Four Iran-linked vessels loitered near Gulf of Oman cables, and no state has said why

The Financial Times reported on 6 November that at least four Iran-linked vessels had been observed circling, loitering or switching off their tracking systems near undersea communication cables in the Gulf of Oman. The reporting frames the movements as possible survey activity preparatory to sabotage rather than sabotage itself, and ties them to earlier warnings from Iranian officials that undersea cables, data centres and other digital infrastructure in the Persian Gulf could be targeted if Washington and Israel resume strikes. This desk reached the story through the aggregator Vision Times rather than the FT original; the only analyst assessment carried in that version is unattributed, naming no speaker and no institution, and is therefore not reproduced here. Four vessels is the sole hard figure. Disabled transponders are a checkable claim against commercial AIS data, and until that check is done this remains a story about a newspaper’s reporting.

The same week produced an unrelated convergence worth more than the vessel count. On 7 November Pakistan’s National Cyber Emergency Response Team, in an advisory reported by Zarmeen Zehra of Geo.tv, warned that AI-assisted attacks threatened banks, oil and gas installations, water utilities and electricity networks, and told operators to inventory every internet-connected IoT and OT asset and restrict third-party maintenance connections. Five days earlier Israel’s National Cyber Directorate had issued near-identical instructions to retail chains, food companies and logistics centres after refrigeration and freezer temperatures rose sharply overnight on 2 November in Swedish supermarkets, three weeks after a comparable incident in France. A spokesperson for the Swedish chain ICA said a “limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems.” Both directorates landed on remote technician access as the exposed surface.

Attribution for the cold-chain attacks remains unofficial. A single-author Substack intelligence roundup records that NPR reported on 3 November a researcher’s assessment, built on forensics plus the attacker’s own claims, pointing to an IRGC-linked persona calling itself Cyber Isnaad Front, and that officials privately suspect Iran. The same roundup states plainly that this is a researcher assessment plus actor self-claims, not an official attribution. The NPR original has not been read here and the researcher is unnamed in the chain available. The roundup also records that limited US strikes on Qeshm Island on 2 November drew no verified cyber retaliation within 72 hours, and that Iranian internet disruptions were reported on 3 November — a finding that cuts against the week’s escalation framing rather than supporting it.

Assessment: Three different kinds of claim are being folded into one narrative this week: ships doing something odd, fridges doing something odd, and a persona on Telegram saying it did the fridges. Only the second is an event with victims and a timestamp. The vessel story is the most quotable and the least verified; the CERT convergence is the least quotable and the most useful, because two national authorities with no shared intelligence picture independently identified maintenance access as the opening. Watch for the attribution to harden by repetition rather than by evidence. The quietest datum — no verified retaliation after Qeshm — is the one nobody will cite.