Full Report
Between January and June 2026, Tehran survived unprecedented military, economic, and political pressure by relying on its longstanding hybrid warfare model: blending asymmetric military operations, cyber operations, information warfare, proxy attacks, and coercive state control. Artificial intelligence (AI) enhanced these capabilities, acting as a force multiplier and almost certainly increasing the speed, scale, and effectiveness…
Analysis Summary
# Threat Actor: Iranian State-Sponsored High-Threat Groups (Tehran)
## Attribution & Identity
- **Name:** Tehran / Iranian State Threats
- **Identity:** State-sponsored actors including military, intelligence services, and government-backed proxy groups.
- **Internal Associations:** Domestic surveillance entities and the Iranian regime.
- **External Associations:** Strategic collaboration with **Russia**, particularly regarding military technology and AI-enabled tactics refined in the Ukraine theater.
## Activity Summary
Between January and June 2026, Iranian threat actors engaged in a large-scale hybrid warfare campaign to counter unprecedented military and economic pressure. Key operations included:
- **Projected 2026 Conflict:** A surge in cyber and asymmetric operations to survive political pressure.
- **Information Operations:** Rapid production and dissemination of AI-generated propaganda to influence Western and regional narratives.
- **Domestic Suppression:** The "January 2026" violent suppression of unrest, utilizing AI-driven domestic surveillance.
- **Kinetic-Cyber Blending:** Integration of drone attacks with cyber-offensive operations.
## Tactics, Techniques & Procedures
- **AI-Enhanced Asymmetric Warfare:** Using AI as a force multiplier to increase the speed and scale of traditional attacks.
- **Information Warfare:** Accelerated production of propaganda and influence narratives using generative AI.
- **Coercive State Control:** Deployment of AI-driven surveillance systems for domestic monitoring and suppression of dissent.
- **Hybrid Operations:** Blending asymmetric military operations, cyberattacks, and proxy-led activities to maintain deniability.
- **Cyber-Enabled Economic Pressure:** Using scalable, low-cost cyber tools to compensate for conventional military disadvantages.
- **Drone Operations:** AI-enabled tactics for autonomous or semi-autonomous drone strikes, likely derived from Russian field experience.
## Targeting
- **Sectors:**
- Critical Infrastructure (Western and Regional)
- Vital Industries
- Maritime Logistics
- Government and State Entities
- Corporate Sector (Targeted via influence operations)
- **Geography:**
- Israel
- Persian Gulf States
- United States
- Western Europe
- **Victims:** Corporate and state entities sensitive to trust-based influence; domestic protestors within Iran.
## Tools & Infrastructure
- **AI-Driven Surveillance Systems:** Used for facial recognition and domestic monitoring.
- **Russian-backed Drones:** Advanced Unmanned Aerial Vehicles (UAVs) incorporating AI-enabled capabilities.
- **Generative AI Platforms:** Tools used for the creation of deepfakes and automated propaganda.
- **Deniable Proxy Infrastructure:** (Specific C2/IPs not listed in text; Infrastructure is noted as "harder to attribute").
## Implications
- **Strategic Resilience:** Iran has proven that its power relies on an "asymmetric playbook" rather than advanced conventional labs; AI merely makes their existing disruption tactics more efficient.
- **Erosion of Trust:** Targeted influence operations pose a high risk to citizen and customer trust in Western institutions.
- **Infrastructure Risk:** Heightened risk of physical damage to maritime logistics and regional infrastructure through AI-enhanced drone and cyber integration.
## Mitigations
- **Build Resilience:** Organizations must prepare for "harder to attribute" threats that blend digital and physical vectors.
- **AI-Defense:** Implementation of AI-driven detection tools to identify generative propaganda and synthetic media.
- **Critical Infrastructure Hardening:** Specific focus on securing industrial control systems against low-cost, high-frequency asymmetric cyberattacks.
- **Regional Collaboration:** Increased intelligence sharing between Western and Persian Gulf partners to track the proliferation of Russian-Iranian drone tactics.