A coordinated disinformation campaign allegedly originating from Pakistan-based networks sought to drag India into a geopolitical flashpoint following a recent maritime confrontation between the United States and Iran, according to open-source intelligence (OSINT) assessments. 

The controversy stems from the March 4 sinking of the Iranian Navy frigate IRIS Dena, which was torpedoed by US forces off the Sri Lankan coast.

The strike, confirmed by US defence secretary Pete Hegseth, was presented as a demonstration of American naval reach, with footage showing the moment of impact.

The Iranian vessel reportedly had no opportunity to surrender, although international naval law permits attacks on active enemy warships without prior warning under certain conditions.

However, within hours of the incident, social media platforms were flooded with posts alleging that India had shared sensitive intelligence with the United States, enabling the strike: A claim widely dismissed by analysts and officials familiar with the matter.

The narrative, driven by the hashtag #IndiaBetraysIran, appears to have originated from a post by the account @TacticalTribun, which has a history of frequent username changes, a pattern often associated with coordinated influence operations.

According to OSINT groups and threat intelligence trackers, nearly 40% of early amplification came from Pakistan-based accounts and networks.

The campaign then spread across clusters aligned with Iran, pro-Palestine groups, segments of Western anti-war communities, and smaller China-linked networks, creating a multi-layered amplification effect.

Investigators noted that the campaign bore hallmarks of hybrid information warfare, blending organic user engagement with coordinated inauthentic behavior.

More than 500 posts from over 100 identified accounts generated an estimated 50,000 to 100,000 views in the early phase, with some posts reaching over 900,000 impressions.

The spread followed a structured “hub-and-spoke” pattern, where the original claim was rapidly amplified by key accounts within hours, before cascading into wider networks through replies, quote posts, and hashtag clustering.

Visual content, including images of the IRIS Dena and unrelated naval footage, significantly outperformed text posts, suggesting deliberate attempts to provoke emotional responses and increase virality.

Further analysis identified layered participation across different account types, ranging from originators and high-reach amplifiers to mid-tier ideological networks and low-reach “sockpuppet” accounts.

Indicators such as identical content duplication, synchronized posting patterns, and sudden engagement spikes pointed to coordinated inauthentic behavior.

While bot involvement was assessed as moderate to high, experts said the campaign operated as a hybrid ecosystem, combining real users with orchestrated actors to maximise reach and credibility.

A notable feature of the operation was its multi-ideological convergence. Distinct groups — including Pakistan-based networks (35–40%), pro-Iran actors (15–18%), pro-Palestine clusters (around 12%), Western anti-war communities (8%), China-aligned accounts (5%), and even segments of India’s domestic political discourse (8%) — amplified the claim through their own narratives.

This convergence, analysts said, helped transform an unverified allegation into a self-sustaining narrative ecosystem that transcended regional and ideological boundaries.

Officials warned that such campaigns highlight the evolving nature of information warfare, where geopolitical events are rapidly weaponised in the digital domain to shape perceptions and strain diplomatic relationships.