Iranian Revolution 2026: Complete Intelligence Briefing — Protests, War, Cyber Operations, and the Fall of Khamenei

From Economic Rage to Revolution: Largest Protests Since 1979

Origins — December 28, 2025

Protests now widely referred to as the Iranian Revolution of 2026 erupted on December 28, 2025, ignited by a combination of economic desperation, political repression, and years of accumulated grievances against the Islamic Republic. A sharp currency devaluation and fuel price hikes pushed millions of already-struggling Iranians past the breaking point.

Within days, scattered economic demonstrations in provincial cities transformed into the most sustained and geographically widespread anti-government movement in the history of the Islamic Republic. Protesters moved beyond economic demands to directly challenge the legitimacy of the theocratic system, with chants of “Death to Khamenei” and “Death to the Islamic Republic” echoing across the country.

Scale and Geography

At their peak, protests reached an unprecedented scale:

• 675+ locations across 210 cities in all 31 of Iran’s provinces
• Major cities including Tehran, Isfahan, Shiraz, Mashhad, Tabriz, and Ahvaz saw sustained mass demonstrations
• Analysts and media described the movement as the largest popular uprising since the 1979 Islamic Revolution
• Significant participation from all social strata — workers, students, bazaar merchants, and the urban middle class

Unlike previous protest waves (2009 Green Movement, 2017–2018 protests, 2019 fuel protests, 2022 Mahsa Amini protests), this uprising demonstrated a qualitative shift: protesters no longer sought reform within the system but openly demanded its overthrow.

Second Wave: Student-Led Resurgence — February 21, 2026

After an initial phase of intense regime crackdown in January — including deployment of live ammunition, mass arrests, and a nationwide internet blackout — a second wave of protests emerged on February 21, 2026, led primarily by university students. February’s resurgence defied the regime’s assumption that the movement had been crushed, demonstrating the depth of popular opposition.

February’s student-led uprising coincided with growing international attention, the deployment of a second US aircraft carrier (USS Gerald R. Ford) to the Middle East, and Trump’s February 13 statement that regime change would be “the best thing that could happen.” Internal resistance and external pressure converged into an unprecedented strategic situation for the Islamic Republic.

Internet Blackout as a Weapon of Suppression

On January 8, 2026, authorities imposed a near-total internet blackout across the country — a deliberate strategy to prevent protesters from organizing, documenting regime violence, and communicating with the outside world. Monitored by NetBlocks, the shutdown reduced connectivity to as low as 1–4% of normal levels and persisted for weeks.

Consequences of the blackout were devastating:

• Civilian coordination became nearly impossible, fragmenting the protest movement
• Documentation of killings and mass arrests was severely hindered
• International media lost direct access to ground-level reporting
• Economic damage compounded the crisis, crippling businesses and banking
• Authorities criminalized use of Starlink satellite internet terminals, treating satellite connectivity as a national security threat

Authorities’ imposed blackout would later be compounded by the February 28 Israeli cyberattack, which plunged the country into what the Jerusalem Post described as “darkness with the largest cyberattack in history.”

Regime Response: “Crush by Any Means Necessary”

Supreme Leader Ali Khamenei reportedly ordered security forces to “crush the protests by any means necessary,” giving the IRGC and Basij militia what sources described as a “blank check” to use lethal force against demonstrators. Methods included:

• Live ammunition fired directly into crowds of unarmed protesters
• Mass arrests — over 53,552 confirmed detained
• Foreign militia recruitment — Iraqi militias were transported on 60+ buses, paid approximately $600 each to suppress protesters, according to multiple reports
• Chemical weapons allegations — unverified but persistent reports of chemical agents deployed in certain protest zones
• Forced disappearances and secret executions carried out away from public view
• Families forced to pay for bullets — reports indicate families of killed protesters were charged between $480 and $1,720 per bullet used to kill their relatives, a practice also reported during the 2019 protests
• Death sentences issued for at least 14 protesters
• Body concealment — regime forces disposed of bodies to hide the true scale of killings

On February 11, 2026 — the anniversary of the 1979 Revolution — President Masoud Pezeshkian publicly apologized for security forces’ actions, a remarkable admission that underscored both the severity of the crackdown and political fractures within the regime itself.

US Buildup: “Help Is on the Way”

Washington responded to the protests with escalating rhetoric and military positioning:

• January 2026: Trump declared “help is on the way” to Iranian protesters
• January 24: He announced a “massive armada” heading to the Middle East as the death toll surpassed 5,000
• February 13: He stated regime change would be “the best thing that could happen”
• February 14: Reuters reported the US military was preparing for “potentially weeks-long Iran operations”
• February 24 (State of the Union): He acknowledged 32,000 deaths and laid out the case for possible military action, condemning “sinister nuclear ambitions” and alleging missiles capable of reaching North America
• February 2026: USS Gerald R. Ford deployed as a second carrier to the Middle East

An embattled regime, a mobilized population, and an increasingly forward-leaning US posture created the conditions that would lead to the military intervention of February 28.

Massacres: Casualty Data and Humanitarian Catastrophe

State violence during Iran’s 2025–2026 protests constitutes what analysts have described as one of the deadliest episodes of state violence in modern history. Karim Sadjadpour of The Atlantic used precisely those words. Multiple organizations have attempted to quantify the death toll, but the regime’s internet blackout, body concealment, and intimidation of families make a definitive count impossible.

Casualty Estimates: A Multi-Source Analysis

Protest-Related Deaths (December 2025 – February 2026)

Cyberwarzone assessment: Actual protest deaths almost certainly exceed HRANA’s confirmed 7,007, likely by a significant multiple. With 11,744 additional cases under HRANA review, combined with systematic body concealment and an internet blackout that prevented documentation, evidence points to a figure in the tens of thousands. Multiple independent estimates converging around 16,000–36,500 lend weight to the higher range.

HRANA Confirmed Breakdown

• 6,508 protesters killed
• 226 children and minors killed
• 214 government and security personnel killed
• 67 uninvolved civilians killed
• 11,744 additional deaths under review
• 53,552 confirmed arrested
• 330,000–360,000 injured (Sunday Times / Iran International estimates)

Patterns of Violence

Human rights organizations have characterized the regime’s systematic and escalating violence as potentially constituting crimes against humanity:

Targeted Killings

Security forces, including IRGC Ground Forces, Basij paramilitary units, and plainclothes agents, fired live ammunition directly into crowds. Snipers were deployed on rooftops in multiple cities. Videos smuggled out before the internet blackout showed security forces shooting at fleeing protesters in residential neighborhoods.

January 8–9 Massacres

Deadliest violence coincided with imposition of the internet blackout on January 8. Iran International documented more than 36,500 killed in the January 8–9 period alone, based on hospital source reporting. Timing was deliberate — the regime escalated lethal force precisely when the ability to document it was eliminated.

Foreign Militia Deployment

In an extraordinary measure underscoring regime desperation, Iraqi Shia militias were recruited and transported into Iran to supplement security forces. Reports indicate:

• 60+ buses used to transport foreign fighters into Iran
• Militia members paid approximately $600 each
• Fighters deployed to suppress protests in areas where local security forces were deemed unreliable or insufficient

Economic Exploitation of Families

In a practice documented during previous Iranian protest crackdowns but now operating at industrial scale, families of killed protesters were forced to pay for the bullets used to kill their relatives. Reported costs ranged from $480 to $1,720 per bullet. Families who refused or attempted public funerals faced arrest, further violence, or denial of death certificates.

Secret Executions and Death Sentences

At least 14 protesters received death sentences, with multiple executions carried out secretly in prisons away from public scrutiny. Reports indicate some executions were conducted without informing families or legal representatives.

Pezeshkian Apology — February 11, 2026

On the 47th anniversary of the 1979 Islamic Revolution, President Masoud Pezeshkian delivered an unprecedented public apology for security forces’ treatment of protesters. Analysts widely interpreted it as:

• An acknowledgment that the crackdown had exceeded what even regime insiders considered acceptable
• An attempt to create political distance between the civilian government and the IRGC
• A signal of deep fractures within the Iranian political establishment
• Too little, too late — protests had already resumed and international intervention was being prepared

Operation Epic Fury: US-Israeli Military Strikes on Iran

On February 28, 2026, the United States and Israel launched the largest coordinated military operation in the Middle East since the 2003 invasion of Iraq. Washington’s codename was Operation Epic Fury; Israel designated its component Operation Roaring Lion. Strikes killed Supreme Leader Ali Khamenei, decimated Iran’s military command structure, and fundamentally altered the geopolitical landscape of the region.

Decision to Strike

According to the New York Times (“How Trump Decided to Go to War,” March 3, 2026), the decision path was shaped by:

• Intelligence on Khamenei’s location: CIA helped pinpoint a gathering of senior Iranian officials, including Khamenei himself, providing a time-sensitive opportunity
• Saudi and Israeli lobbying: Both Riyadh and Jerusalem pushed Trump toward military action
• Failed nuclear talks: US-Iran negotiations in Oman (Feb 6) and Geneva (Feb 15–20) ended without agreement. Iran reportedly boasted of having enough enriched uranium for 11 nuclear weapons
• Alleged Iranian preemptive plans: A senior US official claimed Iran was planning to preemptively launch missiles — though the Pentagon later told Congress there was “no sign that Iran was going to attack US first”
• Tucker Carlson was the lone dissenter: The right-wing podcaster met with Trump three times in the preceding month, arguing against an attack and warning about risks to US personnel, energy prices, and regional partners

On February 27 at 3:38 PM EST (11:08 PM IRST), while traveling on Air Force One to Texas, Trump gave the order to proceed.

February 28: Opening Strikes

Airstrikes commenced at approximately 9:45 AM IRST (1:15 AM EST) on Saturday, February 28 — Saturday being the first day of the work week in Iran, which added to the element of surprise since Israel’s previous strikes on Iran had occurred at night.

Assets Deployed

• Israeli Air Force: ~200 fighter jets in the largest combat sortie in IAF history; 500 military targets struck in western and central Iran; 1,200+ bombs dropped in 24 hours
• US Navy: Tomahawk cruise missiles launched from warships
• US Army: HIMARS launchers deployed
• US Air Force: B-2 stealth bombers used against fortified ballistic missile facilities
• Low-cost drones: Task Force Scorpion Strike’s one-way attack drones employed for the first time in combat
• Israeli innovation: Black Sparrow air-launched ballistic missiles fired from F-15s — first operational use
• Undisclosed standoff weapons and long-range munitions

Priority Targets

• Khamenei’s compound on Pasteur Street, Tehran — also home to the presidential palace and National Security Council. At least seven confirmed missile impacts
• IRGC military bases across Iran — thousands of IRGC personnel killed or wounded, including several senior officials
• Air defenses and missile launchers across western and central Iran
• Nuclear facilities: Natanz Nuclear Facility sustained fresh damage (confirmed by IAEA satellite imagery on March 3), though IAEA said no radiological consequences were detected
• Iranian naval assets: US strikes destroyed Iran’s main naval assets, including at the key naval base on the Strait of Hormuz, which was set ablaze
• F-14 Tomcats and drone launchers at airbases across Iran
• IRIB headquarters: Islamic Republic of Iran Broadcasting hub in Evin, Tehran struck on March 2 — Israel had previously threatened it would “disappear”
• Supreme National Security Council HQ: Destroyed on March 3, along with the president’s office and command-and-control infrastructure

Killing of Ali Khamenei

Most consequential outcome of the opening strikes was the death of Supreme Leader Ali Khamenei. Financial Times reported details under the headline “Inside the Plan to Kill Ali Khamenei.” Key details:

• Israel announced Khamenei had been killed in the strikes on February 28
• Iranian government initially did not confirm or deny, before eventually acknowledging his death
• Khamenei’s wife was confirmed dead on March 2 from injuries sustained in the same strike
• Former President Mahmoud Ahmadinejad was also killed in a Tehran missile strike
• Iran’s Armed Forces Chief of Staff Major General Abdolrahim Mousavi was killed
• CBS reported that 40 Iranian officials were killed in the strikes
• Over 1,000 IRGC and Iranian security officials killed since the start of the war (Jerusalem Post, citing sources)

Coordinated Cyberattack

Simultaneously with kinetic strikes, Israel conducted what the Jerusalem Post called the largest cyberattack in history:

• Iranian infrastructure, media, and phone apps were targeted
• Popular BadeSaba Calendar prayer app (5M+ downloads) was compromised to broadcast push notifications in Persian urging military personnel to defect, with messages like “Help has arrived” and “It’s time for reckoning”
• Cyberattack resulted in a near-total internet blackout lasting 60+ hours, with connectivity dropping to 1–4% of normal levels
• Government communications, state media, and public services were all disrupted

Trump’s Statement: Regime Change

At 2:30 AM EST on February 28, Trump released an 8-minute video statement explicitly calling for regime change. He cited:

• 1979 Iran hostage crisis
• Iran’s support for Hamas and Hezbollah
• Killing of protesters
• Iran’s alleged pursuit of nuclear weapons
• A claim that Iran was developing missiles capable of reaching the United States — which CNN reported was “not backed up by US intelligence”

Netanyahu said the strikes would “create the conditions for the brave Iranian people to take their destiny into their own hands” and called on Iranians to “cast off the yoke of tyranny.”

Day-by-Day Military Timeline

February 28 (Day 1)

• 9:45 AM IRST — First wave of airstrikes hits Tehran, Isfahan, and western Iran
• Khamenei compound struck with at least seven missiles
• Israel announces Khamenei killed; 200 IAF jets airborne simultaneously
• Iran fires retaliatory ballistic missiles at Israel — sirens across the country
• Trump releases regime change video statement at 2:30 AM EST
• IRGC launches drones and missiles at Al Udeid (Qatar), Al Dhafra (UAE), and Fifth Fleet HQ (Bahrain)
• Israel conducts “largest cyberattack in history” — BadeSaba app compromised
• 700+ flights cancelled across region

March 1 (Day 2)

• Hezbollah declares war on Israel; rockets fired at northern Israel and Haifa
• Israel bombs Beirut and Beqaa Valley in response
• Iran targets Kuwait International Airport and Ali Al Salem Air Base
• Three US F-15s crash in Kuwait — attributed to Kuwaiti friendly fire by CENTCOM
• UAE intercepts 148 drones, 9 ballistic missiles, 6 cruise missiles
• Burj Al Arab damaged by missile fragments
• Shahed-136 drone reported near Burj Khalifa
• Check Point Research publishes five-cluster Iranian cyber threat report

March 2 (Day 3)

• IRGC announces Strait of Hormuz closed — “will set fire onto any ship”
• 150+ ships stalled; tankers attacked off Oman
• Khamenei’s wife confirmed dead
• IDF kills Hezbollah intelligence chief Hussein Makled
• RAF Akrotiri (Cyprus) targeted by suspected drone — air raid sirens activated
• UK NCSC issues Iranian cyberattack warning
• IAEA emergency Board of Governors meeting convened
• Iranian drones strike US embassy in Riyadh
• AWS confirms data center damage in UAE (ME-CENTRAL-1) and Bahrain (ME-SOUTH-1)
• Trump calls Kurdish leaders as part of Iran war effort (Axios)

March 3 (Day 4 — Ongoing)

• Israel bombs Assembly of Experts council (Axios) — body responsible for choosing next supreme leader
• Supreme National Security Council HQ destroyed
• IRIB headquarters struck
• Israel authorizes ground invasion of Lebanon to seize strategic positions
• Qatar reportedly strikes Iran in retaliation after shooting down two Iranian Su-24 jets
• Explosions in Larnaca, Cyprus near airport and Dhekelia base
• Iran’s Foreign Minister says military units “acting independently” — suggesting loss of central command
• Oil prices continue surging; LNG rates up 40%+
• IAEA confirms Natanz entrance buildings damaged — “no radiological consequence expected”

War Casualties by Country

Iranian Retaliation and Regional Escalation

Tehran’s response to Operation Epic Fury was rapid, multi-front, and far more aggressive than many analysts anticipated. Within hours of the initial strikes, IRGC launched retaliatory attacks across the Persian Gulf and the broader Middle East, drawing multiple countries into an expanding conflict.

Gulf State Targeting

IRGC forces targeted US military installations and strategic infrastructure across the Gulf, striking at the host nations that facilitated the US presence:

Bahrain

• US Fifth Fleet headquarters in Manama targeted by IRGC missiles — smoke visible rising from the base
• Residential tower in Manama hit by Iranian drone during evening strikes
• 2 killed, 6 injured. Hotel strike injured 2 US Defense Department employees

Qatar

• Al Udeid Air Base — largest US military facility in the Middle East — targeted
• Iranian drones struck Qatar’s LNG facilities, halting production — triggering a 40%+ surge in global LNG shipping rates
• Blasts recorded in Doha at 1:40 AM local time on March 3, continuing for hours
• Iran attempted to directly strike Hamad International Airport — Qatar thwarted the attack
• Qatar shot down two Iranian Su-24 jets and reportedly conducted retaliatory strikes on Iran (March 3)

United Arab Emirates

• Al Dhafra Air Base targeted
• “New wave” of missiles intercepted — fragments fell in Abu Dhabi and Dubai, damaging Burj Al Arab
• Shahed-136 drone strike reported near Burj Khalifa — smoke plumes captured on video
• Drone targeted UAE oil facility (March 3)
• UAE intercepted 148 Iranian drones, 9 ballistic missiles, 6 cruise missiles
• 3 killed, 68 injured (including 3 Indians killed off Oman coast)
• AWS data centers damaged — two facilities directly struck by drones, one in Bahrain hit by proximity strike (see Hormuz/Economy section)

Kuwait

• Ali Al Salem Air Base targeted (also hosting Italian soldiers)
• Kuwait International Airport hit, causing injuries and damage
• Three US F-15s crashed in Kuwait — initially claimed by Iran as shoot-downs, later attributed to Kuwaiti friendly fire by CENTCOM
• Oil refinery hit by shrapnel. US embassy closed indefinitely
• 1 killed, 32 injured

Saudi Arabia

• Explosions and smoke observed in Riyadh
• US embassy in Riyadh struck by two Iranian drones — fire started
• Saudi Aramco refinery hit by apparent drone strike — small fire extinguished
• Crown Prince Salman vowed to employ military force against further Iranian incursions

Oman

• Drone strike on Duqm port — 1 injured
• Vessel struck by unknown projectile northwest of Mina Saqr
• 3 Indians killed in Iranian attacks off Oman coast

Hezbollah Front — Lebanon

On March 1, Hezbollah officially declared war on Israel, opening a significant second front:

• Rockets launched into northern Israel — first Hezbollah fire in months
• Hezbollah fired missiles at Haifa and other northern Israeli targets
• Israel responded with strategic bombings on Beirut and the Beqaa Valley
• IDF killed Hezbollah intelligence chief Hussein Makled on March 2
• IDF killed head of Palestinian Islamic Jihad in Lebanon during strikes
• On March 3, Israel’s Defense Minister authorized ground invasion of Lebanon to seize strategic positions
• 52 killed, 153 injured in Lebanon as of March 3
• Lebanon’s leaders turned on Hezbollah as airstrikes hit Beirut

Strikes on Israel

• Iran launched ballistic missiles at Israel — sirens blared across the country
• Iranian missiles struck Beersheba (19 injured), central Israel (7 injured), and Tel Aviv (1 injured by shrapnel)
• 12 killed, 777 hospitalized since the start of the war
• Israel closed airspace and declared a state of emergency
• Hospitals moved underground to highest readiness level

Iraq — Militia Front

• Islamic Resistance in Iraq (Iranian-aligned militia coalition) claimed 23+ drone attacks on US assets in Erbil
• Iranian-backed Iraqi militia: 4 fighters killed in US-Israeli airstrike in Jurf al-Sakhar, south of Baghdad
• Protests erupted across Iraq against US strikes
• US-Jordanian embassy evacuated “due to a threat.” US embassy in Kuwait closed indefinitely
• Trump called Kurdish leaders as part of the Iran war effort (Axios, March 2)

Cyprus Under Fire

• RAF Akrotiri (British military base) in Cyprus targeted by suspected drone strike on March 2 — air raid sirens activated
• Explosions heard in Larnaca near the airport and British base in Dhekelia on March 3
• IRGC General Sardar Jabbari threatened to strike Cyprus “with such intensity that the Americans will be forced to leave”
• Greece announced deployment of frigates and F-16s to defend Cyprus
• Iran fired missiles at Cyprus — intercepted without damage

US and Allied Casualties

• 6 US service members killed in action (CENTCOM confirmed)
• 18 US personnel injured
• IRGC claimed 650 US troops killed or wounded — widely dismissed as propaganda
• Iranian drone strike on US embassy hit Riyadh compound
• US urging all Americans to immediately leave the Middle East — securing military and charter flights

Hormuz Crisis and Global Economic Fallout

February 2026’s military operations triggered the most severe disruption to global energy markets since the 1973 oil embargo. Closure of the Strait of Hormuz — through which approximately one-fifth of the world’s oil consumption passes daily — combined with missile and drone attacks on Gulf energy infrastructure, has sent shockwaves through global financial markets.

Closure of the Waterway

On March 2, 2026, a senior IRGC commander announced the Strait of Hormuz was closed to shipping, declaring that forces would “set fire onto any ship coming through” and that “no oil will leave the area.” An Operation Aspides (EU naval) official confirmed that vessels were receiving VHF radio messages stating that “no passage will be allowed.”

Immediate consequences of the closure:

• 150+ freight ships, including many oil tankers, stalled behind the strait
• Two oil tankers (Palau-flagged Skylight and Marshall Islands-flagged MKD VYOM) targeted off the coast of Oman
• US-flagged tanker Stena Imperative hit by projectiles off Bahrain — fire extinguished
• IRGC claimed drone strike on Honduras-flagged tanker Athe Nova in the strait
• A seafarer killed by a drone attack on a vessel in the strait
• Japan and South Korea suspended shipping operations through Hormuz

Energy Market Impact

Oil Prices

• Brent crude futures up nearly 10% in the week of the conflict
• Supertanker rates from the Middle East to China hit all-time highs: VLCC benchmark (TD3) rose to W419 on the Worldscale measure — $423,736 per day, doubling from pre-strike levels
• Saudi Aramco began diverting oil shipments from Hormuz to Red Sea ports
• Tehran had rushed to ship oil ahead of the anticipated US strike in late February

LNG (Liquefied Natural Gas)

• LNG shipping rates jumped 40%+ after Qatar halted production following drone strikes on LNG facilities
• Atlantic rates rose to $61,500 per day (up 43%); Pacific rates to $41,000 per day (up 45%)
• Analysts at Wood Mackenzie projected spot rates could exceed $100,000 per day
• Bunker sales at Fujairah (major UAE bunkering port) slowed, shifting demand to Singapore

Broader Economic Impact

• 700+ flights cancelled across the region
• Millions in cryptocurrency left exchanges post-strikes
• US Treasury engineered a dollar shortage, further crippling the economy
• IMF issued warning on economic impact of the conflict
• UK budget outlook thrown into doubt — British finance minister’s forecasts described as “in tatters”
• Global stock markets slid; oil shares surged
• South Korea’s maritime ministry told all Korean shippers to refrain from Middle East operations
• Hyundai Glovis preparing contingency plans including alternative routes and ports

AWS Data Center Strikes

In what may be the first time cloud computing infrastructure has been physically damaged in a military conflict, Amazon Web Services confirmed that three data centers in the UAE and one in Bahrain were damaged by drone strikes:

AWS Impact Summary (as of March 3):

• ME-CENTRAL-1 (UAE): Two facilities directly struck — availability zones mec1-az2 and mec1-az3 “significantly impaired”
• ME-SOUTH-1 (Bahrain): Proximity drone strike caused physical damage — availability zone mes1-az2 affected by “localized power issue”
• Structural damage, disrupted power delivery, fire suppression activities causing additional water damage
• Amazon advised customers to migrate workloads to unaffected regions (US, Europe, Asia Pacific)
• Amazon prioritizing restoring services and tools for data backup and migration

These strikes underscore a new dimension of modern conflict: attacks on cloud computing infrastructure can have cascading effects on businesses and services far removed from the physical conflict zone. Organizations with ME-CENTRAL-1 or ME-SOUTH-1 deployments should immediately execute disaster recovery plans.

Dubai’s Safe Haven Status Shattered

Missile fragments falling in Dubai and Abu Dhabi, including damage to Burj Al Arab and a Shahed-136 drone strike near Burj Khalifa, have shattered Dubai’s carefully cultivated image as a safe, stable, tax-free haven. News Minute reported: “Dubai’s image as a safe, tax-free haven is rocked by blasts from Iranian airstrikes.”

Economic fallout for the UAE extends beyond physical damage — perception of vulnerability could have lasting effects on foreign investment, tourism, and the emirate’s role as a regional business hub.

Russian-Flagged Tanker Fire

Highlighting the conflict’s global ripple effects, a Russian-flagged sanctioned LNG tanker caught fire in the Mediterranean on March 3, with the crew’s fate unknown. While not directly attributed to the conflict, it underscores heightened risks across maritime energy transport.

Cyber Operations: Five Threat Clusters and the Digital Battlefield

Beyond kinetic warfare, the 2026 crisis has a critical cyber dimension. State-sponsored cyber groups remain operationally active despite the domestic internet blackout, and the conflict has produced what Israel describes as the largest cyberattack in history. Meanwhile, the UK’s National Cyber Security Centre (NCSC) warned organizations globally of heightened attack risk.

Five Active State-Sponsored Cyber Clusters

As of March 2026, Check Point Research identifies five distinct state-sponsored cyber clusters actively operating in the context of the current conflict. Each is affiliated with either the Islamic Revolutionary Guard Corps (IRGC) or the Ministry of Intelligence and Security (MOIS):

Notable Cyber Developments

Israel’s “Largest Cyberattack in History” — February 28

Coordinated with kinetic strikes, Israel launched a massive cyberattack against infrastructure across the country:

• Government communications, state media, and public services disrupted
• BadeSaba Calendar prayer app (5M+ downloads) compromised to broadcast push notifications in Persian urging military defections
• Messages included: “Help has arrived” and “It’s time for reckoning”
• Near-total internet blackout for 60+ hours, dropping to 1–4% connectivity
• Attack built on the existing protest-related internet shutdown, creating a compounded digital isolation

UK NCSC Warning — March 2, 2026

Britain’s National Cyber Security Centre issued a warning to UK organizations about heightened cyberattack risk in the context of the Middle East conflict. Advisory recommendations:

• State-sponsored groups likely retain operational capability despite domestic internet disruption
• Organizations should review their external attack surface
• Increase monitoring for anomalous activity
• Ensure incident response plans are current and tested
• Alert for reconnaissance, phishing, and initial access attempts

Handala Using Starlink Infrastructure

Check Point Research observed that Void Manticore’s “Handala” hacktivist persona has been operating from Starlink IP addresses — a significant finding given that Starlink use was criminalized domestically. Implications include:

• Using smuggled Starlink terminals despite the government ban
• Maintaining independent infrastructure access while civilian internet remains shut down
• Potentially operating from locations outside the country that have Starlink access

Compounded Internet Blackout

Two distinct disruption phases hit the country’s internet:

• Phase 1 — January 8 (Regime-imposed): Near-total blackout to suppress protests — connectivity dropped to 1–4%, maintained for weeks
• Phase 2 — February 28 (Israeli cyberattack): Remaining infrastructure taken offline by coordinated attack — 60+ hour outage, government communications severed

Combined effect: over seven weeks of near-total digital isolation — one of the longest and most severe internet shutdowns ever recorded.

Information Operations

Cotton Sandstorm operates sophisticated influence campaigns through:

• Fake news outlets: Fabricated media organizations posting pro-regime content designed to appear as independent journalism
• Social media personas: Sock puppet accounts amplifying regime narratives and sowing confusion
• Altoufan Team: Hacktivist front conducting disruptive operations under the guise of grassroots activism
• Target audiences: US and European media consumers, policy researchers, and diaspora communities

MITRE ATT&CK Mapping

Observed techniques across the five clusters during this conflict:

Opposition Movement: Reza Pahlavi and the Democratic Movement

Protests and subsequent military intervention have thrust the opposition — and in particular Reza Pahlavi, the eldest son of the last Shah — into unprecedented prominence on the world stage. Pahlavi has emerged as the most visible face of the pro-democracy movement, though his role and the broader opposition landscape remain complex and contested.

Reza Pahlavi: Profile

Born in 1960 as Crown Prince, Reza Pahlavi has lived in exile since his family left the country before the 1979 Islamic Revolution. He has spent decades advocating for a democratic, secular system, and has explicitly stated he does not seek to restore the monarchy but rather to guide a democratic transition.

During the current crisis, Pahlavi has become the most prominent opposition figure:

• His name has been chanted at demonstrations across the country
• He called for protests and city occupations during the uprising’s peak
• At Trump’s direction, US envoy Steve Witkoff met with Pahlavi — a significant diplomatic signal
• He declared February 14 as a “Global Day of Action”, drawing over 1 million people to rallies worldwide (Los Angeles and Toronto each drew 350,000+)

Post-Khamenei Positioning

After confirmation of Khamenei’s death on February 28, Pahlavi moved quickly:

• Appeared on CBS 60 Minutes — stated that Iranians should “prepare to take the streets”
• Called the strikes a “humanitarian intervention”
• Released the Iran Prosperity Project emergency booklet — a practical guide for post-regime transition, including guidance on governance, institutional continuity, and civil order
• Emphasized his vision: “I don’t seek to restore monarchy but to guide a democratic transition”

Celebrations After Strikes

Contrary to some expectations, US-Israeli strikes were widely celebrated by protesters and the diaspora:

• Crowds at The Hague celebrated the strikes — Iran International coverage
• Rallies calling for regime change held around the world on February 28 (CBC News)
• Los Angeles, Toronto, London, Berlin, Sydney, and other cities saw large pro-strike demonstrations
• NPR reported that “some Iranians reacted to attacks on their country” with relief and celebration, viewing the strikes as targeting the regime — not the people
• Pahlavi urged citizens to “return to the streets” in the wake of Khamenei’s death

Broader Opposition Landscape

Opposition forces are not monolithic. Dynamics include:

Internal Tensions

• Nobel laureate Narges Mohammadi — imprisoned human rights activist — called Pahlavi’s supporters “the opposition against the opposition,” reflecting tensions between monarchist-leaning diaspora groups and republican, left-leaning, or ethnic-minority opposition factions
• Some opposition figures question whether Pahlavi’s prominence is organic or amplified by US strategic interests
• Others argue that unity behind any credible figure is more important than ideological purity during a moment of potential regime collapse

Diaspora Mobilization

• Diaspora communities have demonstrated unprecedented organizational capacity
• February 14 Global Day of Action drew 1 million+ to the streets worldwide
• Communities have channeled financial support, media attention, and political lobbying
• Starlink terminals have been smuggled into the country despite criminalization

Transition Question

With Khamenei dead and the military command structure decimated, the question of political transition is no longer theoretical:

• Israel reportedly bombed the Assembly of Experts council choosing the next supreme leader (Axios, March 3)
• Foreign Minister said military units were “acting independently” — suggesting loss of central command
• Trump stated the strikes’ purpose was “effectively regime change”
• Netanyahu said the joint action would “create the conditions for the brave Iranian people to take their destiny into their own hands”
• No clear succession path exists with the supreme leadership, military command, and intelligence apparatus all severely degraded

World Reaction and Diplomatic Developments

The 2026 conflict has produced a sharply divided global response. Western nations have broadly supported or accepted the US-Israeli strikes, while much of the Global South, Russia, and China have condemned them. Aftermath has accelerated several significant diplomatic and legal developments.

Supporting / Accepting Nations

United States

• Trump explicitly stated the purpose of strikes was regime change
• Pentagon briefed Congress — but admitted there was “no sign that Iran was going to attack US first” (contradicting the White House’s stated justification)
• “Gang of Eight” congressional leadership briefed before strikes
• NATO stepped up Iran surveillance ahead of the strikes (Bloomberg, Feb 24)
• US securing military and charter flights for American citizens to leave the Middle East

Israel

• Netanyahu: strikes to “remove the existential threat” posed by Iran
• Called up 70,000 reservists (50,000 existing + 20,000 additional)
• Declared state of emergency, moved hospitals underground
• Authorized ground invasion of Lebanon (March 3)

United Kingdom

• PM Keir Starmer: US can use British bases for “defensive” strikes on Iran
• UK disclosed that Ukrainian and other specialists would aid Gulf efforts to intercept Iranian drones
• NCSC issued Iranian cyberattack warning to British organizations
• Britain deploying destroyer and helicopters with counter-drone tech to Cyprus
• UK expected to follow EU in designating IRGC as terrorist organization

European Union

• EU designated the IRGC as a terrorist organization — a major shift from years of reluctance
• Ukraine also designated the IRGC as a terrorist organization
• E3 (UK, France, Germany) resolved to back “proportionate military defensive measures” against Iranian missiles and drones
• Albania’s PM Rama called for IRGC terrorist designation

Gulf States

• Saudi Crown Prince Salman vowed military force against further Iranian incursions
• Qatar thwarted airport attack, reportedly struck Iran in retaliation (contested)
• UAE intercepted 148 drones, 9 ballistic missiles, 6 cruise missiles
• Gulf states’ support for US-Israel campaign hardened after Iranian retaliatory strikes hit their territory

Other Supporters

• Greece deployed frigates and F-16s to defend Cyprus
• Argentina’s President Milei praised the US-Israeli operation
• Papua New Guinea sought help for citizens in Middle East, supported US-Israel strikes

Condemning Nations

China

• Demanded attacks on Iran stop immediately
• Called on both sides to exercise restraint

Russia

• Condemned the strikes
• Reuters reported that “Trump’s Iran attack rattles Russian hardliners who call for Putin to double down on war in Ukraine”
• Analysts noted Russia was watching whether the US could sustain two simultaneous confrontations

Regional Condemnations

• Venezuela and Cuba condemned the military offensive
• Syria condemned Iranian strikes on Arab countries (notably distancing from Iran)
• Taliban warned of “long-term consequences” from the strikes
• Armenia condemned the strikes; Azerbaijan called for dialogue
• Brazil issued a formal protest
• Pakistan: police fired tear gas at protesters outside US consulate; 23 killed in protest-related violence

Vatican

Pope Leo XIV used his Angelus address to appeal for peace, stating that “peace is not built with mutual threats or death-dealing arms.”

Legal Dimensions Under Scrutiny

• Iran appealed to the UN Security Council, alleging war crimes
• US and Israel defended strikes at the UN
• IAEA held emergency Board of Governors meeting on March 2
• IAEA confirmed Natanz entrance buildings damaged but “no radiological consequence expected”
• Legality of the strikes under international law remains fiercely contested — Pentagon’s own admission that there was “no sign” of an imminent Iranian attack undercuts the preemptive self-defense argument

Global Protests and Celebrations

Strikes produced a globally polarized reaction:

• Pro-strike rallies: Iranian diaspora communities worldwide celebrated, viewing the strikes as targeting the regime. Cities included The Hague, LA (350K), Toronto (350K), London, Berlin
• Anti-strike protests: Pakistan (23 killed), parts of Iraq, Lebanon, and across the Muslim world
• Sleeper cell fears: Heightened security alerts in the US and Canada following an Austin shooting and a Canada gym attack (Iran International)
• Turkey denied claims that its territory or airspace was used for the strikes

Defensive Guidance for Organizations

The 2026 conflict has materially elevated the cyber threat to organizations worldwide, particularly those in critical infrastructure, energy, finance, government, and technology sectors. Guidance below synthesizes recommendations from the UK NCSC, US DHS/CISA, and Cyberwarzone’s own threat analysis.

Immediate Actions

1. Review Your External Attack Surface

• Audit all internet-facing assets, particularly web servers, VPNs, and remote access portals
• Agrius and MuddyWater specifically target internet-facing applications for initial access
• Patch known exploited vulnerabilities immediately — prioritize CISA KEV catalog items
• Disable unnecessary external services

2. Increase Monitoring

• Heighten alerting thresholds for anomalous authentication patterns
• Monitor for use of remote management tools commonly abused by MuddyWater (AnyDesk, Atera, ScreenConnect)
• Review logs for connections from Starlink IP ranges if not expected in your environment (Handala observed using Starlink infrastructure)
• Watch for signs of credential harvesting campaigns (Educated Manticore / APT35/42 specialty)

3. Prepare for Destructive Attacks

• Void Manticore/Handala and Agrius deploy wiper malware — data destruction, not data theft
• Verify backup integrity — ensure backups are offline, offsite, and tested
• Test restore procedures now, before an incident
• Segment networks to limit lateral movement

4. Cloud and Infrastructure Resilience

• If you have workloads in AWS ME-CENTRAL-1 (UAE) or ME-SOUTH-1 (Bahrain), execute disaster recovery plans immediately
• Migrate critical data and applications to unaffected regions (US, Europe, Asia Pacific)
• Review multi-region redundancy for all cloud deployments
• AWS data center strikes demonstrate that physical attacks on cloud infrastructure are now a real-world threat vector

5. Phishing and Social Engineering Defense

• Educated Manticore (APT35/APT42) excels at impersonation of journalists, think-tank researchers, and government officials
• Brief high-profile staff on current social engineering tradecraft from state-sponsored actors
• Enforce multi-factor authentication on all accounts — especially email and VPN
• Monitor for domain spoofing and lookalike domains targeting your organization

6. Information Operation Awareness

• Cotton Sandstorm operates fake news outlets and social media personas
• Be cautious of “independent analysts” or “human rights monitors” that suddenly appear in your threat intelligence feeds
• Verify provenance of all threat intelligence before acting on it
• Watch for attempts to manipulate internal communications or public narratives about your organization

Indicators to Watch

• Unexpected connections to Iranian IP space (AS12880, AS44244, AS58224)
• WezRat C2 infrastructure indicators (consult Check Point’s IOC feed)
• WhiteLock ransomware artifacts
• Starlink IP ranges in network logs where not expected
• Anomalous use of remote management tools (AnyDesk, Atera, ScreenConnect, SimpleHelp)
• Credential-phishing emails spoofing journalists, academics, or think-tank personnel
• Wiper-like behavior: mass file deletion, MBR/VBR corruption, partition table destruction
• DNS queries to recently registered domains mimicking news outlets or human rights organizations

Sector-Specific Guidance

Sources and Attribution

Our editorial team draws on primary reporting and analysis from multiple authoritative sources in compiling this intelligence briefing. We independently aggregate, cross-reference, and contextualize information. We do not reproduce copyrighted text — all analysis and commentary is original.

Primary Sources

Open-Source Intelligence and Monitoring

• HRANA (Human Rights Activists News Agency) — Casualty tracking and arrest documentation
• NetBlocks — Internet connectivity monitoring in Iran
• IAEA (International Atomic Energy Agency) — Nuclear facility damage assessments
• U.S. Central Command (CENTCOM) — Military operations and casualty confirmations

Wire Services and Major Outlets

• Reuters — Strait of Hormuz reporting, shipping costs, military developments, diplomatic coverage
• Associated Press (AP) — Regional attacks reporting, Gulf state response
• AFP — International diplomatic reaction

Specialist News Outlets

• Iran International — Independent verified casualty counts, IRGC operations, diaspora coverage
• New York Times — “How Trump Decided to Go to War”; military operational details; diplomatic reporting
• Wall Street Journal — Intelligence on strike timing and Khamenei targeting; BadeSaba app compromise
• Financial Times — “Inside the Plan to Kill Ali Khamenei”; LNG shipping; nuclear ambitions
• Guardian — Live coverage of military operations; Cyprus strikes; economic impact
• BBC News / BBC Verify — Hospital strikes verification; world reaction; internet blackout
• CNN — Military operations; Trump intelligence claims analysis; casualty reporting
• Al Jazeera English — Live blogs covering all days of the conflict; school airstrike coverage

Cybersecurity Sources

• Check Point Research — Five Iranian cyber cluster analysis (March 1, 2026); Agrius identification; Handala/Starlink observation
• BleepingComputer — UK NCSC warning; AWS data center damage reporting
• UK NCSC — Iranian cyberattack risk advisory (March 2, 2026)
• US DHS / CISA — Prior Iran cyber threat advisories (June 2025, October 2025)
• AWS Health Dashboard — ME-CENTRAL-1 and ME-SOUTH-1 incident updates
• 404 Media / The Register — AWS data center fire and damage reporting

Geopolitical and Analytical Sources

• Atlantic — Karim Sadjadpour analysis on Khamenei death; Trump-Iran diplomacy
• Axios — Trump calls Kurdish leaders; Israel bombs succession council
• Council on Foreign Relations (CFR) — Iran conflict tracker
• Wikipedia — 2025–2026 Iranian protests; 2026 Iran conflict; 2026 Iran massacres compiled articles (used for cross-referencing, not as primary source)

Assessment Methodology

The following confidence framework applies to claims in this article:

• Confirmed: Verified by multiple independent sources or official government/military statements
• Assessed: Supported by credible reporting from 2+ independent outlets but not officially confirmed
• Reported: Single-source claims from credible outlets, pending independent verification
• Unverified: Claims that cannot be independently confirmed but are notable enough to report with appropriate caveats

Casualty figures represent the most complex challenge. We present multiple source estimates with full attribution, acknowledging that the true toll — particularly from the protest crackdown — will likely not be known for months or years. Official government figures are considered unreliable floor estimates.

Continuous Updates

We maintain this briefing as a living resource. Last updated: March 3, 2026. As the conflict is ongoing, figures, developments, and assessments may change rapidly. Readers should check back for updates.

Cyberwarzone is an independent cybersecurity intelligence and news publication. For threat briefings, breaking cyber news, and in-depth analysis, visit cyberwarzone.com.
For tips or corrections regarding this article, contact our editorial team.