WIR — 25 Jun 2026 17:05Z

⚡ JIC-IW — INFORMATION WARFARE ASSESSMENT — 251703ZJUN2026

BLUF: An Iran‑Russia coordinated information operation is fabricating a death claim for President Volodymyr Zelenskyy and amplifying a bogus Venezuelan earthquake story to sow discord in NATO while the Hormuz blockade dominates strategic attention.

THREAT LEVEL: ACTIVE

ACTIVE NARRATIVES (this cycle):

**NARRATIVE:** “Ukrainian President Volodymyr Zelenskyy killed in covert attack” Source: Russian state‑affiliated Telegram channels (e.g., RT‑News, Sputnik) – coordinated posting across 7 outlets within 30 minutes Technique: Fabrication, Wedge, Amplification Bias exploited: Confirmation bias (pro‑Russia, anti‑NATO audiences) and In‑group/out‑group framing Target audience: Eastern‑European and Baltic publics, NATO‑member political elites Beneficiary: Russian Ministry of Foreign Affairs (GRU) – seeks to erode alliance cohesion; Iran gains distraction from Hormuz pressure Spread velocity: viral (rapid retweets, meme propagation) Counter‑narrative: NATO’s Joint Information Center (JIC) fact‑check confirming Zelenskyy’s live video address (June 25) — brief

**NARRATIVE:** “Venezuela struck by massive earthquake – omen of Western decline” Source: Iranian Revolutionary Guard‑affiliated Persian‑language sites and proxy accounts on Twitter Technique: Fabrication, Deflection, Amplification Bias exploited: Authority bias (citing “expert” Iranian seismologists) and Availability heuristic (emotional shock) Target audience: Persian‑speaking diaspora, Middle‑East anti‑US constituencies Beneficiary: IRGC – distracts from Iran’s Hormuz blockade and portrays US as destabilizing force Spread velocity: growing (≈3 k shares in first hour) Counter‑narrative: US Geological Survey (USGS) statement confirming no seismic event on the date — brief

COORDINATION INDICATORS:

• Identical headline and image posted simultaneously on RT‑News, Sputnik, and Iran‑IRGC’s “Aparat” channel; timestamps within 2 minutes.
• Shared hashtags (#ZelenskyDead, #VenezuelaQuake) tracked across >12 bot‑controlled accounts linking to Russian “troll‑farm” IP ranges (evidenced by OSINT).

STRATEGIC INTENT ASSESSMENT:

The campaign aims to fracture NATO cohesion by exploiting existing Baltic‑Polish frictions, undermine public confidence in alliance leadership, and shift media focus away from the strategic escalation surrounding the Strait of Hormuz, thereby buying time for kinetic or economic coercion.

UPCOMING IO WINDOWS:

• NATO summit in Brussels (June 30) – prime venue for amplified disinformation.
• Iran’s “National Sovereignty Day” (July 1) – likely trigger for intensified anti‑US messaging.
• UN General Assembly (July 15) – potential platform for Iran‑Russia narrative coordination.

RECOMMENDED COUNTERMEASURE:

Launch a pre‑bunking campaign via NATO Public Diplomacy Office targeting Baltic social media with verified video of Zelenskyy, and expose the coordinated bot network through a joint NATO‑EU cyber‑intel briefing.

CAPABILITY GAP: No real‑time Telegram channel ingest for Iranian proxy accounts.

SOURCES CONSULTED: CSIS, RUSI, Carnegie Endowment for International Peace

FORECASTS:

[30d] Russian‑affiliated outlets will release a second fabricated claim alleging a NATO secret weapons cache in Latvia — P(55%) — MOD confidence [60d] Iran‑aligned media will publish a coordinated narrative linking US naval movements in the Gulf to “global food insecurity” — P(45%) — MOD confidence [90d] NATO member states will issue a joint statement condemning coordinated disinformation, prompting a measurable drop in Russian‑origin meme traffic by ≥30% — P(60%) — MOD confidence