Ahead of the February 28 strikes, Turkey joined several Arab states in offering to mediate a “diplomatic solution” between Washington and Tehran. The proposed
framework would have capped uranium enrichment, limited ballistic missile development, and paused weapons transfers to proxy groups. Notably, it would not have dismantled Iran’s nuclear infrastructure nor addressed the regime’s domestic repression. Instead, it would have preserved regime stability — enabling Tehran to weather external pressure and potentially outlast the Trump administration.
Turkey’s Refusal To Support U.S. Action
Ankara has made clear it will not assist U.S. efforts to dismantle the Islamic Republic. Turkey has reportedly
denied U.S. forces access to its air, land, and maritime space for operations against Iran and declined broader logistical cooperation. This posture is in profound tension with Turkey’s status as a NATO member and a purported U.S. strategic ally.
As strikes hit Tehran on Saturday morning, millions of Iranians got a strange push notification on their phones. The BadeSaba Calendar
prayer app, which has more than 5 million downloads, had been compromised, and the app issued alerts saying, “Help has arrived!” and called for a “People’s Army” to defend their “Iranian brothers,” according to an assessment from cyber intel firm Flashpoint. On Sunday, the app sent with surrender instructions for rank-and-file members of the Islamic Revolutionary Guard and safe locations for protesters to gather.
Then regime loyalists quickly struck back.
According to Flashpoint, what followed on Sunday was the “most aggressive” use so far of what’s known as Iran’s “Great Epic” cyber campaign, which is a loosely coordinated group of cyber operatives under a channel called the “Cyber Islamic Resistance.” Under the group’s umbrella, various cyber attackers have shut down gas
stations in
Jordan, and led attacks against U.S. and Israeli military providers to destroy data as well as conduct psychological operations mimicking the BadeSaba
hack.
The next 48 hours are likely to be a period of “extreme volatility” where hacktivists and proxies “take the lead in escalation to fill the vacuum left by Tehran’s central command,” Flashpoint noted in an update. These actors are allegedly using Telegram and Reddit as a coordination hub, posting screenshots of alleged attacks as proof, although it takes weeks and sometimes months to verify accuracy, said Kathryn Raines, a former NSA expert who is now a threat intel team lead at Flashpoint.
The bigger threat to U.S. companies may not be a data breach, but a coordinated campaign designed to make your employees stop trusting everything they see and hear.
fortune.com