A live Iran conflict tracker is still serving March data as September’s picture

SocRadar’s Iran–Israel Cyber Conflict Dashboard presents as a live tracker. Its own footer reads “Map & incident data last updated: March 2026”, with the page “last updated on April 6”. Anyone screenshotting it this week is circulating incident counts that are five to six months old as current posture. The strongest primary document available is the joint advisory AA26-097A, issued by the FBI, CISA, NSA, the Environmental Protection Agency, the Department of Energy and US Cyber Command, which expands manufacturer scope “to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access”. It is marked on CISA’s own page “(New, July 22, 2026)” — two months old. Vendor research carries no dates at all: Halcyon’s page on MuddyWater’s “Operation Olalampo” is undated, and Trellix’s APT34 page describes an Iraq campaign that began in September 2024.

The numbers age the same way. The best attack-volume figure available comes from Brig. Gen. (res.) Yossi Karadi, director general of Israel’s National Cyber Directorate, who told Die Welt in an interview reported by The Times of Israel on 29 June that Israel “recorded 4,800 Iranian attacks this month, up from 1,600 last June”. That is a belligerent’s own cyber authority counting attacks on itself, with no published definition of “attack”, reported at second hand, and it measures June rather than September. The shutdown record is worse: Human Rights Watch on 6 March called on Iran to “immediately end the ongoing internet shutdown”, dating onset to 28 February, while the Freedom Online Coalition’s 4 February statement records a near-total shutdown imposed on 8 January. Georgia Tech’s Amanda Meng, Alberto Dainotti and Zachary Bischof documented a blackout that extended to phones and Starlink. Whether restrictions persist now is not established by anything on file.

Two anniversaries fall inside the weekend and both reliably generate recycled imagery. On 17–18 September 2024, thousands of pagers and hundreds of walkie-talkies intended for Hezbollah detonated across Lebanon and Syria, killing 42 people including 12 civilians and injuring between 3,500 and 4,000. On 17 September 2025, the Cyber Jihad Movement launched a coordinated campaign against its designated targets. Defacement claims and casualty imagery dated 17 September will circulate this week without a year attached.

Assessment: Staleness is not a minor hygiene problem in this field; it is the delivery mechanism. A dashboard interface confers the authority of measurement on data that stopped moving in spring, and a federal seal confers urgency on an advisory that is two months into its life. The result is a threat picture that looks continuously updated and is in fact a composite of March counts, June interviews and 2024 campaigns. Check the datestamp before the claim. The unresolved Iranian shutdown chronology matters most: until NetBlocks, IODA or OONI measurement settles whether January and February were one event or two, no duration figure should be published by anyone.