4% connectivity. Smuggled Starlinks. VPNs spiking across the diaspora. Telegram channels running the last newsroom. This is what information collapse looks like in real time.
At 07:00 UTC on February 28, 2026, something changed on the internet. NetBlocks - the independent network watchdog that tracks connectivity in real time - watched Iran's national traffic fall off a cliff. Not gradually. Not in stages. A vertical drop, the kind that only happens when a government throws a switch.
Within hours, connectivity across 90 million people was sitting at 4% of normal levels. Cloudflare Radar confirmed it independently: "close to zero across all major regions," with Tehran, Isfahan, Alborz, Fars, and Razavi Khorasan all experiencing near-complete shutdown. The only traffic moving was government and military. The rest of the country - its people, its journalists, its dissidents - had been cut off from each other and from the world.
Operation Epic Fury had begun. And the first target wasn't a nuclear facility. It was the information grid.
This was not a new playbook. Iran had been rehearsing it for years. The 2019 "Bloody November" protests triggered a six-day total blackout. The 2022 Mahsa Amini uprising saw targeted platform blocks. The June 2025 Twelve-Day War with Israel pushed connectivity to 3% of normal. Each shutdown was a test run. February 28 was the final exam.
The mechanism is Iran's National Information Network - a parallel domestic intranet the regime spent a decade building so it could function without the global internet. When authorities throw the switch, external routing dies. Internal government services survive. The rest of the population gets what the regime decides they should see.
But this time, something hit harder. The blackout came faster and was enforced more completely than any previous shutdown. Iranian news websites, including the official IRNA agency, had already reported being targeted by sophisticated cyberattacks in the minutes before connectivity died. The IRGC, the Supreme National Security Council, and the Ministry of ICT moved in unison. Within three hours, the country had been hollowed out digitally.
The 4% that remained wasn't a bug. It was a feature. When 96% of civilian traffic disappears, the residual signal belongs almost entirely to state actors. Cybersecurity experts noted this creates a form of digital fingerprinting - IRGC-linked infrastructure suddenly becomes visible against the silence. Whether US and Israeli cyber operations exploited that window is unconfirmed. But the geometry was there.
The diaspora moved first. Within minutes of the shutdown confirmation, Iranians abroad were burning through Psiphon and Proton VPN accounts trying to push access tunnels back into the country. By midday, approximately 400,000 Iranians outside Iran were actively sharing circumvention tools - proxy links, VPN configs, Telegram bots - trying to punch holes through the blackout.
Proton VPN reported sessions originating from Iran had spiked sharply before cutting off entirely. Psiphon's Iranian user base flatlined - not because people stopped trying, but because there was no longer enough residual connectivity to sustain a VPN handshake. You can't encrypt traffic that can't leave the building.
This is the regime's learned lesson from years of protest. Don't filter. Kill. A partial shutdown can be circumvented with the right tools. A 96% shutdown leaves nothing to work with. VPNs need a carrier signal to ride. At 4% connectivity, routed entirely through state infrastructure, there isn't one for civilians. The tools that worked during 2022's platform blocks - Psiphon, Lantern, Ceno browser - became effectively useless when the underlying routing was killed at the backbone level rather than the application layer.
The one crack in the wall was orbital. Starlink terminals don't route through Iran's national network. They connect directly to satellites overhead. The regime cannot block them at the infrastructure level. It can only find them and seize them.
The Telegraph reported in mid-February that the Trump administration had covertly smuggled approximately 6,000 Starlink terminals into Iran over the preceding months, in coordination with opposition networks and diaspora logistics chains. The Guardian had documented the broader ecosystem in January - terminals moving across borders hidden in commercial shipments, distributed through trusted networks inside the country.
On February 28, those terminals became the only functional windows to the outside world. The BBC managed brief contact with Iranian sources via Starlink connections in the hours after shutdown began. OSINT researchers tracking the conflict noted isolated but genuine uploads from inside Iran - videos, photos, location data - that could only have come through satellite links.
The regime knew it. IRGC units were deployed to track satellite signal emissions. Iranian authorities had been running operations to seize dishes since January - framing them in state media as foreign spy hardware. During the June 2025 war, the government had distributed a fake Starlink app to identify and track people trying to get online. On February 28, that hunt intensified. Ownership of a working Starlink terminal in Tehran became a matter of operational security as much as connectivity.
When the professional press goes dark - and it went dark fast - the information vacuum gets filled by whoever has the tools and the obsession to keep watching. On February 28, that meant a loose network of open-source intelligence accounts on X that had been tracking Iranian military activity for months before the strikes began.
Accounts catalogued by the Institute for the Study of War, volunteer analysts at GeoConfirmed, and a cluster of anonymous OSINT researchers running satellite imagery comparisons in real time became the de facto wire services for the conflict. They were cross-referencing Sentinel satellite passes over Natanz and Fordow to confirm strike damage. They were geolocating video fragments against known map features. They were triangulating missile trajectories from acoustic reports and radar shadows.
The ISW published its Iran Update Special Report for February 28 drawing extensively on these accounts - including one based in Bahrain that was counting Iranian retaliatory missile barrage sizes in real time, estimating two to four missiles per salvo. None of this came from official sources. It came from people with satellite imagery subscriptions, mapping software, and no sleep.
The epistemological shift is worth sitting with. The "authoritative" sources - state TV, government press offices, official wire agencies - were offline, captured by propaganda, or actively lying. The distributed, reputation-only OSINT layer was producing more accurate real-time information than any institution. Nobody in a legacy press freedom organization is fully comfortable with that fact yet. But it's the fact.
Telegram was not supposed to be news infrastructure. On February 28 it was the closest thing Iran had to a functioning press corps.
Iranian opposition channels - Iran International's Telegram feed, diaspora-run news operations, OSINT aggregators - were updating in real time throughout the strikes. Telegram's architecture routes through its own server infrastructure rather than the Iranian national network. Channels that had established subscriber bases before the blackout could still push notifications to users with any residual connectivity, including Starlink users and the few operating on that 4% government-adjacent signal.
The channels functioned as triage centers for unverified information. A video would appear and within minutes a cluster of channels would cross-check it against prior known footage, run reverse image searches, and tag it with confidence levels. It was rough. It was imperfect. But compared to the alternative - state TV broadcasting Quranic recitation into silence - it was the only real journalism happening inside Iran's information perimeter.
IRGC-linked channels ran parallel operations on the same platform, pushing their own narrative. The result was a simultaneous information war through the same servers: regime channels claiming the Supreme Leader was safe and strikes were being repelled; opposition channels and OSINT accounts reporting confirmed leadership deaths and nuclear facility destruction. Telegram became a contested space where both sides fought for the same feed.
Into that contested space came the fakes. They were everywhere and they were fast.
NewsGuard, the disinformation watchdog, had already documented 51 websites pushing fabricated claims during the June 2025 Iran-Israel conflict - AI-generated images of mass destruction in Tel Aviv, fabricated reports of Iran capturing Israeli pilots. The sources included IRGC-linked Telegram channels and IRIB-affiliated media. February 28 reprised that playbook at scale, with better tools and less time pressure on the fakers.
Within hours of the strikes beginning, videos circulated claiming to show Iranian air defenses successfully intercepting American missiles over Tehran. Independent analysts with access to satellite imagery said the footage didn't match any observable thermal anomaly at the claimed location. The video appeared to be repurposed from an unrelated 2024 military exercise, upscaled and recolored to look current.
A separate clip - purportedly showing a US aircraft shot down over Isfahan - was traced within 90 minutes by OSINT accounts to footage originally recorded in Ukraine in 2022. It had been laundered through a chain of anonymous Telegram channels designed to obscure provenance and make it look like a fresh leak from inside Iran.
The regime had prior form. During the June 2025 war, IRIB TV1 was caught fact-checked reusing 2022 footage of Russian missile launches and presenting it as Iranian strikes on Israel. That editorial calculus - run it, see if it holds - had survived intact into February 2026. State media and IRGC channels were operating on the same assumption: in a blackout, the counter-narrative takes time to organize. Flood the zone early and something sticks.
The deepfake problem cut both ways. Pro-regime disinformation competed with anti-regime fabrications. Unverified videos of Iranian civilians celebrating in the streets circulated alongside clips flagged as likely AI-generated or misattributed. In a near-total information blackout, everything becomes suspect. Verification becomes the scarce product. And most people, watching events unfold through a Telegram feed, had no way to buy it.
At some point during the strikes, the Islamic Republic of Iran Broadcasting network went off air. The exact timing is contested by conflicting reports. But the moment it happened was noticed immediately by the diaspora watching satellite feeds and the OSINT community tracking Iranian state media signals.
IRIB has been the regime's primary domestic propaganda organ since 1979. It holds a media monopoly inside Iran. When the strikes hit command infrastructure, IRIB's transmission capability either became a casualty or its operators made the call to go dark rather than be captured live broadcasting the collapse of the government they served.
What came back was not news. It was Quranic recitation.
The choice was not random. In Iranian state media tradition, Quranic recitation on the national broadcast signal carries a specific meaning: the death of a head of state. It is the sonic equivalent of a black armband. When Khamenei was confirmed dead on February 28, IRIB - unable or unwilling to report the fact directly while the situation remained fluid - reverted to the liturgical code that Iranian audiences had been trained over decades to read.
The regime confirmed his death hours later through IRNA, quoting the Quran: "To Allah we belong and to Him we shall return." But for anyone watching IRIB's signal return to recitation, the message had already been transmitted. In the absence of words, Iran's state broadcaster communicated the fact it could not say out loud. The silence had its own grammar.
What happened to Iran's information infrastructure on February 28 was not a side effect of the conflict. It was a primary axis of it. The regime prioritized killing connectivity before the first bombs fell, because information is a weapon it has always understood better than its opponents.
The result was a fog thicker than any military operation could generate through conventional means. A country of 90 million people, cut off from each other and from the outside world, navigating the most significant political rupture in 47 years through smuggled satellite terminals, diaspora VPN shares, OSINT analysts running satellite passes in other time zones, and the liturgical sub-language of state television going quiet.
As of March 1, connectivity remained below 20% of normal. The economic cost - put at $35.7 million per day by the regime's own minister - kept accumulating. Online sales had already fallen 80% during the weeks of partial shutdown that preceded February 28. The Tehran Stock Exchange had shed 130 trillion tomans daily during the January blackout period.
The regime built the cage to keep information in. The cage also kept the regime's own version of events from escaping intact. The Quranic recitation on IRIB said more than any press release could. The silence was the story. And enough people, through enough cracks in the blackout, heard it.
PRISM covers technology, cyberwarfare, and information infrastructure for BLACKWIRE. Read more at nixus.pro/wire.