OSINT/Influence-Operations Package & Iranian Air-Defense Narrative
Source-quality tags used throughout: [VERIFIED] independently documented by ≥2 credible sources; [CORROBORATED] supported by one credible source; [ASSERTED] claimed by the source package, not independently confirmed; [ADVERSARY CLAIM] originating from an Iranian state/aligned actor; [INFERRED] analyst judgment.
EXECUTIVE SUMMARY
The package conflates two distinct real-world conflicts and blends a genuine Western analytical product, an Iranian-aligned propaganda infographic, and a legitimate-but-dual-use amateur radar-modeling tool into a single narrative. The most important finding is that the package’s large numbers — 850+ Tomahawks, 1,000+ JASSM, ~203 “air vehicles,” seven downed US fighters, KC-135 losses — do not correspond to the June 2025 “12-Day War” (Operation Midnight Hammer, in which the US fired only ~30 Tomahawks and dropped 14 GBU-57 MOPs). They correspond to the much larger 2026 Iran War / Operation Epic Fury, a 39-day US-Israeli air-and-missile campaign that began February 28, 2026. Encyclopedia Britannica The user’s own source text mislabels this as a “12-day war,” which is the first and most consequential analytic error to correct, because it would otherwise cascade into every downstream judgment.
The munitions table is a real CSIS product (Cancian & Park, “Last Rounds? Status of Key Munitions at the Iran War Ceasefire,” April 21, 2026), accurately reproduced but stripped of its original strategic framing and recontextualized. The “203 downed” infographic is an Iranian adversary information product that is internally inconsistent and inflates or fabricates kills well beyond independently verified losses. The Polaron tool is a genuine but technically limited line-of-sight terrain-masking calculator authored by an independent, pro-IRGC Iranian “military analysis blogger,” Mohsen Reyhani; it is dual-use and crowd-sources air-defense gap analysis, and the unsigned alpha binary poses a real, if unquantified, supply-chain risk to any Western analyst who runs it.
KEY JUDGMENTS
KJ-1 — High confidence. The package’s munition and aircraft-loss figures refer to the 2026 Iran War (Operation Epic Fury, opened February 28, 2026), not the June 13–24, 2025 “12-Day War.” [VERIFIED] The 2025 US action (Operation Midnight Hammer, June 21–22, 2025) consisted of ~30 submarine-launched Tomahawks against Isfahan and 14 GBU-57 MOPs against Fordow and Natanz — roughly 75 precision-guided munitions total. The 850+ Tomahawk / 1,000+ JASSM figures are documented only for Epic Fury.
KJ-2 — High confidence. The “Estimated Use in the Iran War” munitions table is a genuine CSIS analytical product (Mark F. Cancian and Chris H. Park). Its unit-cost, inventory, and expenditure figures match CSIS’s published numbers almost exactly. It is real analysis — not fabricated — but it has been recontextualized alongside adversary propaganda and divorced from its original warning about US over-extension.
KJ-3 — High confidence. The “203 air vehicles downed” infographic from “خبرگزاری انصار / Ansar News Agency” is an adversary/aligned information product that is internally inconsistent (the KC-135 line “6 total / 5 destroyed / 2 damaged” is arithmetically impossible) and inflates aircraft kills far beyond the 42 US airframes the Congressional Research Service documents as lost or damaged. The specific claim of seven downed US fighters including an F-35 and an F-18 is largely unconfirmed to fabricated: CENTCOM denied all fighter shootdowns; Times of San Diego one F-35A was damaged (not downed) and the F-18 engagement was a near-miss. The Aviationist
KJ-4 — Moderate confidence. “Ansar News Agency” (ansarpress.com) is a Kabul-based Persian/Dari-language outlet, self-described as licensed by Afghanistan’s Ministry of Information and Culture, that presents Iran-sympathetic content; it is not one of Iran’s flagship state agencies (IRNA/Fars/Tasnim). It functions as an amplifier rather than an originator of IRGC narratives. A naming-collision risk exists with other “Ansar”-branded entities; attribution beyond “Iran-sympathetic Persian-language amplifier” is held at moderate confidence.
KJ-5 — High confidence (developer identity); no evidence of state employment. Mohsen Reyhani is an independent Iran-based, self-described “Software Programmer, Military Analysis Blogger” (Tehran) producing pro-IRGC/pro-Russia technical commentary and free OSINT tools. We found no evidence of formal IRGC, defense-industry, or government employment; his work relies entirely on public data (SRTM/GMTED elevation, NASA CEA). His output is dual-use enthusiast/OSINT work, not an insider leak. [CORROBORATED]
KJ-6 — High confidence. Polaron performs geometric line-of-sight / terrain-masking (“radar horizon”) analysis only. It does not model the radar range equation, radar cross-section, atmospheric refraction beyond a simple Earth-curvature constant, multipath, clutter, sidelobes, ECM, or probability of detection. Its colored altitude bands are best read as “lowest altitude at which a target becomes geometrically visible to the radar at a given range/bearing” layers — useful for siting and corridor analysis, but not true detection envelopes. Outputs systematically overstate real coverage because they ignore power-limited range and propagation losses.
KJ-7 — Moderate-to-high confidence. Screenshot 2 (single red footprint, water top-left, lakes, 200 km scale) is consistent with northwestern Iran / the South Caucasus–eastern Anatolia border zone (candidate water bodies: Caspian, Lake Urmia, Lake Van, Lake Sevan; Black Sea is geometrically unlikely at a 200 km scale). Screenshot 1 (multi-band, rugged terrain) is consistent with the Zagros corridor of western/central Iran referenced in the commentary (Hamedan–Isfahan). Precise geolocation cannot be confirmed from the textual descriptions alone. [INFERRED]
KJ-8 — Moderate confidence. The apparent contradiction in the package — a regime claim of massive Western losses vs. a candid Iranian-analyst admission that airspace is “almost safe for cruise missiles” (~3% interception) — most likely reflects an authentic internal Iranian technical-community divergence (practitioner realism vs. state triumphalism), subsequently juxtaposed by the user’s collecting channel. A coordinated reflexive-control deception is a less likely but non-trivial alternative (see ACH, Task F).
KJ-9 — Moderate confidence. The crowd-sourced gap analysis (Polaron + commentary naming the Subashi/Hamedan radar, Tehran/Isfahan S-300 sites, and low-altitude corridors) is more useful as a defensive self-diagnosis tool for Iran than as a novel targeting aid for an adversary, because the US/Israel already demonstrably hold this targeting knowledge (Subashi was struck; S-300 engagement radars were destroyed). Its principal counterintelligence value is as a window into Iranian internal threat perception.
DETAILS BY TASK
A. Ground truth — which war, and are the numbers real?
Two conflicts must be separated:
- June 2025 “12-Day War” (June 13–24, 2025): Israeli Operation Rising Lion plus US Operation Midnight Hammer (June 21–22, 2025). The US action was a single strike: per the DoD/CJCS briefing by Gen. Dan Caine, “a submarine also fired 30 Tomahawk missiles” at Isfahan and “a total of 14 MOPs” (GBU-57A/B) were dropped on Fordow and Natanz, within “approximately 75 precision-guided munitions” overall. [VERIFIED] The US fired ~30 Tomahawks, not 850+. F-35/F-22 entered airspace as decoys; no US fighter was lost.
- 2026 Iran War / Operation Epic Fury (began February 28, 2026; Israeli side “Operation Roaring Lion”): per CSIS (Cancian & Park, “Last Rounds?”, April 21, 2026), “in the 39 days of the air and missile campaign before the ceasefire, U.S. forces heavily used the seven munitions.” This is the conflict the package’s numbers actually describe. [VERIFIED]
The package’s figures mapped to ground truth:
- 850+ Tomahawks / 1,000+ JASSM — [VERIFIED for Epic Fury]. Per CSIS via Small Wars Journal: “The Navy launched over 850 TLAMs in the war’s first month. TLAMs continued to be expended until the ceasefire, bringing their total use to over 1,000.” These are real Epic Fury figures, not 2025.
- ~203 “air vehicles” downed (Iranian claim) — [ADVERSARY CLAIM, inflated]. Independently documented US losses: the CRS report (May 13, 2026) lists exactly 42 airframes — 24 MQ-9 Reapers, 7 KC-135 Stratotankers, 4 F-15E Strike Eagles, 2 MC-130J Commando II, and one each of E-3 Sentry, F-35A Lightning II, A-10 Thunderbolt II, HH-60W Jolly Green II, and MQ-4C Triton; FlightGlobal adds “between two and four” MH-6 Little Birds (raising the tally to ~44–46). “203” appears to conflate disparate tallies — notably, Qatar was reportedly targeted by “203 missiles,” a plausible source of numerical contamination.
- 131 drones downed — [PARTIALLY PLAUSIBLE]. Many Israeli Hermes-900/450 and IAI Eitan/Heron drones were genuinely downed, and ~12–24 US MQ-9 losses are documented. The composition list (MQ-9, Hermes 900, Hermes 450, Orbiter-4, “Lucas”) mixes plausible and garbled entries; the aggregate 131 is likely inflated but not wholly fabricated.
- 56 cruise missiles “downed” — [ADVERSARY CLAIM]. Used in the commentary to derive the “3% interception” figure against 850+ TLAM + 1,000+ JASSM.
- 7 fighters incl. F-35, F-15, F-16, F-18 — [LARGELY UNCONFIRMED/FABRICATED]. CENTCOM: “No U.S. fighter aircraft have been shot down by Iran.” One F-35A took Iranian ground fire over Iran on March 19 and returned to base (damaged, not downed). The F-18 Chabahar event (March 25, 2026) was independently assessed as a near-miss/MANPADS. Of 4 F-15Es lost, three were destroyed by friendly fire from Kuwaiti air defenses over Kuwait and one to Iranian fire (April 3, 2026). Notably, the F-18 entry is theater-appropriate for Epic Fury (carrier operations from USS Abraham Lincoln) — contradicting the user’s note that an F-18 is “unusual for this theater.”
- 1 helicopter (Black Hawk) — [PLAUSIBLE]. A US Army UH-60 was damaged at Camp Victory, Baghdad (March 23, 2026); an HH-60W was damaged during the CSAR mission.
- KC-135 line “6/5/2” — [INTERNALLY INCONSISTENT]. CRS documents 7 KC-135 affected: per Military Times, “A KC-135…went down over western Iraq on March 12…killing all six aircrew…not the result of hostile or friendly fire,” Military Times and “Iranian missiles and drones struck Prince Sultan Air Base, Saudi Arabia, damaging five more KC-135s on the ground and bringing total tanker losses to seven.” The infographic’s “6 total / 5 destroyed / 2 damaged” is arithmetically impossible and is itself evidence of careless propaganda assembly.
Bottom line (A): The package’s strike-volume numbers are real (Epic Fury, sourced to CSIS). The Iranian kill claims are inflated-to-fabricated. The “12-day war” label is wrong; this is the 2026 war.
B. Source & attribution analysis
Munitions table = genuine CSIS analysis. The table’s seven systems and figures map precisely onto CSIS “Last Rounds?” (April 21, 2026): Tomahawk $2.6M / 3,100 inv / 850+ used; JASSM $2.6M / 4,400 / 1,000+; PrSM $1.6M / 90 / 40–70; SM-3 $28.7M / 410 / 130–250; SM-6 $5.3M / 1,160 / 190–370; THAAD $15.5M / 360 / 190–290; Patriot $3.9M / 2,330 / 1,060–1,430. [VERIFIED] CSIS’s purpose was the opposite of the propaganda use: to warn that depletion creates a “window of vulnerability” for a future Western Pacific/China conflict — not to celebrate Iranian success. A Russian outlet (news-pravda, attributed to Elena Panina) had already recontextualized the same table to claim US “air superiority over Iran was not achieved,” demonstrating a documented adversary-recontextualization pathway. Assessment: an authentic Western think-tank product weaponized as propaganda by stripping its strategic framing.
“Ansar News Agency” (خبرگزاری انصار / ansarpress.com). [CORROBORATED] A Kabul-based Persian/Dari outlet, self-described as licensed by Afghanistan’s Ministry of Information/Culture, covering Afghanistan/Iran/world news and claiming to be “free, independent, impartial.” Content sampling shows Iran-sympathetic, anti-US framing. It is not a flagship Iranian state agency (contrast IRNA, the official state agency, and Fars/Tasnim, the IRGC-linked agencies). Assessment: an Iran-sympathetic regional amplifier, not an IRGC organ; treat its infographics as aligned/adversary content of lower production discipline — consistent with the arithmetic errors observed. Naming-collision caveat noted.
C. Mohsen Reyhani & Polaron — developer/tool assessment
Developer. [CORROBORATED] Self-described on LinkedIn (ir.linkedin.com/in/mohsen-reyhani-68b475309) as “Software Programmer, Military Analysis Blogger,” based in Iran (Tehran). He runs mreyhani.wordpress.com and the Telegram channel “Exciton_missile_program.” No formal IRGC, defense-industry, or government affiliation was found. A possible but unconfirmed academic match is a physics graduate student at the Islamic Azad University of Mashhad (common-name caveat). His blog inventory (2023–2025) shows a mix of neutral technical tool releases and clearly pro-IRGC/pro-Russia strategic commentary: e.g., “Why are the Islamic Republic’s ballistic missiles so important to Israel?” (Dec 26, 2025); “Saturation attack: An analysis of IRGC mass drone attacks on Israel” (Aug 30, 2024); “Why is it important for Russia to destroy the Patriot system in Ukraine?” (May 29, 2023). He frames the Exciton software as “free software… helpful for researchers in the field of OSINT,” “experimental,” and not “the most accurate.” Related tools: the Exciton Missile Program (ballistic/artillery/free-fall trajectory → KML) and a “Cruise Missile Control” / “LOS Software” lineage.
Tool legitimacy/sophistication. Polaron is a real, functioning Windows program (Wine-compatible on Linux): it ingests GeoTIFF SRTM/GMTED elevation (≤400 MB) — the blog’s own sample images are GMTED2010 tiles — models Earth curvature, computes LOS coverage for 1–4 target altitudes simultaneously, and outputs KML for Google Earth. This is a competent amateur geospatial engineering effort — modest but real, not classified-grade radar modeling.
Dual-use verdict. [INFERRED] The tool plus commentary constitute crowd-sourced air-defense gap analysis. Offensively it could help an attacker visualize terrain-masked low-altitude ingress corridors; defensively it helps Iranian analysts identify and remediate their own coverage holes. Given that the US/Israel already possess vastly superior classified terrain/radar-masking tools and have already struck the named sites, the marginal offensive value to a peer adversary is low; the higher-value signal is what it reveals about Iranian internal threat perception and self-identified weaknesses.
D. Technical capability assessment of Polaron
What LOS/terrain-masking modeling CAN do: identify terrain horizon and masking; show where ground relief blocks a radar’s line of sight to a target at a given altitude; support radar-siting trade-offs (placement to minimize terrain shadow); identify low-altitude “blind” corridors created by ridgelines; and approximate the radar horizon including Earth-curvature (typically a 4/3-Earth or true-geometric model). The multi-altitude colored bands should be read as “minimum target altitude visible vs. range/azimuth” layers — the lower the altitude still illuminated at a bearing, the better the low-level coverage there.
What it CANNOT do (flag in any downstream product): it does not model the radar range equation (power, antenna gain, frequency, receiver sensitivity → maximum power-limited range); radar cross-section of specific targets; atmospheric refraction beyond a simple curvature constant (no ducting, sub-/super-refraction); multipath, ground clutter, or sidelobes; ECM/jamming; or probability-of-detection / false-alarm tradeoffs. Its outputs are therefore geometric visibility maps, not detection envelopes, and they systematically overstate real coverage, because a target can be geometrically “visible” yet far beyond the radar’s energy range or buried in clutter. For penetration planning, terrain-masking maps are necessary but not sufficient; for siting, they are a legitimate first-order screening tool. Professional radar-coverage tools (e.g., commercial products from Cambridge Pixel; military Parabolic-Equation-Model codes) add precisely the propagation physics Polaron omits.
E. Geolocation
- Screenshot 2 (single red footprint; water top-left; mountainous; lakes; 200 km scale): [INFERRED, moderate-to-high] Consistent with northwestern Iran / South Caucasus–eastern Anatolia. At a 200 km scale, “Black Sea top-left” is geometrically unlikely from an Iranian radar site; more probable water bodies are the Caspian (N/NE), Lake Urmia, Lake Van, and Lake Sevan. A radar sited near the NW border (Tabriz/Urmia axis) fits.
- Screenshot 1 (multi-altitude bands; rugged terrain): [INFERRED] Consistent with the Zagros corridor of western/central Iran — the Hamedan–Isfahan axis named in the commentary. The “4081 m” peak is plausible for high Zagros summits (note: Mt. Damavand, ~5,610 m, lies in the Alborz, not this corridor; the Zagros holds numerous 4,000 m+ peaks such as Zard-Kuh, ~4,221 m).
- “Subashi, Hamedan”: [VERIFIED as a real site] Per TRT World, “the Subashi radar site, one of Iran’s most important radar centres in the country’s western Hamedan province,” TRT World is Iran’s westernmost air-defense radar near the Iraqi border; it was struck in Israel’s opening strikes. This firmly anchors the commentary’s western-corridor focus to a genuine, already-targeted facility.
- Tehran/Isfahan S-300 sites: [VERIFIED] Open-source satellite analysis (Arms Control Wonk; Planet Labs/Airbus imagery, February 2026) confirms repositioned S-300 launchers near Tehran and Isfahan with fire-control radars notably absent — consistent with the commentary’s premise of degraded coverage.
F. Influence-operation / narrative assessment — Analysis of Competing Hypotheses
The artifacts and their audiences:
- Infographic (203 downed): mass domestic + regional Arabic/Persian audience; intent = morale, deterrence signaling, “we bloodied a superpower.”
- CSIS table: originally Western policymakers; repurposed for a strategic/insider audience to argue “the US is overextended and depleted.”
- Reyhani/practitioner commentary: niche Iranian technical/defense community; intent = candid problem-identification (“airspace almost safe for cruise missiles,” ~3% interception).
The apparent contradiction: triumphalist regime claim vs. candid admission of near-total air-defense failure. Competing hypotheses:
- H1 — Authentic internal divergence (MOST LIKELY; moderate confidence). The infographic is regime/aligned morale propaganda; the Reyhani-type analysis is genuine practitioner realism. Iran’s technical community has a documented record of candid self-criticism — e.g., per FPRI’s “Shallow Ramparts” (October 2025), Artesh deputy of operations Mahmoud Mousavi stated: “Some of our air defences were damaged, this is not something we can hide, but our colleagues have used domestic resources and replaced them with pre-arranged systems that were stored in suitable locations.” Foreign Policy Research Institute The two registers simply coexist; the user’s channel juxtaposed them. Supporting evidence: the infographic’s sloppy arithmetic (KC-135 line) is inconsistent with a disciplined coordinated operation; Reyhani is an independent blogger, not a state mouthpiece.
- H2 — Reflexive-control / weakness-signaling (low-to-moderate confidence; cannot be excluded). Iran amplifies candid “we are vulnerable to cruise missiles” messaging to (a) justify large air-defense procurement (domestic budget politics), (b) bait adversaries into predictable strike patterns, or (c) manage domestic expectations ahead of further strikes — while the simultaneous “we downed 203” provides face-saving cover.
- H3 — Hostile/third-party assembly (low confidence). The juxtaposition is the work of an anti-regime or foreign actor assembling Iranian artifacts to expose regime mendacity (the triumphalism is provably false beside the admission). The package’s analytic framing suits an adversary-of-Iran narrative; this depends on the user’s collecting channel, which is unknown to us.
Reflexive-control note: Regardless of which hypothesis holds, candid admissions of air-defense weakness objectively serve Iranian procurement and deterrence-management interests, so even authentic practitioner analysis is functionally exploitable by the regime.
G. Risk & maliciousness / OPSEC
Counterintelligence value of the crowd-sourced gap analysis: [INFERRED] LOW-to-MODERATE marginal targeting value to a peer adversary. The US/Israel have already demonstrated they hold this knowledge — Subashi was struck, and S-300 engagement radars were destroyed in 2024 and again in 2026, with low-altitude/IR-guided engagements observed throughout. The analysis is more valuable as (1) a window into Iranian self-perceived weaknesses (collection value to all parties) and (2) a genuine remediation aid for Iran. Who benefits most: Iran defensively, and any analyst seeking to understand Iranian internal threat assessment. It is not a decisive offensive enabler.
Binary/supply-chain risk to a Western analyst: [INFERRED — elevated caution warranted] Running an unsigned alpha-stage Windows executable (.rar from Google Drive) authored by a pro-IRGC Iranian blogger is a non-trivial risk. Multiple 2025–2026 campaigns (Google/Mandiant on UNC1549; Symantec on Seedworm/MOIS; Morphisec; SentinelLABS) document Iranian-nexus actors delivering malware via RAR archives on cloud storage (Google Drive, OneHub), double-extension tricks, and DLL search-order hijacking, specifically targeting defense/aerospace/OSINT professionals. There is no specific evidence Polaron is malicious, but the threat pattern is an exact match. Treat the binary as untrusted (see Recommendations).
INTELLIGENCE GAPS & COLLECTION PRIORITIES
- Provenance of the package itself — which channel assembled these artifacts, and with what framing? (Decisive for H1 vs. H3.) Priority: HIGH.
- Static/dynamic malware analysis of “Polaron Radar Coverage_0.2.0 Alpha_x64.rar” in an isolated sandbox — hashes, network callbacks, signing status, persistence behavior. Priority: HIGH.
- Definitive identity resolution of Mohsen Reyhani — confirm or deny the Islamic Azad University Mashhad physics link and any defense-industry ties. Priority: MEDIUM.
- Exact provenance of the infographic — is “Ansar News Agency” the originator or a re-poster of an IRGC/Tasnim graphic? Priority: MEDIUM.
- Geolocation confirmation of the two screenshots via the actual KML coordinates / “Radar(P)” label, if the files are obtainable. Priority: MEDIUM.
- Verification of the “3% cruise-missile interception” claim against higher-fidelity battle-damage data. Priority: LOW-MEDIUM.
RECOMMENDATIONS
Immediate (0–7 days):
- Do NOT execute the Polaron binary on any production or internet-connected system. If analysis is required, detonate it in an isolated, monitored VM with no credentials and full network capture; compute hashes and submit to multi-engine plus behavioral analysis. Threshold to revise: a clean, reproducible build from published source plus an independent code review would downgrade the risk.
- Re-label the package internally to correct the “12-day war” error: tag all high-volume munition and loss figures as Operation Epic Fury (2026), not the 2025 12-Day War. This single correction prevents cascading analytic error.
- Tag the CSIS table as genuine-but-recontextualized in any downstream product; cite CSIS directly and restore its original “window of vulnerability vs. China” framing to neutralize the propaganda spin.
Short-term (1–4 weeks):
- Treat the “203 downed / 7 fighters / F-35” claims as adversary information operations; in any reporting, pair each claim with the CRS/CENTCOM ground truth (42 airframes lost/damaged; no confirmed fighter shootdowns; one F-35A damaged).
- Pursue collection priorities 1–2: commission the malware detonation and the package-provenance trace.
Ongoing:
- Use the package as a case study in adversary recontextualization (genuine Western analysis + aligned propaganda + dual-use open-source software) and in practitioner-vs-regime narrative divergence for analyst training.
- Maintain a watch on Reyhani’s blog and Telegram as an open indicator of Iranian internal air-defense threat perception; treat new “gap analyses” as collection-relevant sentiment, not as targeting product.
CAVEATS
- This assessment is built entirely on OSINT; several key artifacts (the infographic image, the two screenshots, the binary) were described by the user but not directly examined by us.
- The “Ansar News Agency” attribution carries a naming-collision risk; our characterization is held at moderate confidence.
- The Reyhani academic/affiliation details are partly unconfirmed (common Iranian name).
- The 2026 Iran War is an ongoing, fast-moving event; loss tallies (CRS “42, subject to revision”) and munition figures (CSIS estimates derived from budget documents, not classified counts) will continue to be updated. Several figures rest on think-tank estimation methodologies rather than official disclosures and should be treated as best-available rather than definitive.
- Where Iranian sources are the sole origin of a claim (interception rates, specific kills), we have flagged them as adversary claims and have not treated them as established fact.
