Most of this week’s Iran cyber traffic is recycled, some of it fifteen months old

Queries explicitly scoped to September 2026 returned, at or near the top of the results, a cluster of older work on the Iranian cyber front. SecurityWeek’s “Predatory Sparrow Burns $90 Million on Iranian Crypto Exchange” carries a page age of 19 June 2025 — fifteen months. The Record’s report on pro-Israel hackers claiming an Iranian bank breach and Ynet’s piece on Predatory Sparrow targeting Iran’s financial systems are both dated 17 June 2025. The NetBlocks post recording Iranian connectivity at roughly one percent of ordinary levels is from 4 March 2026; Iran International’s follow-up is 10 March, Al Jazeera’s piece on the wartime shutdown record 5 April. Industrial Cyber’s cluster on an Iranian counteroffensive against Gulf energy dates to 2 and 10 March 2026, Resecurity’s “multi-domain phase” to 24 March, and the Times of Israel’s interview with the Israeli cyber chief to 29 June 2026.

Two items in that set deserve particular caution because they are the ones most likely to be reshared stripped of a date: the Predatory Sparrow exchange-burn story, which reads as current at any point in an escalation, and the NetBlocks one-percent connectivity reading, which is now nearly seven months old. This desk cannot currently say what Iranian connectivity is. The most recent telemetry available to it is from March and April 2026. The Internet Society’s Pulse tracker logged an exam-related shutdown in Iraq on 8 September 2026, outside the window. A Georgia Tech research page describing an Iranian blackout extending to phones and Starlink carries no publication date in results, as does Trellix’s “The Iranian Cyber Capability 2026.” Neither can be used until dated.

Assessment: Recirculation is not usually deception. It is a ranking artefact: search and social systems reward engagement and topical match over recency, and a war in its eighth month generates enough matching text that the archive outranks the day. The effect is the same either way — a reader assembles a picture of the current cyber front out of last summer’s incidents. The check is trivial and almost never performed: look for the publication date before the claim, not the date you saw it. Treat any Predatory Sparrow item without a visible date as 2025 until proven otherwise, and any Iranian connectivity figure without a fresh NetBlocks or Pulse reading behind it as unverified.