Everything Everywhere All at Once - Part 2

Overview

In June 2025, the long-standing tensions between Israel and Iran escalated into direct conventional warfare. Through our intelligence monitoring, Graphika tracked and analyzed the activities of Iranian state and state-aligned media outlets, networks of inauthentic social media accounts, and pro-Iran hacktivist groups. This two-part report details how these actors mobilized to spread unified narratives, despite varying levels of proven state affiliation.

Our analysis reveals a playbook used by pro-Iran actors to manage perceptions during and after the war. We observed a notable delay in the initial mobilization of an information response, suggesting a lack of preparation for a large-scale on-the-ground conflict. Once mobilized, however, these actors collectively clouded the information space by disseminating a mix of breaking news alerts, aggressive threats, and unverified claims. Our reporting outlines the tactics employed to target domestic and global audiences.

While the first part in this series covered activity from state and state-aligned media as well as sets of inauthentic social media accounts, this second part covers the activity we observed from pro-Iran and Iran-linked hacktivist groups. In particular, we examine a new group that is regularly amplified by the Iranian Revolutionary Guard Corps (IRGC)-backed media, and which we assess with medium confidence is an Iranian-sponsored persona. These findings stem from our June 13-25 monitoring, alongside our tracking of previously identified Iranian state-backed and state personas, the groups that revolve around them, and the overall Iran-aligned hacktivist community.

 

Key Findings

We identified the following key findings across parts 1 and 2 of this report.

• Pro-Iran hacktivist groups, media, and social media mobilized during the 2025 Israel-Iran war and spread similar narratives regardless of their proven or self-described state affiliation.
• Organic pro-Iran activity accounted for most of the hacktivist cyberattacks we observed during the war, with over 100 pro-Iranian hacktivist groups originating from the broader pro-Palestine and pro-Russia movement.
• Iranian state-run and -sponsored hacktivist personas reactivated, redirected their efforts, or reframed some of their campaigns to support Iran and attack Israel.
• At least one new group - Cyber Isnaad Front - that we assess with medium confidence is an Iranian-run hacktivist front, given its similarity to previously attributed personas, emerged during the June escalation. The group gained amplification through Iranian official channels, and sought to depict Israel as exposed, unprepared, and technically inferior to Iran in cyberspace.