Welcome back. The war is less than two weeks old. Iran has a new supreme leader. (Or does it? See below.) Meanwhile, some of the war’s most striking developments are taking place on the frontlines of cyberspace.
Share your thoughts, analysis and predictions with me at ailves@mbn-news.com. If you were forwarded the newsletter, please subscribe. Read me in Arabic here, or on the flagship MBN Arabic-language and English-language news sites.
Quote of the Week
“Khamenei the Younger exists in not one but two states of superposition: both (or neither?) alive and dead, and simultaneously the Supreme Leader… and not.”
–Internet pundit Stephen Green
TOP OF THE NEWS
But where is he? Photo: Reuters
Where’s Mojtaba?
In my last edition of the newsletter, I highlighted the most important things to know about Mojtaba Khamenei, who succeeded his father as supreme leader of the Islamic Republic.
So where is he?
He’s rarely ever been seen, even before Monday. Mojtaba has always been a shadowy figure, but even by Islamic Republic standards the opacity is startling. There are a few short clips from a couple of years ago in which he is visible and speaking, and that’s pretty much it. The public record offers only a handful of photos of Mojtaba at Quds Day marches in 2018 and 2019, plus the odd group shot from clerical gatherings in Qom years before this war.
The man proclaimed as Iran’s new “supreme leader” has not delivered a single confirmed post‑strike speech, video message, or even a few seconds of fresh audio. There is no visual evidence that he is actually at the helm. One can point to old images, but not to a single verified appearance in recent months.
In the theological underpinning of the existence of the Islamic Republic, the supreme leader is approved in his role by God Almighty. Mojtaba has now been elevated to this most powerful role in the country, but he is nowhere to be seen. The supreme leader’s website Khamenei.ir (English here) has not been updated in days and only speaks of the now-deceased father.
The MBN China Tracker is a data-driven, interactive feature on how successfully Beijing wields economic, political and military influence in the Middle East compared to the U.S.
The regime is referring to him as wounded in war. “Janbaz” (جانباز) is regime shorthand for someone who has been physically wounded in war, and state TV has now attached that label to Mojtaba in the specific context of what it calls the current “Ramadan war.” The term implies “wounded by the enemy” in the context of the ongoing conflict, but we have no details as to where, when, or how he may have been injured.
This mystery matters. A nuclear‑threshold state, in the middle of a shooting war with the United States and Israel, is claiming to have a new supreme leader who has not addressed his own public or the world even once. The silence fuels competing theories, among them that he is alive but badly injured and fronting for an IRGC‑clerical junta; that he is incapacitated and being used as a placeholder; or, in the most conspiratorial version, that he died in the same strikes that killed his father and the system is ruling in the name of a ghost. Until Tehran can provide something as basic as a dated video message, those questions will hang over every decision issued “in the name of Ayatollah Mojtaba Khamenei.”
One analyst simply calls him Schrödinger’s Ayatollah, “both (or neither?) alive and dead, and simultaneously the Supreme Leader… and not.”
An alert issued by the United Arab Emirates’ Interior Ministry, warning of potential missile threats and instructing people to seek shelter. Photo: Reuters
The Fog of War
The mystery of the missing Mojtaba leads me to the next matter: The shadow war being fought in cyberspace.
The U.S. opening: The first American move in this war was not the firing of a missile. General Dan Caine, the Chairman of the Joint Chiefs of Staff, told reporters that U.S. Cyber Command and Space Command were among the “first movers” in Operation Epic Fury, “disrupting and degrading and blinding Iran’s ability to see, communicate and respond” before a single plane crossed the border. Iran went dark at precisely the moment it needed its networks most. But the government also seems to have shut down access to keep its own people in the dark.
On the morning of Feb. 28, Iran’s available internet connectivity dropped to between one and four percent. (This site, which monitors connectivity in real time, issued this update: “Iran’s internet blackout is now among the most severe government-imposed nationwide internet shutdowns on record globally, and the second longest registered in Iran after the January protests, with the country having spent a third of 2026 offline.”)
Amazon Web Services (AWS). Photo: Reuters
Iran retaliates. On the second day of the war, Iranian drones struck three Amazon Web Services facilities in the Gulf, two directly hit in the UAE and a third damaged by a nearby blast in Bahrain, knocking out power, triggering fire suppression systems and taking significant portions of the region’s cloud infrastructure offline for days. Careem, Snowflake, Emirates NBD and several UAE payment firms reported outages. The Uptime Institute, an independent data center standards body, confirmed it as the first military strike on a major cloud provider.
Iran removed any ambiguity about intent. The IRGC stated the Bahrain facility had been deliberately struck because of its role in supporting the enemy’s military and intelligence activities. According to TechRadar, the Fars News Agency noted on Telegram that the U.S. military uses AWS infrastructure for intelligence functions, including AI tools.
Dubai International Financial Centre (DIFC), as banks step up precautions after Iran threatened Gulf banking interests linked to the U.S. and Israel. Photo: Reuters
Iran’s Revolutionary Guard has publicly labeled leading US tech and banking companies operating in Israel and the Gulf as “legitimate targets,” publishing a new list of offices and infrastructure it says are now in its crosshairs.
The boundary between commercial cloud infrastructure and military operations has largely vanished. The Pentagon’s war-fighting networks run on the same commercial infrastructure that serves banks and ride-hailing apps, meaning attacks on data centers can have immediate military consequences. “If data centers become critical hubs for transiting military information, we can expect them to be increasingly targeted by both cyber and physical attacks,” Zachary Kallenborn, a PhD researcher at King’s College London, told Fortune. Data centers are now legitimate military targets. That is new.
Cyber war. Within hours of the strikes, Iranian-aligned groups established what they called an “Electronic Operations Room of Islamic Resistance Axis,” and within days some sixty hacktivist collectives were active under its umbrella, including pro-Russian groups. Whether the Russian groups are that effective is open to question, though.
For a fascinating real-time look at the cyber war, check out this live dashboard. Iran’s methods draw from a familiar menu: DDoS attacks, data theft, and website defacement.
The cyber campaign has not stayed purely digital. Handala Hack, a persona linked to Iran’s Ministry of Intelligence, sent death threats to Iranian-American and Iranian-Canadian influencers, including a $250,000 bounty for a beheading, claiming to have passed their home addresses to physical operatives.
BeyondTrust, a cybersecurity firm that tracks state-linked threat actors, concluded that Iranian cyber units have likely been operating without central direction since the opening strikes, cut off from their own command infrastructure. The hacktivists operating under Tehran’s umbrella may no longer be taking orders from anyone, which on the one hand gives Tehran plausible deniability but also means it loses control of the targeting.
In the words of one former National Security Agency analyst, cyber retaliation from Iran is “in the hands of a 19-year-old hacker in a Telegram room.”
The other side has not been dormant: As the first strikes hit Tehran on the morning of Feb. 28, millions of Iranians received a strange push notification. The BadeSaba Calendar prayer app, which has more than five million downloads, had been compromised. It sent alerts reading “Help has arrived” and urged Iranians to mobilize in defense of their country. The following day it pushed surrender instructions to rank-and-file IRGC members, along with safe gathering points for protesters. The Wall Street Journal attributed the hack to Israel. The phrasing was not accidental. “Help has arrived” deliberately echoed U.S. president Donald Trump’s January Truth Social post to Iranian protesters: “Help is on its way.”
Enter AI. A more novel battlefield is the one running on generative AI. A photograph of smoke rising over a U.S. military base in Erbil in northern Iraq showed a massive fireball explosion. Satellite imagery depicted damage to a U.S. naval base in Qatar. Video showed the USS Abraham Lincoln being sunk. None of it was real.
Iran’s state-affiliated Tehran Times posted a video captioned “Doomsday in Tel Aviv,” showing a city reduced to rubble, lifted wholesale from an Arabic TikTok account that makes AI fantasy content for entertainment.
The volume is hard to overstate. BBC Verify’s Shayan Sardarizadeh, who has been live-posting debunks throughout the conflict, concluded by March 4 that the war had likely broken the record for the highest number of AI-generated videos and images to go viral during any conflict. “Welcome to our brave new world of AI misinformation,” he said.
Photo: Reuters
The AI disinformation war has found an unexpected accelerant in the Epstein files. Pro-Tehran accounts on X, part of a network of at least fifteen anonymous “news” handles identified by the Institute for Strategic Dialogue, have been drawing millions of views by fusing AI-generated content with the conspiracy theory that the strikes on Iran were ordered to distract from the Epstein files. The formula is cynically effective. As disinformation researcher Bret Schafer put it: “You come for the Epstein content, and you stay for the propaganda.”
Iranian state media has sought to portray American and Israeli leaders as part of a corrupt so-called “Epstein class,” and posts using that phrase increased a hundredfold on the first day of the strikes. The two principal accounts were suspended after press inquiries, but nine of the fifteen had held verified paid status on X, meaning the platform’s own algorithm was actively amplifying the propaganda.
Fake Mojtabas. Which brings us back to Mojtaba. His absence has produced its own information vacuum, and vacuums fill fast. AI-rendered images of Iran’s new supreme leader have appeared online in place of anything official, with no one claiming authorship.
Every day Tehran fails to produce a dated video of Mojtaba, the AI front broadens. Anti-Iran hackers have fabricated visuals purporting to show the dead bodies of leaders, creating the impression that key figures were killed in airstrikes.
ESSENTIAL READING
Old-school tricks and AI tech are weapons in the Iran war — NPR. Solid reported piece with new detail: Israel located Ali Khamenei by hacking Tehran traffic cameras.
Fake AI satellite imagery spurs US-Iran war disinformation — France24/AFP highlights fabricated satellite imagery, including one fake image Google’s own SynthID watermark exposed as AI-generated.
Disinformation in the Iran-Israel-US War: Major Cases and Patterns — Erkan’s Field Diary. A researcher’s running compilation, useful as a reference link. Includes detail about Grok giving contradictory verdicts on the same fake video — sometimes within minutes of each other.
Andres Ilves
Andres Ilves is Iran Editor and Senior Adviser at MBN. His career as a journalist and writer includes two decades at the BBC and Radio Free Europe.
