Loading story…
Human Rights Watch said the February 28 strike on Shajareh Tayyebeh Primary School in Minab, Iran, was likely unlawful and should be investigated as a possible war crime. The school stood within an IRGC Naval Forces compound perimeter but was separated by walls and had its own street entrance; HRW found no evidence that it was used for military purposes. Its review of imagery and footage indicated that accurate guided munitions struck the school during class hours, killing numerous children. Iranian state media put the broader death toll at 168, a figure HRW could not independently confirm, while the United States said it was investigating and Israel said it was unaware of strikes in the area.
Subsequent reporting cited by Techdirt alleged that US Central Command relied excessively on Palantir's Maven Smart System after stale intelligence incorrectly classified the school as an IRGC facility, causing it to be recommended as a first-day target. The reporting also attributed the failure to detect or prevent civilian harm to reduced Pentagon civilian-protection capacity and Central Command's decision not to route the target through its remaining civilian-harm review team. Palantir denied responsibility, stating that its software neither supplied the underlying intelligence nor identified deficiencies in it, and that there was no evidence Maven was at fault.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
US Defense Secretary Pete Hegseth said the United States was investigating the Minab school attack. Iranian state media also reported that the death toll had risen to 168, a figure Human Rights Watch could not independently verify.
The Special Governor's Office of Minab County circulated a list of 57 names following the school strike. Human Rights Watch assessed that at least 48 of the listed people appeared to be children, and the list included the apparent principal and several teachers.
During broader US and Israeli attacks across Iran, guided munitions struck the school and other structures in the IRGC Naval Forces compound in Minab while classes were in session. HRW found no evidence that the school itself was being used for military purposes.
Iranian state media reported that Major General Hossein Salami inaugurated the Shaheed Absalan Specialist Clinic, an IRGC Naval Force medical clinic within the compound containing the school.
By August 2017, satellite imagery showed the front of the school cleared and soccer-pitch markings added to its courtyard, evidence that the site was identifiable as a school rather than solely a military facility.
Satellite imagery reviewed by Human Rights Watch indicated that an inner wall and separate street entrance physically separating Shajareh Tayyebeh Primary School from the surrounding IRGC Naval Forces compound were created during 2016.
Reporting cited by Techdirt said some Central Command personnel over-relied on Maven to identify stale or inconsistent intelligence, while no civilian-harm mitigation team member reviewed the Minab site before the strike. Palantir said it was not responsible for the underlying intelligence data and that there was no evidence Maven was at fault.
Human Rights Watch's review of videos, photographs, witness-source accounts, and satellite imagery concluded that the strike was likely unlawful and should be investigated as a possible war crime. It found multiple buildings in the compound had been accurately struck and criticized Iran's internet shutdown for hindering documentation of the attack.
According to reporting cited by Techdirt, the site retained an incorrect IRGC-facility classification, was submitted to Palantir's Maven Smart System, and became a recommended day-one target. The source did not provide a specific date for this targeting-process event.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigators suspect Iran or Iranian-aligned actors used commercial advertising data and vulnerable cellular infrastructure to help locate U.S. military personnel during the recent Iran-U.S. conflict. Reporting cited by multiple sources says troops moved from bases into hotels and civilian buildings in locations including Iraqi Kurdistan and Bahrain, where repeated mobile app bid requests may have exposed device identifiers and precise movement patterns through real-time bidding systems. Researchers said social media, human sources, and telecom signaling data were also likely part of the targeting picture, although attribution for specific strikes or attacks remains unconfirmed. Citizen Lab said the activity reflects a long-running weakness in global mobile networks, where **SS7-style** attacks and broader telecom interconnect abuse can still be used to track phones despite years of warnings. The combined reporting underscores that commercially available location data and insecure carrier infrastructure can create a persistent intelligence exposure for deployed personnel, allowing state actors and surveillance vendors to identify, monitor, and potentially target sensitive movements outside traditional military facilities.
Jul 24, 2026
Iran experienced a near-total **internet blackout** affecting roughly **90 million** people, with monitoring indicating about a **99% drop in outbound traffic** and only limited, likely **whitelisted** connectivity remaining for government, military, and select elites. Reporting indicated the shutdown followed **US and Israeli strikes on February 28** that killed Iran’s Supreme Leader **Ali Khamenei**, and that the state continued to route domestic activity through its *National Information Network (NIN)*, keeping access to local services while cutting off most access to the global internet; common circumvention methods (e.g., VPNs/proxies) were described as largely ineffective during a full shutdown, with a small number of external links reportedly available via **Starlink** gateways. Separate open-source reporting using **Planet Labs PlanetScope** satellite imagery documented damage consistent with strikes on **Iranian police stations**, alongside broader attacks on military infrastructure and significant reported casualties. The combined picture is of escalating kinetic conflict and internal security pressure coinciding with severe communications restrictions that constrain independent reporting, disrupt civilian and business connectivity, and centralize information flow through state-controlled networks.
Jun 29, 2026
A coordinated influence operation, codenamed PRISONBREAK, was uncovered by Citizen Lab and Clemson University researchers, revealing the use of artificial intelligence to incite unrest in Iran. The operation involved a network of over 50 inauthentic accounts on the social media platform X, which were created in 2023 but became active primarily in 2025. These accounts systematically disseminated AI-generated imagery, deepfake videos, and fabricated news content designed to encourage Iranian citizens to revolt against the Islamic Republic. The campaign's activity was closely synchronized with real-world military actions, notably the Israeli Defense Forces' strikes against Iranian targets in June 2025. Researchers found that the operation mimicked legitimate news outlets to lend credibility to its disinformation, and some posts achieved tens of thousands of views, despite overall limited organic engagement. The PRISONBREAK network targeted large public communities on X and may have paid to promote its content, amplifying its reach within Iranian online spaces. After evaluating alternative explanations, Citizen Lab concluded that the most plausible scenario is that an unidentified Israeli government agency, or a closely supervised contractor, orchestrated the campaign. The operation's primary objective was to destabilize the Iranian regime by leveraging advanced AI tools to manipulate public opinion and sow discord. The campaign's timing and messaging were at least partially coordinated with Israeli military operations, suggesting a hybrid approach combining kinetic and information warfare. The use of AI-generated content marks a significant evolution in influence operations, enabling more convincing and scalable disinformation efforts. While the campaign's direct impact on Iranian society appears limited, its ability to reach large audiences and its sophisticated use of technology raise concerns about future state-sponsored influence operations. The PRISONBREAK case highlights the growing intersection of geopolitical conflict, artificial intelligence, and social media manipulation. Researchers emphasize the importance of monitoring such operations, as they represent a new frontier in psychological and information warfare. The findings underscore the need for robust detection and mitigation strategies to counter AI-enabled disinformation campaigns targeting vulnerable populations during periods of geopolitical tension.
Jun 29, 2026