Search

Thierry Cotillard, president of the Les Mousquetaires group, warns about the gravity of cyberattacks, reporting that 300 Intermarché and Netto stores have been affected by an attack targeting refrigeration control systems, leading to significant losses of fresh and frozen product stocks. #cyberattaque #sécuritéinformatique #distribution (translated)

A cyberattack recently targeted refrigerated facilities in France, affecting several major retail brands, which led Prime Minister Sébastien Lecornu to request the intervention of Anssi to identify the affected companies and prevent any spread. #Cybersécurité #Cyberattaque #Anssi (translated)

SaxX stated that a cyberattack targeting Danfoss regulatory systems affected around 500 supermarkets in France during the night of October 11 to 12, including Intermarché, Netto, Coopérative U, Market, Monoprix, and Leclerc stores. According to him, the attackers forced the defrosting of equipment, with instructions reaching up to 50 °C. Two stores in Alsace alone reportedly recorded losses of 270,000 euros. Relying on information from a cyber official of a major brand, SaxX indicated that the vulnerability concerned three types of equipment and had been known since July, without clients being informed. Only one of the three types had a patch, which needed to be installed manually by refrigerant technicians, store by store. He added that the connected refrigerators used 3G cards installed by technicians, outside of the network and control of the brand's IT teams. The equipment would have been shut down, and the stores would have switched to manual mode, with a return to operation expected within the day, while the application of the patch would take longer. According to SaxX's analysis, the targeted versions were earlier than version 4. He reminded that Danfoss had fixed an authentication bypass vulnerability in version R4.2 related to passwords generated from the date and time. If these elements were confirmed, he estimated, it would not be a “zero-day” vulnerability, but rather a delay in updating. He also noted that Shodan still listed more than 3,700 Danfoss interfaces accessible from the Internet in August. SaxX said that France seemed to be the only country affected for the moment. He mentioned possible explanations such as the size of the French Danfoss park, a common provider or access channel, or deliberate targeting, while clarifying that nothing was established. He finally reported that his contact feared that other organizations might be more affected, particularly those whose activities relied mainly on frozen products. SaxX also indicated that he intervened at midday on TF1’s newscast to talk about the attack and possible motivations of the state group or hackers. #cyberattaque #sécuritéinformatique #France (translated)

Infos Françaises affirmed that an unprecedented national cyberattack was affecting the refrigeration facilities of several major French retail chains, including U and Intermarché stores. According to the report, the hackers had remotely triggered the defrosting of the equipment, with programmed temperatures that could reach 50 degrees, and hundreds of stores were affected. Infos Françaises added that the damages could amount to millions of euros, citing TF1 and BFMTV. #cyberattaque #sécuritéinformatique #France (translated)

Jon De Lorraine stated that a cyberattack targeted the refrigerated facilities of several French brands, including Intermarché, Leclerc, and Super U. According to his message, the hackers exploited control systems from the manufacturer Danfoss and hijacked the defrost function, causing continuous operation and set temperatures reaching 50 °C. He indicated that around 150 Intermarché stores would be affected and that stock of fresh and frozen products would have been destroyed. In Haguenau, in Alsace, two supermarkets reportedly suffered losses of 270,000 euros, he wrote, adding that the national toll could reach several million euros. He cited BFM and Je Bosse en Grande Distribution as sources and specified that the assessments were still provisional. #Cyberattaque #SécuritéInformatique #Supermarchés (translated)

Louis Boyard wrote that the youth had had enough, like the rest of the country. He reminded that students had been queuing for years to receive food supplies and that high school students were denouncing their study conditions. He believed that the youth were setting an example and called on all French people to join them and strengthen the mobilization. #jeunesse #mobilisation #solidarité (translated)

Russia’s war propaganda gets a soundtrack – how AI-generated songs reached global streaming platforms Russian war propaganda is no longer confined to television broadcasts, Telegram channels or political videos. A study by the Ukrainian threat-intelligence organisation Terrecon has identified 981 songs combining signs of AI generation with pro-Russian military narratives, distributed through an ecosystem that reaches YouTube, Spotify, Apple Music, Deezer and SoundCloud. The songs range from sentimental ballads to rock and heavy metal. Their recurring themes are familiar from conventional Russian wartime propaganda: the heroisation of Russian soldiers, romanticisation of the war, mobilisation, the “Russian world”, commemoration of fallen troops and attacks on Ukraine and its armed forces. Some contain derogatory or dehumanising references to Ukrainians. What is new is not necessarily the message, but the production and distribution model: generative AI allows propagandistic music to be produced rapidly, cheaply and in quantities that would previously have required musicians, studios and producers. Nearly 1,000 tracks identified Terrecon examined 3,725 tracks collected from YouTube, YouTube Music, SoundCloud and the AI music platform Suno. After manual review, researchers classified 981 as showing both indications of AI generation and pro-Russian war propaganda. In 681 tracks they identified 728 propaganda-related keywords or phrases. The largest category was the glorification of the Russian military, followed by romanticised treatment of Moscow’s so-called “special military operation”, mobilisation appeals, narratives about the “Russian world”, and the cult of fallen soldiers and the state. The reach was not merely theoretical. Listening or viewing statistics were available for 608 of the identified tracks; together they had accumulated 86.8 million plays and views, according to Terrecon. A smaller group of 13 high-performing songs accounted for more than 53 million YouTube views and more than 67 million when YouTube Music was included. Among the better-known examples is “Power of Artillery”, a Russian-language rock song praising artillery weapons that passed two million views on YouTube. Most of the tracks for which publication dates could be established appeared after 2024, broadly coinciding with the rapid expansion of consumer AI music generators such as Suno and Udio. That correlation does not prove that AI alone caused the increase, but it illustrates how drastically the economics of production have changed. A propaganda song for as little as $11 Terrecon also tested how difficult it would be to commission such material. Researchers approached 25 creators producing AI-assisted militaristic music; 15 agreed to take commissions. Prices ranged from approximately $11 to $330, while delivery times ranged from two hours to three days. According to Terrecon, some were prepared to produce highly aggressive anti-Ukrainian material, including content intended for audiences involving children from occupied Ukrainian territories. Some creators used Russian intermediary services that provided access to Western AI tools such as Suno and Udio despite restrictions. The researchers then tested several AI generators themselves. Across 40 prompts submitted to Suno, Udio, Mureka, Google Flow Music and ElevenLabs, 25 resulted in successful generations, while safeguards were circumvented in 15 cases. Terrecon reported that four of the five services tested produced Russian-language material containing wartime narratives, although technical problems prevented comparable testing on some systems. In one Udio experiment, the researchers said the model itself introduced more explicit violent language than had appeared in the original promp These tests do not demonstrate that the commercial platforms knowingly support Russian propaganda. They show something narrower: existing safeguards can be inconsistent when political messaging is packaged as music. From generation to Spotify The distribution experiment may be the most revealing part of Terrecon’s research. The team deliberately uploaded test tracks containing explicit hostile language to YouTube, SoundCloud, Spotify and Deezer. Terrecon says none was blocked during the experiment. On SoundCloud, researchers used an account identifying its location as Moscow, disclosed the use of AI and added markers including references to the Russian military and the war. The platform accepted the upload and subsequently offered paid promotional and distribution tools. This does not prove that streaming recommendation systems systematically promote pro-war music. There is currently insufficient public evidence to make that claim. It does demonstrate that material can enter the same commercial distribution infrastructure as ordinary music and, once there, potentially benefit from playlists, searches, sharing and recommendation mechanisms available to other releases. That distinction is important. Propaganda no longer has to announce itself as political communication. On a streaming platform it can look like another song. Culture as a delivery mechanism Music has always been used in wartime propaganda. What generative AI changes is scale. Instead of investing heavily in a limited number of patriotic performers or officially commissioned productions, creators can generate variations across styles, audiences and emotional registers at very low cost. Terrecon found material ranging from war rock to sentimental songs and content styled for younger audiences. Some creators also experimented with cloned celebrity voices and stylistic imitation of established musicians. The format also offers a different relationship with the audience. A political video asks a viewer to consume an argument. Music can accompany commuting, exercise or entertainment and may be encountered outside explicitly political spaces. This does not automatically make it more persuasive, and Terrecon’s research does not establish measurable effects on political attitudes. It does, however, place wartime narratives inside a cultural environment where users may not initially perceive themselves as consuming political messaging. An ecosystem, not a proven Kremlin command structure The strongest evidence supports describing this as a growing AI-assisted pro-Russian propaganda-music ecosystem, not a single operation controlled from Moscow. Terrecon did not establish that the Russian government created, financed or coordinated all 981 tracks. Reporting on the study likewise notes that the extent of direct state involvement remains unclear. There is broader evidence that the Russian state finances cultural projects and digital content supporting the war, including through state-backed funding bodies. That context matters, but it does not allow individual songs in Terrecon’s dataset to be attributed to the Kremlin without additional evidence. The significance of the case lies elsewhere. AI has reduced the cost of producing ideological content, intermediaries can help creators access generation tools, and global platforms can provide distribution. The result is a pipeline in which wartime propaganda no longer has to resemble propaganda at all. It can simply appear in a playlist. Sources Terrecon / Ukrainska Pravda — Daria Verbytska on the research https://www.pravda.com.ua/columns/2026/10/05/8056229/ Suspilne Culture — detailed breakdown of Terrecon findings https://suspilne.media/culture/1417933-rosijsku-voennu-propagandu-maskuut-pid-anime-karaoke-ta-rok-doslidzenna-si-pisen-vid-terrecon/ The Insider — AI-generated Russian war propaganda music https://theins.ru/news/297839 Institute of Mass Information — summary of New York Times reporting https://imi.org.ua/en/news/doslidzhennya-rf-masovo-stvoryu%D1%94-propagandistski-pisni-za-dopomogoyu-shi The Bridge Media — AI-generated songs and Russian military propaganda https://thebridgemedia.com.ua/en/ai-generated-songs-russian-military-propaganda/ Center for Strategic Communication — cost and production of AI propaganda music https://spravdi.org/propaganda-za-11-yak-rosiya-shtampuye-shi-pisni-z-miljonamy-prosluhovuvan/ Times of India — AI-generated Russian war songs https://timesofindia.indiatimes.com/world/europe/ai-sings-russias-war-story-inside-the-rise-of-generative-songs-about-ukraine-conflict/articleshow/134650594.cms EU Council / EUR-Lex — Presidential Foundation for Cultural Initiatives https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026D1351 Human Rights Watch — Russian state funding of digital and patriotic content https://www.hrw.org/report/2025/07/30/disrupted-throttled-and-blocked/state-censorship-control-and-increasing-isolation #DISINFORMED #Episode16 #Russia #Ukraine #RussianPropaganda #WarPropaganda #MusicPropaganda #AIMusic #ArtificialIntelligence #AI #GenerativeAI #SyntheticMedia #AIPropaganda #Disinformation #InformationWarfare #InfluenceOperations #CulturalPropaganda #DigitalInfluence #NarrativeManipulation #PropagandaMusic #StreamingPlatforms #Spotify #AppleMusic #YouTube #YouTubeMusic #Deezer #SoundCloud #Suno #Udio #RussianWorld #RusskiyMir #MilitaryPropaganda #WarNarratives #Mobilisation #AlgorithmicDistribution #RecommendationAlgorithms #MusicStreaming #PlatformManipulation #Terrecon #OSINT #MediaManipulation #WRLD

"Every day brings new information about destroyed buildings, injured people, or tragically killed individuals. Today, the question is survival." The words are signed by Vitali Klitschko, the mayor of Kyiv. "The crisis [regarding water distribution] could be quite significant," warns Vitali Klitschko. #Ukraine #Russie #Guerre (translated)

Nostra indicated that the chosen option, approved unanimously, involved August and September to select 300 affiliates. He specified that €20,100 would be distributed in total, which is €67 per affiliate, and that the campaign would start the following week, while he was gradually recovering from jet lag. https://t.co/LyhLz8rYuz #Affiliés #Campagne #Distribution (translated)

Disinformation for hire – the network of 70 fake newsrooms sold as a service The websites looked local. Naija Pulse appeared to cover Nigeria, Echo Berlin Germany, The British Daily Britain, Fifty States the United States and Commonwealth Post Australia. Each had its own branding, articles, supposed journalists and matching social-media presence. Taken individually, they resembled small independent news outlets. According to Anthropic, however, they were parts of a single commercial influence network spanning six continents. Anthropic’s September 2026 threat report identifies the operation as GTG-54002, a commercial “influence-as-a-service” network that used Claude to generate and rewrite political content at industrial scale. Investigators linked roughly 70 fabricated news websites to around 70 matching X accounts and more than 250 additional inauthentic commenting accounts designed to create the appearance of genuine public engagement. The network produced at least 8,913 articles in about 20 languages before Anthropic disrupted the activity. The significance of the case is not simply the number of fake sites. It is the business model. The network did not consistently promote one government, party or ideology. Anthropic found that its political position changed according to the apparent interests of different customers. The company therefore described it as a commercial influence operation: political manipulation offered in much the same way as other outsourced digital services. A fake media ecosystem built at scale Anthropic says the infrastructure was created rapidly. Domains were registered from France during a roughly ten-week period in mid-2025 and deployed through shared technical infrastructure, allowing investigators to connect publications that outwardly appeared unrelated. Most of the supporting social-media accounts were also created within a narrow timeframe in June and July 2025. The sites were designed to look like functioning local newsrooms rather than anonymous propaganda pages. Articles carried fabricated bylines belonging to journalists who, according to Anthropic, did not exist. Each outlet had a corresponding account on X, while a second layer of fake profiles commented on and amplified the articles. Many of those accounts used AI-generated profile photographs. The result was a three-tier structure: the newsroom published the story, the branded social account distributed it, and apparently ordinary users supplied the appearance of public reaction. Some of those sites remained publicly visible after the operation was exposed. The British Daily, for example, described itself as providing “conservative insights” on British sovereignty and migration, while Commonwealth Post presented itself as an Australian liberal publication focused on democracy, migration and regional security. Those contrasting editorial identities illustrate the central feature identified by Anthropic: the network was capable of taking different political positions in different markets. Claude as a publishing engine Claude was not simply asked to draft occasional articles. The operators built a structured production pipeline around it. Prompts required fixed JSON outputs, formatted HTML, precise character limits and internal links, allowing articles to move directly into an automated publishing workflow. The system could generate entirely new material or take reporting produced by legitimate journalists and rewrite it to fit a desired political perspective. Anthropic identified three recurring techniques. The same source article could be rewritten in opposite ideological directions for different audiences; a political interpretation could be added to a story that originally contained none; and material could be moved from one country to another after its original context had been removed. The articles were also structured to improve the apparent authority of the sites in search engines, helping the network imitate ordinary digital publishing practices rather than simply broadcasting propaganda. This is where generative AI changes the economics of an influence operation. A conventional network of dozens of supposedly local publications would normally require writers, translators, editors and social-media staff. Here, much of that production could be standardised and automated while human operators concentrated on political direction, customer requirements and distribution. The DRC–Rwanda conflict as a test case The clearest concentration of activity involved the Democratic Republic of Congo. Anthropic identified 318 articles concerning the DRC across the fake-news network. The material generally supported positions aligned with the Congolese government, particularly on regional mineral agreements and tensions with Rwanda. Early in the network’s growth, many of the fake social-media personas following and amplifying its accounts also presented themselves as Congolese. Investigators observed one especially revealing episode on 11 September 2025, when multiple sites published almost identical articles about the DRC–Rwanda conflict within approximately three minutes of one another. The wording and political tone were adjusted for different regional audiences, while associated X accounts distributed the links in a coordinated pattern. Anthropic said the activity contained signals suggesting that one or more customers had interests connected to the DRC–Rwanda conflict. It did not, however, identify those customers and explicitly stated that it found no evidence that any government had directed the operation. That distinction is essential. The content may have benefited a political actor without demonstrating that the actor commissioned or controlled it. Influence without ideology Commercialisation is what distinguishes GTG-54002 from many state-linked information operations. A government propaganda network usually has an identifiable strategic direction. A commercial influence provider does not need one. Its infrastructure can support one position in one country and the opposite position somewhere else, provided different customers are willing to pay. That makes attribution more difficult. Analysts cannot necessarily infer the operator from the ideology of the content because ideology may simply be part of the service package. The enduring asset is the infrastructure: domains, publishing systems, fake journalists, social-media accounts and automated amplification. Anthropic says the operation was disrupted before it achieved significant genuine reach. It classified GTG-54002 as Category Two on the Brookings Breakout Scale: material circulated across the network’s own sites and associated social accounts but showed no evidence of substantial penetration into authentic communities. Most of the 8,913 articles generated little observable engagement from real users. That limited impact is important. The case should not be presented as a successful global manipulation campaign. It is better understood as evidence that the infrastructure required to run such campaigns has become cheaper, faster and increasingly commoditised. The deeper shift is that a fake media ecosystem no longer has to be built around a single political cause. It can be built once, automated and then repurposed for the next customer. Disinformation, in this model, is no longer only a political instrument as it turend into the service. Sources: Anthropic — Countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 Business Standard — AI scaling fake newsrooms, surveillance and online scams https://www.business-standard.com/technology/tech-news/anthropic-report-ai-fake-newsrooms-dating-surveillance-scams-126091100730_1.html Mimikama — KI baut 70 erfundene Nachrichtenportale https://www.mimikama.org/ki-netzwerk-erfundene-nachrichtenportale-echo-berlin/ Poliscoop Media — Anthropic exposes DRC propaganda network https://www.poliscoopmedia.com/articles/anthropic-exposes-drc-propaganda-network-20260911 The British Daily — example of a fabricated outlet identified in the network https://www.british-daily.com/contact Commonwealth Post — example of a fabricated outlet identified in the network https://commonwealth-post.com/category/science MalPulse — infrastructure references for network domains https://www.malpulse.com/infra-pivots/usom-pivots/list/?page=1105 Keywords: #DISINFORMED #Episode13 #DisinformationAsAService #InfluenceAsAService #FakeNewsrooms #FakeMedia #SyntheticMedia #ArtificialIntelligence #AI #GenerativeAI #ClaudeAI #Anthropic #Disinformation #InfluenceOperations #InformationWarfare #FIMI #CommercialInfluence #PoliticalManipulation #NarrativeManipulation #NarrativeLaundering #SourceLaundering #MediaImpersonation #FakeJournalists #SyntheticPersonas #Astroturfing #SocialMediaManipulation #CoordinatedInauthenticBehaviour #CIB #DigitalInfluence #AutomatedPropaganda #ContentAutomation #AIPropaganda #LKMCompany #NaijaPulse #AxumVoices #JamboJournal #EchoBerlin #TheBritishDaily #FiftyStates #CommonwealthPost #DRC #Rwanda #OSINT #WRLD

IRAN: MEK/NCRI – when AI impersonated a real activist in live conversations For years, synthetic media has largely meant fabricated images, cloned voices and manipulated video. A case uncovered by Anthropic in September 2026 suggests a more consequential development: artificial intelligence being used not merely to imitate how a person looks or sounds, but to behave as that person in an ongoing conversation. Anthropic says it dismantled a distributed influence operation targeting Iranians inside the country and abroad that it linked to the People’s Mojahedin Organization of Iran, or PMOI/MEK, and its political front, the National Council of Resistance of Iran. The operators used a shared AI-agent platform to support impersonation, audience profiling, coordinated social-media activity, synthetic personas and the laundering of organisational content through apparently independent accounts. At least four people involved in the operation worked for official NCRI media outlets, according to Anthropic. The company also found references to committee approval processes and MEK leadership, but said it could not independently determine the precise level of central control. Cloning a person from 8,400 Telegram posts The most striking part of the operation involved a real activist whose Telegram identity was copied. According to Anthropic, the operators instructed Claude in Persian that it was now that person, then provided approximately 8,400 of the activist’s Telegram posts so the system could learn and reproduce his writing style. The AI-assisted account was subsequently used to conduct live political conversations with the activist’s existing contacts. Anthropic says that, to its knowledge, the people receiving those messages did not know they were interacting with an account being operated with AI assistance. This is materially different from a conventional chatbot or a static deepfake. The system was not simply producing a forged statement attributed to someone else. It was using a large archive of that person’s authentic language as behavioural training material, then applying the resulting imitation interactively. In practical terms, the deception moved from synthetic content to synthetic identity. Anthropic did not publish the identity of the impersonated activist, nor details of his contacts, and the public report does not establish what specific information the conversations produced. What it does establish is that the impersonation was operational rather than experimental: the cloned account was used in real exchanges with real people. From social-media monitoring to psychographic dossiers The impersonation sat inside a much broader targeting system. Anthropic says the network scraped more than 500 social-media channels and categorised individuals by location, age, profession, political orientation and arrest history. It then analysed approximately 51,944 archived messages from conversations to construct detailed psychographic dossiers on dozens of people inside Iran. The system was therefore not limited to broadcasting propaganda. It was also designed to understand specific audiences and individuals. Profiles could be used to decide what kind of message was most likely to resonate with a particular person, which political identity they appeared closest to and how they should be approached. Anthropic describes this as a structured targeting funnel rather than ad hoc social-media activity. That distinction is important in the Iranian context. Political activists, dissidents and opposition contacts inside Iran can face arrest and severe punishment. The report does not show that the dossiers directly led to arrests or other harm, but collecting and organising information such as arrest history and political affiliation adds a surveillance dimension to what would otherwise be described as an influence operation. A shared AI system for an influence network Anthropic found that the actors used a shared Claude-based platform named “Viktor”, with separate workspaces and persistent memory. Those memory files contained approved sources, prohibited words, account-management instructions and methods intended to reduce the risk of detection. One operator loaded MEK founding doctrine into the system as what the report called “strategic base data”, allowing others to reuse it across their work. This persistent-memory structure meant the AI did not have to be briefed from scratch for every task. Once doctrine, stylistic rules and operational constraints had been stored, the system could repeatedly produce material consistent with the network’s objectives. Anthropic says the same general playbook appeared across different workspaces despite the operators not sharing obvious account infrastructure. The network also used automated pipelines to coordinate Instagram posting schedules and tailor messages to different audiences. Some accounts initially avoided mentioning the Mojahedin at all, allowing material aligned with MEK/NCRI narratives to appear as neutral or independent political commentary. Content was distributed through the organisation’s own media ecosystem as well as accounts presented as ordinary news or activist profiles. Anthropic assessed the campaign as Category Two on its Breakout Scale: active on multiple platforms with distribution through NCRI-linked media properties and amplifier accounts, but without evidence of broad authentic penetration. Synthetic citizens and disguised organisational media The same infrastructure generated AI avatars presented as ordinary Iranians, complete with Persian audio, to promote Maryam Rajavi’s political programme. Anthropic says the synthetic nature of these personas was intentionally concealed. Operators also rewrote and redistributed content originating from MEK-affiliated media while stripping identifying features or presenting it through apparently independent accounts. The network’s political messaging targeted the Iranian government but also rival opposition currents, including monarchists and supporters of the Pahlavi camp. Anthropic documented fabricated video material attacking a member of the Pahlavi family and the use of the slogan “Neither Shah Nor Sheikh”, consistent with the NCRI’s broader competition with other opposition movements. That rivalry provides relevant context. Reuters describes the MEK as one of Iran’s principal organised opposition movements in exile and the dominant force behind the NCRI, led by Maryam Rajavi. Its relationship with other opposition currents is often contentious, while the extent of its support inside Iran remains uncertain. What can be attributed – and what cannot Anthropic’s attribution is unusually specific but still needs to be stated carefully. The company says its investigation linked the operation to MEK/NCRI and established that at least four participants worked for official NCRI media organisations. It also found a common operational playbook, committee review structures and repeated references to MEK leadership. On that basis, Anthropic said central tasking was likely. It nevertheless stopped short of saying it had proven that NCRI’s senior leadership directly ordered or managed every component of the operation. That caveat matters. The strongest public evidence supports describing GTG-84006 as a MEK/NCRI-aligned influence operation involving personnel from official NCRI media, rather than asserting that every action was directly commanded by the organisation’s top leadership. The broader significance of the case lies elsewhere. Earlier generations of synthetic media attempted to fabricate evidence: a photograph, a voice recording or a video. Here, AI was used to maintain an identity over time, remember doctrine, analyse targets and speak directly to real people while appearing to be someone they already trusted. The deepfake was no longer merely an artefact. It had become a participant in the conversation. Sources Anthropic — Countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 AI Misuse Case Library — GTG-84006 activist impersonation case https://www.misuseofai.com/en/cases/gtg-84006-activist-impersonation/ Reuters — Who makes up Iran’s fragmented opposition? https://www.reuters.com/business/media-telecom/who-makes-up-irans-fragmented-opposition-2025-06-18/ Reuters — Iran’s divided opposition senses its moment https://www.reuters.com/world/middle-east/irans-divided-opposition-senses-its-moment-activists-remain-wary-protests-2025-06-19/ Reuters — NCRI and Maryam Rajavi https://www.reuters.com/world/middle-east/dissident-leader-abroad-urges-iranians-bring-down-khamenei-2025-06-24/ Keywords #DISINFORMED #Episode12 #Iran #MEK #PMOI #NCRI #IranianOpposition #Disinformation #InfluenceOperations #InformationWarfare #ArtificialIntelligence #AI #GenerativeAI #ClaudeAI #Anthropic #AIDeception #AIImpersonation #IdentityImpersonation #SyntheticIdentity #InteractiveDeepfake #DigitalImpersonation #PersonaCloning #BehaviouralCloning #Telegram #PsychographicProfiling #TargetProfiling #AudienceTargeting #SocialMediaManipulation #Astroturfing #SyntheticPersonas #NarrativeLaundering #CoordinatedInfluence #PoliticalInfluence #DigitalInfluence #OppositionPolitics #IranPolitics #OSINT #WRLD

The Saudi-led coalition said a drone hit the Taibah electricity distribution station, which supplies power to the Prophet's Mosque, one of Islam's holiest sites. The Houthis denied the claim, stating it was a "lie" to back previous allegations against the group. #Yemen #Houthis #Medina

"a reduction in levels and the distribution of more resources to countries, territories, cities to give local teams more responsibility for gains in their markets" The group's CEO, Elliott Hill, sent a message to employees explaining in detail this operational shift, called "Pace", which will result in "fewer jobs within Nike". #Nike #Emplois #Réorganisation (translated)

Iran’s cognitive warfare – when AI becomes the operating layer of state propaganda Iranian state-linked influence operators were not using artificial intelligence simply to write faster social-media posts. According to Anthropic’s September 2026 threat intelligence report, three separate operations connected to Iranian propaganda institutions were using Claude to help construct the machinery behind what the operators themselves called “soft war” and “cognitive warfare” – non-military efforts intended to shape public opinion inside Iran and abroad. Anthropic linked the activity to the Islamic Culture and Communications Organization (ICCO), which operates under Iran’s Ministry of Culture and Islamic Guidance; the Islamic Propaganda Office of Khorasan Razavi; and the Bina Cultural Observatory, part of the Islamic Propaganda Organization. The company said each operation was run by someone working within or on behalf of the named institution. The attribution was based on a combination of account telemetry, institutional references disclosed during conversations, branded documents and open-source corroboration. Anthropic subsequently removed the accounts. AI as an operational headquarters The most significant feature of the operation was the role assigned to AI. Claude was used to develop campaign plans, doctrine manuals, coded project portfolios, persona systems, target databases, early-warning protocols, amplification schedules and ministerial planning documents. Anthropic described the model as the principal administrative and operational layer supporting the three campaigns, allowing relatively small groups of operators to create organisational structures and planning material that would otherwise have required a much larger staff. This distinction matters. The reported use of AI went considerably beyond content generation. Operators were using the model to help organise how influence activity should function: which audiences to target, which identities should deliver particular narratives, how official material should be repackaged and when amplification should take place. Human operators still determined objectives and supplied the underlying political doctrine; AI helped translate those decisions into an operational system. Anthropic found that all three operations explicitly connected their activity to Jihad al-Tabyin, often translated as “explanatory jihad”, a concept used within the Iranian state system to frame information activity as both a strategic and ideological responsibility. In internal planning material examined by the company, this doctrine was not merely rhetorical: it informed manuals and campaign structures used by the operators. ‘Not the narrator, but the director’ One sentence contained in the ICCO material captures the model particularly clearly. According to Anthropic, an operator described the role of Iranian cultural attachés as being “not to be the narrator, but the director” of the narrative. The distinction reveals the logic of attribution laundering. Instead of publishing an overt state message and asking foreign audiences to believe it, the operator attempts to create the appearance that the same narrative emerged independently from journalists, activists, foreign writers or ordinary citizens. Anthropic found that Claude was used specifically to make content appear to come from foreign authors or independent media organisations and to design hashtag campaigns that looked grassroots rather than centrally organised. The ICCO operation reportedly used the organisation’s international cultural network as part of this structure. Anthropic found ministerial-level documents carrying official ICCO branding, including a nine-part international influence portfolio. This makes the operation particularly significant because the infrastructure was not limited to anonymous social-media accounts; it intersected with formal state institutions and an existing network of cultural representation abroad. A multilingual content factory A second operation was associated with the Islamic Propaganda Office of Khorasan Razavi and what Anthropic described as a “cognitive warfare command room” operating from a seminary in Mashhad. Its organisers ran a multi-province content production system known internally as Manjanegh, or “Catapult”. According to Anthropic, dozens of activists were involved in repackaging publicly available reporting from Iranian security institutions under different personas so that the material no longer appeared directly connected to those institutions. The network used Claude to transform official government intelligence bulletins into customised material in Farsi, Arabic, Urdu, Malay, Spanish and English, while planning expansion into a total of 20 languages. Distribution extended across Iranian platforms such as Eitaa, Bale and Rubika and international services including X, Instagram, Telegram, TikTok and YouTube. Anthropic also documented paid amplification across more than 100 Iranian channels, including channels associated with IRGC narratives. The scale should nevertheless be interpreted carefully. Anthropic documented production infrastructure and some real-world dissemination, but it did not demonstrate that all planned campaigns were fully deployed or that they meaningfully changed public opinion. The company placed the operation in Category Three of its Breakout Scale, indicating multi-platform activity with content observed in external distribution channels, rather than evidence of strategic impact on entire populations. From security bulletins to apparently independent voices The Bina Cultural Observatory operation provides another example of the same architecture. Anthropic linked a director-level official at Bina to activity in which Claude generated messaging in the voice of an IRGC spokesperson. During the 2026 US–Israel–Iran war, the network also attributed false claims to Western institutions including CSIS, Brookings and RAND. The apparent objective was to make Iranian state-aligned claims look as though they had been independently validated by respected foreign research organisations. That technique is more sophisticated than simply publishing propaganda under a false name. It attempts to manufacture a chain of external validation: official information is transformed into apparently independent commentary, which can then be recirculated as evidence that outside observers have reached the same conclusion. Anthropic also found target databases naming international officials and Iranian opposition figures, as well as aggressive counter-narrative material directed against the Bahá’í community. These findings show that the infrastructure was designed not only for broad messaging but also for targeted influence activity against specific groups and individuals. What AI changed The Iranian operations described by Anthropic did not create a new doctrine of influence. Iran has used cultural institutions, official media, aligned organisations and covert or semi-covert online networks for years. What AI changed was the economics and organisational capacity of that model. A relatively small team could use the system to draft doctrine, create personas, translate material, structure target databases, produce campaign calendars and generate multiple versions of the same message for different audiences. The operator remained responsible for intent, political direction and selection of targets. AI reduced the amount of human labour required to turn those decisions into a functioning influence operation. The most revealing part of the case is therefore not that an Iranian propaganda network used a chatbot. It is that AI was being treated as part of the back office of information warfare – a system for converting state doctrine into apparently decentralised, multilingual and plausibly independent voices. Sources Anthropic — Detecting and countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 Iran International — Iran state-aligned accounts used Claude to push IRGC narratives https://www.iranintl.com/en/202609105561 BNE IntelliNews — Yemen missile cell used AI to write guidance software, Anthropic says https://new.intellinews.com/articles/yemen-missile-cell-used-ai-to-write-guidance-software-anthropic-says-467296 This is Beirut — Anthropic report details Iranian propaganda operations https://thisisbeirut.com.lb/news/politics/anthropic-report-details-iranian-propaganda-operations-and-yemen-missile-development-using-claude Anthropic report — PDF mirror https://static.foxbusiness.com/foxbusiness.com/content/uploads/2026/09/anthropic-detecting-and-countering-091026-1.pdf Keywords #DISINFORMED #Episode11 #Iran #IranianInfluence #IranianPropaganda #CognitiveWarfare #SoftWar #JihadAlTabyin #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #ArtificialIntelligence #AI #AIPropaganda #GenerativeAI #ClaudeAI #Anthropic #SyntheticMedia #NarrativeManipulation #NarrativeLaundering #AttributionLaundering #PersonaNetworks #Astroturfing #SocialMediaManipulation #DigitalInfluence #StatePropaganda #IslamicCultureAndCommunicationsOrganization #ICCO #IslamicPropagandaOrganization #KhorasanRazavi #IRGC #MultilingualInfluence #Targeting #Amplification #OSINT #WRLD