‘Wait for death’: Inside Iran’s psychological war against its enemies

By Mostafa Salem, CNN

(CNN) — “You must report immediately in case of any security incident,” read a text message sent to phones in the United Arab Emirates from “MOI” during the Iran war. But the country’s Ministry of Interior never sent such an alert. It later cautioned residents against acting on the “fake” message.

In a country that bore the brunt of Iranian attacks as Tehran retaliated against Israel and the United States, authorities say the nation also faced barrages of a more insidious nature.

The UAE had already noticed a sharp spike in cyberattacks weeks before the war, Mohamed Al Kuwaiti, the head of cybersecurity for the UAE Government, told state media last month. In the early days of the war, he said, cyber-attacks from Iranian proxies grew to 500,000 a day, mostly targeting critical infrastructure

“After the (war began) the internet was cut (in Iran) yet their proxies continued (attacking us) from…outside of Iran,” he said. “Many people received phishing emails asking people to click on links…which began as data gathering and then transformed to become destructive.”

During the war, Iran and its proxies launched thousands of missiles and drones at as many as 12 American-allied states in retaliation against US-Israeli strikes on its territory. But it’s on the less visible front – the psychological and information war – where Tehran has had an outsized impact.

Threatening text messages purporting be from Iran’s Revolutionary Guards told Israelis to “wait for death” as evacuation orders – mimicking the Israeli military’s controversial style used in Gaza and Lebanon – urged civilians near critical infrastructure and major residential neighborhoods in Gulf Arab states to leave.

Attacks on web servers early March disrupted banking systems in the United Arab Emirates and Bahrain, halting financial transactions and everyday banking activities. Iran’s Revolutionary Guards announced a hit list of American companies and universities operating in the Middle East – including Meta, Oracle, Nvidia, Microsoft, and Google – forcing many to ask staff to work from home.

Paolo Napolitano, associate director at Dragonfly from Dow Jones, a geopolitical and security risk firm based in London, said that cyber operations and influence campaigns are now an integral part of modern warfare, and Iran as well as Iran-linked actors made extensive use of these during the conflict with the US and Israel.

The economic opportunities in countries like Saudi Arabia, Qatar and the UAE have long attracted foreign businesses seeking access to lucrative markets, capital and low taxes. Global talent has flocked to the nations that have for decades been seen as islands of stability in a volatile region.

Iran’s campaign takes aim at this carefully cultivated image, aiming to inflict reputational damage – even if the physical damage is minimal.

“Iran was under no illusion that it would be able to defeat the US and Israeli militaries conventionally and so has probably for several years been preparing such methods for such a conflict.” Napolitano said.

In Jordan, Iran-linked groups launched cyber attacks aimed at manipulating the storage temperatures of wheat reserves to damage strategic stockpiles in a country already suffering economically, Jordanian National Cybersecurity Center reported in early March.

After reports emerged that Iran was hacking into CCTV cameras and home security cameras, officials asked residents to change their passwords.

“Iranian hackers have been trying to access surveillance footage from cameras in Israel and the Gulf countries since the start of the war,” said Seyoung Jeon, lead cyber analyst at Dragonfly. “This seems to be to support its air strikes, by helping them to more accurately identify target locations or to assess damage from missile strikes.”

Hundreds of miles away from the Persian Gulf, Israelis received ominous messages on their phones too.

“Thousands of Palestinian children died because of you. You and your family are a target for us. Wait for death,” one message in Hebrew sent to Israeli phones read, signed by the Revolutionary Guards.

Controlling the flow of information

For weeks ahead of the war, Tehran warned that any strike on its soil would trigger retaliation against Washington’s regional allies. As speculation about an imminent attack intensified following the deployment of US warships to the region, a pro-Iran X account called “Iran Military Media” – often mistaken for the military’s official account – posted an image of Dubai’s Burj Khalifa, the world’s tallest tower, with no caption. The veiled threat to the city left many residents concerned.

In the hours after the first US-Israeli strikes on Tehran on February 28, Iran made good on its threats.

Hundreds of projectiles were fired at cities that were known as some of the world’s safest, in what a senior UAE official, Anwar Gargash, described as “the worst-case scenario.” Even as the attacks targeted US bases, the Revolutionary Guards struck civilian targets including hotels in Dubai, residential high-rises in Bahrain, gas facilities in Qatar, and airports in Kuwait.

As information and disinformation spread about the extent of the damage caused by Iran’s strikes, Gulf Arab governments rushed to control the narrative. Dozens of people were arrested in the UAE for filming interceptions or sharing videos deemed inappropriate.

In Kuwait, Ahmed Shihab-Eldin, a prominent Kuwaiti-American journalist was detained after sharing videos related to the Iran war and in Qatar more than 300 people were arrested for “photographing, sharing and publishing misleading information.”

In the following days, the tactic appeared to be working. Residents began self-censoring in private chats and deleting posts out of fear of reprisal. Even journalists working for some Western news outlets in the region began taking precautions, avoiding bylines on news stories and photos.

Rise in cyberattacks

Iran-linked hackers have struck targets far beyond the reach of its missiles, causing disruptions at multiple US oil, gas and water sites in recent weeks, according to a US advisory and three sources familiar with the investigation. The hacks have caused some industrial processes at the sites to shut down, forcing them to operate manually, the sources said.

Tehran-linked hackers last month leaked emails stolen from the private account of FBI Director Kash Patel. Before that, they disrupted business for a major US medical device maker.

The same hackers claimed responsibility for breaching the personal devices and accounts of former Israel military Chief of Staff Herzi Halevi. The group released dozens of photos and identification documents as proof of the breach.

The cyber activity often has a psychological component. Iranian hackers boasted online of the hacks against Patel and the medical device maker while exaggerating their impact.

Still, experts say that Iran’s blocking of foreign internet services at home has also limited the intensity of cyber attacks across the region.

“We are seeing geopolitical tensions spill into cyberspace in more organized, sustained, strategic, and publicized ways than ever before,” Andy Piazza, senior director of threat intelligence at Unit 42 in Palo Alto Networks told CNN.

But while the Islamic Republic has a “proven capability for highly sophisticated, multi-pronged cyber campaigns,” initial cyber activity was “significantly hindered because domestic internet connectivity dropped to between one and four percent following the initial conflict,” Piazza added.

The effectiveness of Iran’s asymmetric campaigns is difficult to determine but a key objective was definitely achieved, Napolitano said.

“The primary aim of these campaigns is to diffuse fear and amplify uncertainty in the Gulf, thereby demonstrating that local authorities are unable to address threats coming from Iran,” he added.

The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.