Three days produced no verified cyber incident in the region, and a stack of old claims dressed as new ones

The clearest example of the recirculation problem is a Morocco World News report on Landfall spyware found on Samsung devices in Morocco and the wider region, with infrastructure overlapping the UAE-linked Stealth Falcon cluster. The story was published on 8 November 2025. The page renders “August 24, 2026” in its furniture. A second example is the Jerusalem Post’s 28 February report that Israel had “plunged Iran into darkness” in the “largest cyberattack in history” — sourced to unnamed “Israeli sources” and “Western intelligence sources,” a claim rather than a documented event, and still moving. The mechanism is not only bad dates. SOCRadar’s Iran–Israel dashboard, refreshed around 25 August, places hacktivist claims and confirmed incidents on the same visual timeline; the entries retrieved from it date to 28 February. CSIS’s significant-incidents tracker had been updated within a day of the sweep, but the entries retrieved were from February.

The one item close to the window remains unconfirmed. Envirotec and Intelligent CISO both reported on 24 August that a cyberattack reportedly linked to Iran had taken a small UK electricity generator offline for four days in July, and that the government had subsequently briefed energy companies on defensive measures. Both trade outlets use “reportedly,” meaning the originating report is elsewhere; this desk did not reach it. There is no named official, no named generator, no regulator statement. Intelligent CISO’s piece is a roundup of vendor comment — Barrier Networks, Illumio, Advania UK, OPSWAT, Orange Cyberdefense, e2e-assure — which is marketing, not corroboration. The interesting question is not the attribution but the calendar: a July outage at a generating asset disclosed in late August, with no accompanying regulatory notice or parliamentary answer identified.

Assessment: A quiet window and an incomplete sweep look identical from the outside, and this one has real gaps: no Persian, Hebrew, Arabic or French searching, no NetBlocks, IODA, OONI or Cloudflare Radar checks, no CISA, NCSC or Israel National Cyber Directorate bulletins. So the absence is reported here as an absence, not as a finding. The wider point stands regardless. The most-cited numbers on this beat are unaudited: the Israel National Cyber Directorate’s Yossi Karadi told the Times of Israel on 29 June that Iranian attacks on Israel rose to 4,800 in June 2026 from 1,600 a year earlier, with no published definition of an attack and no independent corroboration two months on. Undated vendor stats and unmethodologised official ones travel further than either deserves.