in Iran. In recent decades, the United States has used internet-based systems to communicate with its operatives. (Years ago, Iranians discovered how the system works and arrested or killed many spies.) But the CIA has also used satellite-based systems for its most valuable human assets.
One U.S. official I spoke with wondered whether the station was just a red herring meant to make the United States and Israel believe that Iran was activating foreign sleeper cells. Or could someone be trolling the Iranians? The amateur trackers have heard the suspected Iranian jammer as far away as Canada. That’s a lot of effort, and transmission signal, to stop a prank.
[Read: ‘The worst-case outcome is complete chaos’]
As of late last week, the station had broadcast numbers seven times since the war started, but then went quiet. Perhaps the message had been delivered. Maybe the broadcaster gave up in the face of Iranian interference. The trackers lamented that we might have heard the last of V32, the designation they’ve given the station.
On Saturday, some of the trackers and I dutifully tuned in at 1800 coordinated universal time (1 p.m. in Washington, D.C.) to see whether V32 might reappear at its customary broadcast hour. We heard nothing. But a minute later, one of the trackers heard a man’s voice, slowly and clearly reading numbers in Farsi, on a different frequency. Over on V32’s previous frequency, the jammer was banging away, apparently unaware that the reader had moved. A classic cat-and-mouse game was on.
The trackers reported that they heard the numbers clearly in their various locations across Europe and the Middle East. They tried different methods to locate the transmission’s origin, without success. We listened for ambient noises that might give us some hint as to who was reading. Some trackers thought they heard a fan blowing. Others said they heard the sound of a Microsoft Windows prompt. Not especially revealing clues, but ones that offered more information than we’d had about V32 when the broadcast started. After about 90 minutes, the reader stopped, and we heard only static.
We still don’t know who’s sending the messages, who they’re meant for, or what they mean. Even the jamming might be an unreliable clue. I found myself wondering if Iranian intelligence broadcast the message and then jammed it to make the Americans and the Israelis think it wasn’t them.
Security officials are trying to make sense of baffling developments like the numbers station as they work to forestall potential attacks. Trump has extolled the ferocity of the U.S. campaign, now just more than a week old. Undoubtedly it has caused tremendous damage to Iran’s military, its security apparatus, and its leadership, with comparatively little loss of life on the American side.
But no one I’ve talked with thinks Iran has been so crippled that it cannot inflict pain and damage beyond its borders. If this week was just the first phase of a long war, don’t expect Iran to use every weapon in its arsenal at once.
The post The Asymmetric Ways Iran Could Strike Back appeared first on The Atlantic.
