How Pakistan's disinformation campaign against India over US strike on Iran Navy's IRIS Dena got exposed

AMatching disinformation run allegedly originating from Pakistan-based networks sought-after(a) to tap a recent maritime infringe involving the United States and Iran to target India's diplomatic standing, according to detailed open-source intelligence assessments.The incident in question is the strike on Iranian Navy's frigate IRIS Dena, which was torpedoed and sunk by the US on March 4 off the Sri Lankan coast.US defence secretary Pete Hegseth described the strike as demonstrating that Iranian vessels were not safe even in international waters, with released periscope footage showing the impact. The frigate had no opportunity to surrender, and debates persist over whether warnings were issued, though naval warfare law permits attacks on enemy warships without prior warning absent clear surrender signals.Disinformation campaign by Pak against India Soon after the sinking, social media platforms witnessed the rapid spread of a narrative accusing India of sharing sensitive information with the United States, a claim widely disputed by analysts, people familiar with the matter said."Almost immediately after the incident, a coordinated disinformation campaign emerged on social media under the hashtag #IndiaBetraysIran, falsely alleging that India had leaked the frigate's coordinates or location data to the United States, enabling the attack. Analysis by Indian OSINT groups and threat intelligence platforms traced the campaign's origin to a March 4 post by the account @TacticalTribun, an account with a history of frequent username changes suggestive of malicious intent," the said.The narrative spread rapidly through manual amplification by unique accounts (not purely algorithmic), with approximately 40% originating from Pakistan-based users and networks, followed by contributions from Iran-aligned, Middle Eastern, African, and Southeast Asian clusters, they added.They noted that the campaign bore hallmarks of coordinated hybrid information warfare, combining genuine user engagement with orchestrated amplification techniques."Over 500 posts from more than 100 identified accounts reached an estimated cumulative exposure of 50,000-100,000 views in the initial phase, with some individual posts achieving viral reach exceeding 900,000 impressions," according to national security officials.'Coordinated hybrid disinformation op'Open-source intelligence assessments found that the campaign exhibited characteristics of a coordinated hybrid disinformation operation, combining organic sentiment with inauthentic amplification."Key propagation followed a hub-and-spoke network structure: the origin post was rapidly replicated by primary amplifiers within 3-6 hours, followed by secondary amplification across 80+ accounts through quote tweets, replies, and hashtag clustering. Notably, high-engagement visual content-such as images of IRIS Dena with Iranian flags and unrelated naval footage-significantly outperformed text-based posts, indicating deliberate emotional manipulation tactics," the people familiar with the matter said.Further breakdowns revealed layered participation across different types of accounts, suggesting structured coordination behind the campaign."Further analysis identified structured layers of participation, including originators, high-reach amplifiers, mid-tier ideological networks, and low-reach "sockpuppet" accounts. The campaign also demonstrated moderate-to-high indicators of coordinated inauthentic behavior, including verbatim content duplication, synchronized posting patterns, rapid hashtag emergence, and abnormal engagement spikes. Bot-amplification risk was assessed as moderate-high, though the campaign remained a hybrid ecosystem involving both real users and coordinated actors."The narrative gained traction across multiple ideological groups, amplifying its reach beyond its original source."A key feature of the campaign was its multi-ideological amplification, where distinct groups-including Pakistan-based networks (~35-40%), pro-Iran actors (~15-18%), pro-Palestine clusters (~12%), Western anti-war communities (~8%), China-aligned accounts (~5%), and even sections of Indian domestic political opposition (~8%)-amplified the narrative through their own ideological lenses. This convergence created a self-reinforcing "narrative ecosystem," allowing a single unverified claim to gain cross-regional traction."The spread extended into India's domestic information space, aided by cross-platform sharing and algorithmic boosts.Repeat playbook by ISI-backed actor'The people aware of the matter also linked the campaign to a broader pattern of similar operations involving fabricated or manipulated media."Such campaigns are not isolated but have witnessed rinse and repeat playbook by ISI-backed actor and have featured deepfakes and fabrications, including AI-manipulated videos. Earlier, on March 3rd, @TacticalTribun posted a deep-fake video of Defense Minister Rajnath Singh endorsing attacks on Iran by the US. Similarly, an old footage of Israeli PM Benjamin Netanyahu was repurposed by Pakistani X account @IntelPk_ asserting that PM Narendra Modi has pledged support for assassinating Iran's supreme leader Ali Khamenei. India's Press Information Bureau (PIB) Fact Check and other verifiers debunked these as Pakistani-origin propaganda aimed at straining India-Iran relations," they said.Overall, they said, the #IndiaBetraysIran campaign represents a Type II targeted disinformation operation, leveraging a real-world geopolitical incident to construct a false narrative aimed at undermining India's international credibility, particularly among Muslim-majority countries and Global South audiences.“While short-lived in its primary wave, the campaign succeeded in seeding a residual perception of distrust, highlighting the evolving role of misinformation warfare as a strategic tool in contemporary geopolitical conflicts.”