Iranians had seen a "paradigm shift in digital repression" using a variety of techniques since July, the Miaan group said, adding that some activities bore clear signs of Tehran's involvement.

Miaan, which provides legal and technical support to rights campaigners in and outside Iran, said cyber threats referred to it in July-March jumped nearly 170 percent over the previous six months.

July-March covered the aftermath of last year's 12-day bombing campaign by the US and Israel, as well as street protests starting in December and renewed bombing since late February.

Cyberattacks can be difficult to attribute directly to the Iranian state or state-linked actors.

But "in several cases there is significant evidence that strengthens the possibility of a connection," Miaan said.

One example was a human rights group targeted by a direct denial of service (DDoS) attack, which floods internet servers with requests, crowding out legitimate traffic.

"This is one of the most important pieces of evidence in the entire collection, because... domestic telecommunications infrastructure inside Iran was also observed in the attack," Miaan said.

The DDoS attack was just one element in a "multilayered, adaptive, and in some cases successful threat environment directed against high-risk Persian-speaking users and institutions," the group said.

It said requests for help from people outside Iran were concentrated in Britain, the US, Sweden, Turkey, Germany and France.

Within Iran, the government imposed internet blackouts during the January protests and again during the new war.

Miaan said it saw a surge of referrals related to arrests and people having their devices confiscated during the December-January protests.

Requests also leapt for help with issues like being unable to access messaging services such as WhatsApp and Instagram and fears that authorities might have hacked people's accounts or devices.

Ethnic minority and human rights organisations accounted for around half Miaan's referrals between July and March, while cases involving media outfits quadrupled to 12 percent of the total.

Documented cyberattacks included "phishing" attempts, in which attackers attempted to dupe or persuade people into giving up sensitive information.

Some used fraudulent messages purporting to be from trusted platforms like Facebook or Gmail, or fake accounts on messaging service Telegram.

Also on Telegram, Miaan reported distribution of a malicious information-gathering app targeting Android phones, disguised as a PDF document and designed to conceal itself once users mistakenly installed it.