‘Bots’ on the ground: How Iran’s 400,000-strong web brigade shapes Middle East conflict

[Editor's Note: Follow Khaleej Times live blog amid US-Israel-Iran war for the latest regional developments.]

As missiles streak across the sky, an army of automated accounts floods the internet with AI-generated images creating a new theatre of war: invisible, borderless, instantaneous, and devastatingly effective.

Industry and cybersecurity experts told Khaleej Times: “In a digitised world, hostile states can distort the stories that land on your newsfeed and change the way you see the world.”

Take this for example: “Within seven minutes of Iranian missiles tearing through the night sky on March 14, a digital blitzkrieg had already detonated across the internet. Before the first warhead struck, before journalists could verify a single frame of footage, before governments could scramble to issue statements, 200,000 automated accounts were carpet bombing social media with a meticulously engineered alternate reality.”

"We are witnessing the industrialisation of deception on a scale never before seen," said Rayad Kamal Ayub, Dubai-based cybersecurity expert and managing director of Rayad Group, which monitors more than one billion bot interactions daily alongside organisations such as Graphika, Mandiant, the Atlantic Council's Digital Forensics Research Lab, and the Stanford Internet Observatory.

Stay up to date with the latest news. Follow KT on WhatsApp channels.

"Iran has constructed the most sophisticated bot army ever deployed in conflict, a machine engineered not to obliterate buildings, but to annihilate truth itself,” Ayub told Khaleej Times.

He explained, at peak capacity in the middle of March, Iran's bot network mobilised between 200,000 and 400,000 automated accounts simultaneously, “hemorrhaging approximately 440,000 posts daily, 3 million posts weekly.”

“After allied amplification networks from Russia, Hezbollah and China joined the assault, the ecosystem metastasized to 500,000 to 700,000 accounts.”

Ayub continued: "What Iran has weaponised represents nearly half the active bot capacity we observe across the entire global commercial sector on any given day. They've constructed a bot army rivaling a small nation's entire internet population."

Three-tiered illusion

To expand their investigation, Rayad Group coordinated with Recorded Future's Insikt Group, FireEye Threat Intelligence, and EU DisinfoLab. What they unraveled was a three-tiered architecture of illusion – from sleeper to strategic and shock accounts – “engineered for maximum psychological devastation”.

• Tier one: 10,000 to 30,000 so-called ‘sleeper accounts’ cultivated over the years, averaging 2.7 years of ‘innocuous content’, food recipes, football commentary, vacation photos, meticulously building credibility before actual weaponisation.

• Tier two: 50,000 to 100,000 ‘strategic accounts’ executing long-term narrative manipulation. Rayad Group and Clemson University's Media Forensics Hub analysis revealed 73 percent identical sentence structures, meaning there is a centralised production with superficial variations to circumvent detection.

• Tier three: 100,000 to 300,000 shock accounts detonated during crisis flashpoints. On March 13, monitoring systems at Rayad Group, Graphika, and the Australian Strategic Policy Institute's International Cyber Policy Centre detected 287,000 newly activated accounts, with 91 per cent exhibiting bot signatures, including posting intervals under 10 seconds.

Automated disinformation arsenal

Bot farms are clusters of automated software applications designed to perform repetitive tasks. These dubious accounts are transformed into disinformation arsenals.

According to cybersecurity professionals, bot farming operations deploy hundreds or thousands of smartphones that are rack-mounted like server farms, each simultaneously operating multiple social media accounts through automated software and rotating IP addresses. These facilities operate ceaselessly, with single installations housing 500 to 1,000 devices commanding 5,000 to 10,000 accounts. The phones cycle through VPNs, simulate human behavior patterns including random pauses and typos, and leverage AI tools generating unique content variations that evade platform detection algorithms.

Ayub shared: "We've documented bot farm operations where a single room packed with phones generates more social media activity than an entire city of actual humans. The phones are programmed to replicate human sleep cycles, engagement patterns, even emotional responses, rendering them virtually indistinguishable from legitimate users until you analyse coordination patterns at massive scale."

How bots are deployed

“Iranian bots detonate within four to seven minutes of kinetic strikes, faster than news organisations can verify basic facts,” explained Ayub, noting: “For instance, by the 15-minute mark after March 12's missile exchange, coordinated hashtags had spawned over 80,000 posts. Within one hour, 200,000 posts were saturating X, Instagram, Facebook and Telegram.

Digital Forensics Research Lab, Oxford Internet Institute, and Rayad Group did a forensic analysis of hashtags #NoWarWithIran, #USAggression, #DefendIran and found out they were masqueraded as organic because 60 to 80 per cent of initial traffic originated from coordinated bots.  

On March 11, #NoWarWithIran erupted 340,000 times in 24 hours, with 68 per cent coming from bot accounts.

So, why is this dangerous? To put it simply, it creates an illusion of truth. “Your brain interprets volume as legitimacy," explained Darren Linvill of Clemson's Media Forensics Hub. They are dangerous because “they manufacture consensus. And your mind accepts it as reality."

Here are two fabrications that conquered millions:

• The Bahrain Inferno Hoax (March 14) – It was actually an AI-generated video depicting a Bahraini high rise building consumed by flames. Seeded through 127 bot accounts, it was amplified by Iranian Students' News Agency (ISNA) within 22 minutes, and it detonated to five million views in six hours despite glaring flaws Bellingcat and Forensic Architecture identified such as warped vehicles and physically impossible human movements. The truth: The building never existed; the inferno never burned.

• The Fifth Fleet Phantom Strike (March 15) – Doctored satellite imagery portraying US Navy headquarters in Bahrain obliterated. Circulated by 340 accounts in 90 minutes, it grew to 180,000 shares and 12 million views. Four hours later, authentic satellite imagery from Planet Labs and Maxar Technologies proved the base was untouched. But the fabrication had already created the false narrative.

Fight for truth

In cyberwarfare, even AI detection systems from Sentinel, Truepic, and Reality Defender can only identify 60 to 70 percent of sophisticated deepfakes, and nearly one third evades automated filters.

“We're locked in a digital arms race,” Ayub warned. "Detection algorithms undergo constant reconstruction because Iranian bots evolve exponentially faster than defensive systems can adapt. As AI advances, deepfake video will become absolutely indistinguishable from reality, bot accounts will replicate human behavior flawlessly, and verifiable truth will face existential pressure.

“Unless societies construct dramatically more robust detection systems and invest massively in public media literacy, we face losing the capacity to distinguish reality from fabrication. The March 2026 conflict transcends military warfare, it's the proving ground for the next generation of information warfare, and defences are collapsing,” he added.

He highlighted: “With 400,000 accounts hemorrhaging 440,000 posts daily, the bot army doesn't need to convince everyone. It merely needs to make everyone doubt everything. Reality itself has become a battlefield. And the first casualty isn't truth, it's our capacity to recognise truth at all.”

Ayub and other cybersecurity experts like him, however, are hopeful and optimistic with the human capacity to fight back against AI-generated deepfakes and trolls. But people need to stand up now to unravel the truth and win the war.