Four months of old Iran cyber material is ranking as this week’s news
A CISA advisory on Iranian-affiliated actors carries two materially different dates across two federal sites. It is surfacing in search as current, alongside an August platform takedown and a vendor dashboard that aggregates self-attribution.
The joint advisory on Iranian-affiliated actors targeting programmable logic controllers in US critical infrastructure is posted in two places by the US government with two different ages. The IC3 PDF carries an April 2026 date, roughly 182 days old. The CISA advisory page, AA26-097A, reads as roughly 76 days old. Either the advisory was quietly updated or re-released — in which case what changed has not been publicly stated — or one of the two timestamps is wrong. Neither reading supports treating the document as a development of the past week, which is how it is currently presenting in search results scoped to recent days. The discrepancy is small, unglamorous and worth a direct question to both agencies, because federal advisory dates are the timestamp that downstream coverage inherits.
Two other items are travelling the same way. Axios reported on 27 August that Meta disrupted an Iran-linked AI operation targeting politicians and journalists; that is roughly 39 days old and still being pulled up by platform-takedown queries. Infosecurity Magazine’s report on Chinese actors exploiting the Iran war to target maritime and energy firms is about 14 days old. Both are legitimate; neither is this week. Sitting above them in search is SOCRadar’s Iran–Israel cyber conflict dashboard, last updated around 2 October, which aggregates claims including hacktivist self-attribution under a commercial vendor’s brand. It is a marketing asset and a lead generator, not a citable source, and the freshness of its update stamp does not transfer to the claims inside it.
Assessment: Attribution in this theatre is now shaped less by what is disclosed than by what re-ranks. A dashboard refreshed on 2 October, a federal PDF with a contested date and an August takedown can arrive on the same screen looking like a single week’s escalation, and that composite is what feeds think-tank tip sheets and ministerial talking points. The discipline is boring and it is the whole job: check the age of the artefact, not the age of the page. Same caution applies to the one chart-ready number in the window — a reported Israeli figure of 39 percent of Iranian operations — which we are holding until its producer, sample and date range are known.