Iran War Post-MoU: From Cyfluence Operations to STRATCOM Efforts

Key Takeaways

• A new report by cyber-influence threat intelligence firm Intercept9500 examines how cyber, influence, economic, and kinetic actions operated as interconnected components of the Iran War.
  

• The report also highlights practical lessons for counter-Cyfluence and Influence Defense, including the need for rapid pre-bunking and response to narrative attacks, as well as the pre-conflict development of defensive capabilities and procedures to protect civilian infrastructure from both kinetic and hybrid threats.
  

• The recently-signed U.S.–Iran Memorandum of Understanding has led to a reduction in cyfluence attacks. At the same time, renewed kinetic attacks against civilian shipping and military assets have tested the agreement’s longevity.
  

• A CRC narrative intelligence analysis mapped key Iranian strategic communication assets on X/Twitter, primarily senior officials and state media channels, alongside their recent activity patterns, reach, and dominant narratives.
  

• Iran’s post-MoU messaging and overt influence activity continue to offer a valuable case study in how influence efforts persist, shift, and adapt across the conflict’s most recent stages. 

Recap

Since the outbreak of the Iran War in February 2026, the conflict has extended far beyond conventional military exchanges. It has included cyberattacks (such as hack-and-leak operations, infrastructure disruption, broadcast interruption, and message application hijacking), extensive internet restrictions, the proliferation of synthetic propaganda and coordinated information disorder, and STRATCOM messaging.

CRC threat researchers have previously examined this convergence of military disciplines and offensive vectors in a recent report titled The Deployment of Hybrid Threats and Cyfluence Operations in the Iran War. In the report, we documented how cyber, cognitive, and physical actions were combined to impact military institutions, national infrastructure, political leadership, and public perceptions.

The Islamabad MoU

On June 17-18, the United States and the Islamic Republic of Iran officially signed the Islamabad Memorandum of Understanding (MoU), agreeing on a 60-day framework intended to cement the ceasefire, reopen the doubly blockaded Strait of Hormuz, and enable negotiations on sanctions, Iran’s nuclear program, and wider regional security settlements.[1]

This MoU entered into effect despite important (and high-profile) disagreements between U.S. and Iranian interpretations of its provisions, resulting in some critics even describing it as “dead on arrival”.

Perhaps unsurprisingly, the MoU did not put an everlasting end to the conflict. It did, however, temporarily move the conflict from a high-intensity open warfare toward arduous negotiations, confrontational statements, and a continued contestation of the information domain. For now, the apparent result is a confusing dynamic featuring constant crisis management, posturing and re-posturing.

Developments Since the MoU

As of mid-July, Iranian attacks on commercial shipping in the Strait of Hormuz have renewed, prompting retaliatory U.S. military action against Iranian targets. Subsequently, Iran launched missile and drone strikes against American military assets and allies in the region. Iran continues to frame its control of the strait as a source of strategic leverage, while claiming sovereignty over the important maritime routes.[2]

On July 8, President Trump declared the ceasefire effectively over, although diplomatic contacts continued. By July 12, the conflict had returned to direct widescale military exchanges, with the Strait of Hormuz again emerging as both a military chokepoint and an instrument of economic coercion. On July 13, President Trump, together with key American administration officials and the U.S. Central Command, declared the reinstatement of the naval blockade against Iran.

Figure 1 - Posts published by official U.S. accounts on X. Left: A @WhiteHouse post, reposted by @POTUS, quoting President Trump’s declaration that “the ceasefire is over”; Right: @CENTCOM’s July 12 announcement of a “third round of strikes” against Iran following the IRGC’s targeting of a container ship in the Strait of Hormuz. (Courtesy of X)

Figure 2 - Posts published by official U.S. accounts on X: a statement by President Trump, reposted by @WhiteHouse, and a U.S. Central Command announcement confirming the resumption of the naval blockade against Iran. (Courtesy of X)

Regarding offensive cyfluence actions, public reporting since June 18 does not yet provide evidence of new operations. However, the current lack of positive evidence does not mean that cyber-influence efforts have ceased.

Iranian efforts targeting the information environment are persistent. Iranian officials, state media, aligned commentators, and associated proxies have continued competing to define the narrative following the signing of the MoU agreement (i.e. a humiliating and expected U.S. surrender), as well as the reasoning for the current re-escalation, and the legitimacy of Iran’s military actions against affected Arab nations.

Iranian Narrative Adaptation After the MoU

The signing of the MoU required Iranian messaging to balance several potentially conflicting objectives: presenting the agreement as an Iranian achievement, denying that Tehran had capitulated, maintaining deterrence, preserving the legitimacy of the “Resistance Axis” (including Hezbollah in Lebanon and the Houthis in Yemen), and preparing domestic and foreign audiences for renewed confrontation.

Initial Iranian statements emphasized conditional compliance. Tehran thus presented the agreement as a mechanism for acknowledging Iranian sovereignty and securing U.S. and Israeli concessions while retaining the right to respond to any violations. On the other hand, Iran’s supreme leader made his reservations about the agreement known, approving it due to Iranian national interests and the preservation of the wider resistance project.

Later on, as tensions mounted, Iranian messaging shifted toward blaming the U.S. for the agreement’s imminent failure. This narrative essentially bridged the two alternating and competing positions of diplomatic engagement and military escalation. And by doing so, Iran portrayed itself as having accepted negotiations while framing renewed hostilities as a legitimate response to the American administration’s insincerity and aggression.

Following Ayatollah Ali Khamenei’s funeral ceremonies, online discourse and media coverage saw a sharp increase in attention to Iranian threats against American and other Western leaders. Iranian revenge rhetoric, accompanied by imagery targeting President Donald Trump and other key political figures generated major traction on social media. A reported Israeli intelligence warning of a possible Iranian assassination plot against President Trump added to the perceived threat narrative. Trump himself responded by publicly warning that any successful attack would trigger overwhelming U.S. retaliation.

Figure 3 - Coverage by CNN and Fox News on X regarding recent Iranian death threats against U.S. and Israeli leaders, and an Israeli intelligence warning of an alleged Iranian assassination plot. (Courtesy of X)

Media coverage of the Iranian state-sanctioned threats and alleged intelligence disclosures, together with official statements, were joined by online influencers amplifying escalatory or conspiratorial narratives. Almost instantaneously, Iranian promises of revenge by means of assassination became a prominent theme of online discourse.

Figure 4 - Posts by influencer Laura Loomer addressing Iranian assassination threats, questioning President Trump’s claim of successful regime change, and suggesting a possible connection to Senator Lindsey Graham’s sudden death. (Courtesy of X)

Narrative Intelligence Analysis

A CRC analysis of the most influential Iranian officials and state media accounts on X/Twitter (between dates June 10 – July 12, 2026) maps the extent of Iran’s overt messaging and narrative control efforts, by tracking its leading strategic communication assets, during this timeframe.

Figure 5 - Activity graph showing top 10 Iranian officials and state media accounts on X/Twitter (timeframe: June 10 to July 12, 2026).

Figure 6 - Graph showing impressions per day for the top 10 Iranian officials and state media accounts on X/Twitter (timeframe: June 10 to July 12, 2026).

The two graphs above depict posting activity and impressions metrics for leading Iranian strategic communication assets on X/twitter. The selected time window allows us to assess STRATCOM efforts velocity and impact, before and after the signing of the MoU agreement.

The table below shows an aggregated summary of reach and engagement metrics for the top 10 Iranian officials or state media accounts considered as STRATCOM assets (as of July 12, 2026).

Figure 7 – A summary of the top 10 leading Iranian STRATCOM assets active on X/Twitter, including aggregated impressions metrics (timeframe June 10 to July 12, 2026).

According to our analysis of Iranian communications throughout recent weeks, two amplification models appear to operate in parallel. State media outlets drove volume, publishing hundreds of posts with relatively low average reach. On the other hand, Iranian senior officials posted far less but attracted far more attention. Foreign Minister Araghchi’s 18 posts generated over 18 million impressions, exceeding the reach of IRNA or Press TV despite their much higher output. State media therefore sustained distribution, while viral reach came from a small number of high-profile officials.

Dominant Narratives

Using automated classification of content published by the most prominent Iranian X accounts since the signing of the MoU, CRC analysts identified three dominant narratives:

The first - centered on the death of former Supreme Leader Ayatollah Khamenei, portraying it as martyrdom and honorable sacrifice while reinforcing the legitimacy of his son and successor, Mojtaba Khamenei. 

The second - accused the United States of repeatedly violating the MoU and emphasized Iran’s claimed exclusive sovereignty over the Strait of Hormuz. 

The third - focused on deterrence, retaliation, and revenge, combining official threats with visual depictions of “the Iranian public” demanding retribution in an effort to present these messages as organic, popular sentiment.

Figure 8 - Top 3 narratives appearing in posts by Iranian officials and state media outlets on X/Twitter.

Implications for Cyfluence Research

Since the start of the Iran War, threat analysts and researchers have begun to map, correlate and monitor the diverse – and perhaps unprecedented – usage of hybrid threats, including cyfluence attacks, carried out by the combatting sides.

A new report by cyber threat intelligence firm Intercept9500, titled Iranian Hybrid Warfare During Operation Epic Fury, provides a valuable multi-dimensional review of offensive operations. Following an earlier Intercept9500 Preliminary Analysis published in May 2026, it complements the CRC’s abovementioned research by examining the overall Iranian response to the U.S.–Israeli military campaign.

Interestingly, the report posits that Iran effectively inverted the “conventional hybrid hierarchy”. Instead of deploying offensive influence and cyber operations to support a kinetic main effort, Tehran prioritized the cognitive and cyber domains, due to its calculation of its own comparative strengths and weaknesses. By doing so, Iran managed to gain greater opportunities to deny its adversaries from achieving their strategic objectives. 

To that extent, cyber activity was primarily designed and leveraged for visibility, narrative dissemination, and cognitive impact. Moreover, the strategic and operational models presented in the report place hostile influence operations and offensive cyber capabilities as part of an integrated cyfluence ecosystem.

Figure 9 – Iranian Cyfluence Operational Model during the Iran War. (Courtesy of Intercept9500)[3]

Conclusion

The Iran War remains a valuable case study for hybrid-threat researchers, cyfluence analysts, and Influence Defense stakeholders. It highlights the role of the strategic and operational fusion of kinetic actions, cyber capabilities, economic coercion, information control, diplomatic posturing, and strategic communication in modern warfare. Given that the increased integration of these various elements has already created a highly complex and dynamic global threat landscape, additional research into both offensive applications and defensive countermeasures should be encouraged.

For Influence Defense practitioners and stakeholders, the existing (and still expanding) body of evidence and operational insights is a valuable resource. A methodological examination of how hybrid threats manifest during high-intensity conflict could directly inform pre-emptive and proactive capacity building, helping to protect against emerging threats, especially in other regions currently at risk.

CRC report raises several noteworthy takeaways for defenders, such as the need to pre-bunk and respond rapidly to narrative attacks, while establishing defensive capabilities, coordination mechanisms, and protection procedures before a crisis emerges. This point is particularly important for civilian infrastructure and private sector entities, which are increasingly exposed to both kinetic and hybrid threats.

Lastly, we should be mindful of a basic working assumption: the valuable lessons learned from this conflict are not limited to the current combatants. Other major actors, including China and Russia, will surely draw their own conclusions. Likewise, different hacktivist groups, proxy organizations, and small-scale threat actors will likely be quicker to adapt, modifying their approach and TTPs accordingly. Ultimately, it is the application of those lessons that will determine how cyfluence capabilities and hybrid threats will be deployed in future conflicts.

The CRC continues to monitor the developments and will report on relevant findings.

[References:]

1. Deutsche Welle (DW). What’s in the 14-Point US-Iran Peace Plan? [online] Published 19 June 2026. Available at: https://www.dw.com/en/whats-in-the-14-point-us-iran-peace-plan/a-77595563

   
   

2. Associated Press. Iran, USA and United Arab Emirates Attack. [online] Published 24 June 2026. Available at: https://apnews.com/article/iran-usa-united-arab-emirates-attack-0764d17c09370a8c5cf1e8197a8878ab
   

3. Intercept9500, “Iranian Hybrid Warfare During Operation Epic Fury: Preliminary Analysis While the Situation is Still Unfolding” 15 June 2026. Available online: https://media.licdn.com/dms/document/media/v2/D4D1FAQFygKagA-vnDQ/feedshare-document-sanitized-pdf/B4DZ9THlLlGkA8-/0/1783805925198?e=1784451600&v=beta&t=H0YeCibL2_7qxMeO4zYcEN13cJFG6gqSYtZ9E7PJY7E