Info War & Source Reliability
From the first hours of the US-Israeli strikes on Iran, the information environment became a second battlespace — one where claims about casualties, infrastructure damage, and leadership kills moved faster than any verification mechanism could follow. This thread tracks the fog machines: fabricated satellite imagery, bot-amplified casualty claims, AI-generated content, deliberate attribution flips, and the cross-ecosystem correction cycles that sometimes caught them.
The arc follows a clear trajectory. In the opening hours, disinformation was reactive and crude — false death announcements, recycled footage, hasty claims debunked within minutes. By day three, it had professionalized: states deployed coordinated attribution flips (blaming Israel for Iranian strikes on Gulf oil infrastructure), opposition outlets manufactured succession narratives, and every belligerent tightened its information perimeter. By the end of the first week, the information denial architecture had become the story itself — satellite imagery delays extended to 14 days, Iran's internet blackout passed 120 hours, and Israel imposed prison sentences for publishing impact locations.
What makes this thread structurally revealing is not the volume of fakes but the speed of correction cycles and who performed them. Russian milbloggers — often caricatured as pure propagandists — repeatedly flagged AI-generated content and sourcing problems before Western OSINT accounts did. Israeli OSINT channels became the fastest debunkers of Iranian casualty claims, while Iranian state media ran the tightest message discipline on succession politics. The information war was not chaos — it was a series of competing quality-control systems, each optimized for different audiences.
First Signal
Saturday morning, February 28 (10:00–22:00 UTC) — four to sixteen hours after the first strikes hit Iran. The information war's opening salvo was dominated by a single question: who was dead and who wasn't? Boris Rozhin, one of the most-read Russian milbloggers, posted at 10:47 UTC that Iranian Armed Forces commander Amir Hatami — announced killed — was alive and safe. This set the pattern for the day: premature kill claims followed by corrections, with Russian channels performing the fastest debunking.
The Russian MFA's formal statement at 10:57 UTC framed the strikes as 'armed aggression,' a term that would harden into the standard Russian descriptor. IntelSlava immediately carried Rozhin's Hatami correction to English-language OSINT audiences. By evening, QudsNen (Palestinian) was surfacing Israeli source claims about pre-strike negotiations being a 'facade' — an early signal of the attribution battle to come. The ecosystem was 82% Russian-sourced in this window, reflecting both the Telegram corpus composition and Moscow's rapid information mobilization.
Coverage Widens
Saturday night through Sunday evening (Feb 28 22:00 UTC – Mar 1 18:00 UTC) — the Khamenei death question and the Minab school strike became the twin disinformation battlegrounds. At 22:16 UTC, Readovka reported that Fars News had denied Khamenei's death, calling Trump's announcement false. BBC Persian carried the denial at 23:10, noting Fars cited 'informed sources.' The framing gap was revealing: Russian channels treated it as a debunking of Western claims; Persian-language outlets framed it as regime resilience.
Simultaneously, the Minab school strike — where 148+ children would eventually be confirmed dead — became the first major disinformation target. At 23:28 UTC, CIG Telegram posted a GeoConfirmed rebuttal of claims that the school was hit by a 'failed rocket' rather than a strike. Fotros Resistance cross-posted instantly. By Sunday morning, Rybar had published an extended analysis framing Khamenei's reported death as a catalyst for consulate attacks worldwide — the information environment was already racing ahead of verification.
Activity Resumes
Sunday evening, March 1 (18:00–20:00 UTC) — roughly 36 hours into the conflict, the information war took a qualitative leap. BBC Persian reported at 18:13 that Iran's internet connectivity, severed since the strikes began, remained heavily restricted — meaning Iranian civilians were largely cut off from non-state information. At 18:20, BBC Persian broke that parts of IRIB (Iran's state broadcasting) had been struck, with the network framing it as an 'enemy attack on the voice of the nation.'
The most striking development came at 19:47 UTC: AbuAliExpress (Israeli OSINT) reported that IRIB Channel 3 had been hacked, broadcasting messages from Netanyahu and Trump directly to Iranian audiences instead of regular programming. This was information warfare in its most literal form — hijacking state media infrastructure. Simultaneously, Middle East Spectator carried Israeli Channel 12's claim that 'Iran is breaking the Geneva Convention,' while MilInfoLive (Russian) was already analyzing missile debris footage, noting that what Iranian sources claimed was a cluster-munition warhead was more likely a shot-down missile breaking apart. The ecosystem diversity exploded in this window — seven different ecosystem types active, up from the Russian-dominated opening.
Activity Resumes
Sunday night into Monday (Mar 1, 20:00 UTC – Mar 2, 00:00 UTC) — the first major amplification surge hit. The IRGC's claim of 40 killed and 60 wounded in Haifa triggered an immediate cross-ecosystem collision. Boris Rozhin carried the claim straight at 20:01 UTC (22,600 views). Within fifteen minutes, AbuAliExpress fired back in Hebrew: 'Just so you understand how much the Iranians are liars — the IRGC claims 40 dead and 60 wounded in Haifa. The bigger the lie...' This real-time debunk-and-counter cycle became the template for the days ahead.
The window also surfaced a kinetic-information crossover: Middle East Spectator reported a gunman wearing an Iranian flag shirt killed two people in Texas. Whether authentic or staged, the story migrated instantly across ecosystems. By 22:15, MilInfoLive was analyzing leaked Pentagon slides on 'Operation Epic Fury' — the first operational documents entering the information space. Rybar published a comprehensive end-of-day summary at 22:22, functioning as the Russian ecosystem's wire service. The OSINT channels (7 items) matched Russian channels (6 items) for the first time, signaling the verification community was now fully mobilized.
Amplification Surge
Monday through Tuesday evening (Mar 2, 00:00 UTC – Mar 3, 18:00 UTC) — the information war's longest chapter saw the fog thicken across multiple fronts simultaneously. At 01:20 UTC Monday, BBC Persian reported Iranian media confirming strikes on Gandhi Hospital, Khatam Al-Anbiyaa Hospital, and a Red Crescent building — civilian infrastructure targeting that would become a major disinformation battleground. IntelSlava carried Pentagon-released strike footage at 03:54 while simultaneously, at 04:49, posting IRGC footage of underground drone and missile tunnels — the information space presenting dueling proof-of-capability narratives.
A critical pattern emerged: the Saudi false-information committee debunked a Riyadh hotel fire claim (Soloviev, 06:23 UTC Tuesday), marking the first Gulf state entering the information war as an active counter-disinformation actor. Rozhin surfaced a Pentagon congressional briefing admission — no evidence Iran was preparing a preemptive attack on US forces — at 06:42, a revelation that cut against the US casus belli narrative. By midweek, Rybar was publishing detailed technical analysis of US Reaper drone operations over Iran, while Cuban state media (Cubadebate) appeared in the thread for the first time, reporting arrests of Panamanian citizens for 'propaganda against constitutional order' — the information war's ripple effects reaching the Caribbean.
Amplification Surge
Tuesday evening through Wednesday morning (Mar 3, 18:00 UTC – Mar 4, 06:00 UTC) — this window was dominated by Iranian state media's information offensive around the Khamenei funeral preparations. Tasnim published logistics for the farewell ceremony at 19:44 UTC; Mehr followed with mourning coverage framing the narrative as one of 'bravery, generosity, and devotion to the leader.' The Russian MFA injected a parallel narrative at 18:02 — an explicit 'anti-fake' bulletin accusing Western media of 'smearing Russia' under political orders.
The ecosystem composition shifted dramatically: Iranian sources produced 9 of 15 items, their highest share yet. This wasn't organic — it was a coordinated messaging push timed to the funeral preparations, designed to dominate the information space during a moment of regime vulnerability. BBC Persian at 22:12 UTC reported Fars sources suggesting the Assembly of Experts' final session to select a new leader might be held in-person after burial — a story the information environment would obsess over for days. QudsNen surfaced a British funding connection to an Israeli documentation group, opening a new disinformation vector about Western complicity.
Amplification Surge
Wednesday early morning (Mar 4, 06:00–08:00 UTC) — a brief but concentrated Iranian messaging burst. Eight of ten items came from Iranian state channels, focused entirely on funeral logistics and mobilization. IRNA and Mehr published near-identical traffic advisories for the Khamenei farewell procession at 06:57 and 06:59 UTC — the synchronized timing revealing a centralized messaging apparatus.
Rybar's morning dispatch at 06:15 stood out for its sardonic tone, headlined 'Turkey is an independent state' with 'jokes for the morning of March 4' — processing the growing absurdity of conflicting claims through dark humor. Rudaw English (Kurdish Iraqi media) reported an Iraqi militia drone attack claim in Jordan, a story that would later feed into the Kurdish ground offensive disinformation cycle. The window's narrowness (two hours) and ecosystem concentration (80% Iranian) marked it as a pure state-media mobilization event rather than an organic information development.
Amplification Surge
Wednesday through Friday (Mar 4, 08:00 UTC – Mar 6, 14:00 UTC) — the thread's largest chapter (107 items) saw the information war mature into systematic operations. The Kurdish ground offensive story at editorial #90 became the defining disinformation event: Fox News cited a US official; CIG Telegram and IntelSlava amplified; AbuAliExpress added Israeli framing — and then denials cascaded from every direction. Iranian and Kurdish sources both rejected the claim, but it had already served its purpose as a pressure narrative.
Iran's NYT ceasefire story triggered another attribution battle. At 14:59 UTC Wednesday, Soloviev reported Iran denying the NYT claim of ceasefire readiness. Rozhin followed at 15:21 with sharper framing: 'poorly concealed desire' by the American press to project Iranian weakness. The information environment was now processing not just events but other media's coverage of events — a recursive loop. Meanwhile, Iranian state channels maintained extraordinary volume: 33 items, the highest absolute count in any chapter. The Ras Tanura attribution flip — Tasnim claiming Israel struck the Saudi refinery while Iran was openly hitting Gulf states — was identified in editorial #57 as a deliberate wedge operation to separate Gulf energy interests from the military coalition.
Amplification Surge
Friday afternoon through Saturday morning (Mar 6, 14:00 UTC – Mar 7, 08:00 UTC) — the Azerbaijan disinformation front opened fully. IntelSlava at 19:02 UTC Friday reported Azerbaijan 'preparing the ground for an attack on Iran' through disinformation about an 'Iranian attack on Nakhchivan.' By 20:00, IntelSlava followed with Israeli Channel 11's claim that Azerbaijan would 'soon enter a war against Iran on Israel's side.' The narrative's migration path — Azerbaijan state security → TASS → Soloviev → Rozhin — was tracked in editorial #134 as a textbook synchronized construction.
Trump's 'Make Iran Great Again' statement (Al Jazeera, 14:00 Friday) and 'unconditional surrender' demand generated massive cross-ecosystem amplification. Al Mayadeen at 16:59 carried a Khamenei account post in Hebrew on X — the deceased leader's social media still being operated as an information weapon. Middle East Spectator's breaking report on possible Hezbollah prisoner captures at 02:20 Saturday carried the hallmarks of unverified fog-of-war content. TASS closed the window at 21:45 Saturday with the Kurdistan Democratic Party's denial of any offensive — the correction arriving 48 hours after the original claim, illustrating the asymmetric speed of disinformation versus debunking.
Amplification Surge
Saturday through Sunday (Mar 7, 08:00 UTC – Mar 8, 08:00 UTC) — the one-week anniversary brought a reckoning with accumulated disinformation. Tasnim at 08:36 Saturday published mourning invitations for Khamenei's seventh-day ceremony, maintaining the regime's information drumbeat. But the most significant item came from an unexpected source: Margarita Simonyan, RT's editor-in-chief, posted at 12:53 UTC warning her followers about fakes circulating under her name — 'if you see such information anywhere, don't fall for it.' When the Russian information ecosystem's most prominent figure publicly flags disinformation targeting herself, the fog has reached saturation.
BBC Persian at 14:28 highlighted the 'apparently contradictory statements' between Pezeshkian (who apologized to neighbors) and Khatam Al-Anbiyaa headquarters (which announced continued strikes) — the Iranian internal split becoming an information warfare vulnerability. TASS closed the window by carrying the Kurdistan Democratic Party's formal denial of any offensive, sourced through Rudaw and Tasnim — a rare three-ecosystem convergence on a single debunking. The Tasnim housing ministry warning about fake SMS scams targeting housing applicants at 11:36 revealed the domestic information environment's parallel crisis: opportunistic fraud riding the war's chaos.
Amplification Surge
Sunday through Monday morning (Mar 8, 08:00 UTC – Mar 9, 00:00 UTC) — the information war entered a new phase: narrative fatigue and recycling. Fotros Resistance at 23:24 Sunday published a remarkable artifact — a 28-page Farsi document debunking 'all rumours and doubts' about Mojtaba Khamenei, citing Wikipedia and other sources. The existence of such a document reveals the scale of the information war around succession: enough disinformation had accumulated to require a comprehensive rebuttal.
Rybar's output was particularly revealing. At 15:34, a dispatch headlined 'Khark is not the only target' analyzed Israeli intelligence 'plants' through Western media about potential special forces operations — Rybar was now performing meta-analysis of information operations, not just amplifying claims. At 17:14, Rybar published a week-in-review noting that 'with each day, the sides invent new ways to escalate.' Russian milblogs at 13:49 carried UAE denials of involvement in a desalination plant strike, while Arab channels dominated with military communiqué coverage. The ecosystem had settled into its mature configuration: Russian channels as analytical processors, Iranian channels as mobilization engines, Arab channels as event carriers, OSINT as the verification layer.
Peak Activity
Monday through Tuesday (Mar 9, 00:00 UTC – Mar 10, 04:00 UTC) — the thread's final chapter brought the information war's most sophisticated dynamics yet. At 04:13 Monday, IntelSlava flagged Iranian media claims that Bahrain's king had 'fled the country' after heavy bombardment — a claim Bahrain notably did not immediately deny, creating an information vacuum. Soloviev at 11:18 carried Fox News's on-air apology for an 'error' during the Dover Air Force Base ceremony for six dead American service members — a US domestic information failure that Russian channels amplified as evidence of systemic dishonesty.
The Patriot missile failure video (Rybar, 20:16 Monday, 13,500 views) became the window's signature artifact — clear footage of an interceptor malfunctioning at low altitude, framed by Rybar with the sardonic headline 'I'm not me, and the missile isn't mine.' Fotros Resistance at 20:48 caught the Israeli army's Farsi propaganda page reposting footage from the 2025 twelve-day war — 'it seems they've run out of videos' — a small but telling indicator of the content production strain on all sides. Trump's closing threat about Iranian power stations at 22:00 and Hormuz at 00:41 generated the final amplification wave, with Al Jazeera Arabic carrying both statements to massive Arabic-speaking audiences.