Dr. Hamdi Malik is an Associate Fellow with the Washington Institute, specializing in Shia militias. He is the co-founder of the Militia Spotlight platform, which offers in-depth analysis of developments related to the Iranian-backed militias in Iraq and Syria. He is the coauthor of the Institute's 2020 study "Honored, Not Contained: The Future of Iraq’s Popular Mobilization Forces."
Militias falsely claimed attacks against Israeli and U.S. targets in retaliation for the nuclear incident, underlining how Tehran directs and coordinates each proxy's kinetic and information operations in a centralized manner.
On April 11, 2021, Iran announced that its Natanz nuclear site had been attacked. Israeli media quickly attributed the attack to Israel, with Iranian media soon following suit. Israeli outlet Kan specified that the Mossad intelligence agency was behind the incident. This was a humiliating blow to the Islamic Republic, especially because the same facility had previously been targeted in July 2020, causing significant damage to the country's main nuclear fuel enrichment site. Alireza Zakani, head of the Iranian parliamentary research center, reacted to the April explosion by describing Iran as “heaven for spies.”
To demonstrate its ability to retaliate against Israel, Tehran quickly mobilized its resources. On April 12, an Israeli-owned ship was attacked off the coast of the United Arab Emirates, and Israeli officials believe Iran was behind the attack. Meanwhile, Tehran announced that it would start enriching some uranium to 60 percent.
Iran also mobilized the Iraqi muqawama (resistance). This took the form of a coordinated effort among muqawama social media channels to spread news of attacks against the U.S.-led coalition. Fake stories disseminated by muqawama Twitter and Telegram accounts are nothing new, but there was an uptick in the frequency of fake attacks and news campaigns for a few days after the Natanz incident. Two of the most prominent are detailed below.
April 13: Fake Attack on Israeli Intelligence
On April 13, Unit 10,000 posted a message on its Telegram channel at 21:01 local time claiming that a Mossad center for information and special operations in northern Iraq had been attacked, and that a number of Israeli personnel had been killed or injured (Figure 1).
Other Iraqi muqawama Telegram accounts quickly followed suit. At 21:02, Sabereen News reposted the same exact message without giving credit to Unit 10,000 (Figure 2), an indication that this was an information operation directed from above—that is, by Iran's Islamic Revolutionary Guard Corps (IRGC), which is generally able to compel a degree of coordination across the muqawama. In order to reach an international audience, Sabereen then posted the message in Farsi and English.
Next, Press TV, an Iranian state-owned English-language network, used its “PTVbreaking” Twitter account to post news of the attack. This was quickly retweeted and prominently pinned by the main Press TV Twitter account, which is followed by more than 252,000 users.
The IRGC-affiliated Fars News Agency then picked up the fake story and published it in Farsi. This prompted the Jerusalem Post to run the story, citing Fars News. Other outlets such as Russia TV Arabic also published the news.
April 15-16: Fake Attacks on al-Asad Air Base
In another coordinated information operation, two fake attacks were claimed on al-Asad Air Base. The first was claimed on April 15 around 20:10 local time by a group of Kataib Hezbollah-affiliated channels. These claims led to a flurry of propaganda imagery and posts from across the Kataib Hezbollah online networks. At 20:45, however, Sabereen posted a statement confirming that the attack had not happened yet.
Hours later, at 03:41 on April 16, Sabereen broke the (fake) news of a drone attack on the base (Figure 3), and dozens of other muqawama social media channels and Telegram accounts aggressively published fake details, building an iterative and interwoven narrative. According to these posts, high-value targets such as the operations center and anti-missile systems had been bombed. Once again, Sabereen published the news in Farsi and English, and Iranian news agencies such as IRNA and Mehr published the fake story, citing Sabereen. Taken together, these efforts resulted in what appeared to be a plausible developing story—despite no drones or rockets having been fired. Only two days before, muqawama had launched a real attack on U.S. forces at Erbil airport using a suicide drone.
Other fake attacks have included claimed rocket strikes against Balad Air Base and improvised explosive device attacks against convoys. Again, though, the fake stories coexist with real attacks: two separate, real rocket attacks were launched against Baghdad's air base in the second half of April, and real convoy attacks are ongoing as well.
The combination of real and fabricated attacks is intended to confuse opponents while falsely demonstrating a “robust” Iranian and muqawama response to the Natanz incident. This hybridization of information and kinetic operations will almost certainly continue in the coming months, since it represents a cheap way of multiplying the propaganda value of militia operations while adding a layer of deception.