spying

Remnants claimed to be photographed in Iran have been identified as belonging to a Raytheon ADM-160 Miniature Air-Launched Decoy (MALD). The wreckage was reportedly recovered after an Iranian interception that occurred earlier in the day, although the exact location and circumstances remain unconfirmed and there is reason for caution. Iranian state and military media have a long record of presenting unverified or exaggerated claims, especially during periods of conflict, and imagery released through those channels warrants independent scrutiny. Still, the MALD identification appears credible based on the visible wreckage, but its provenance, location, and the circumstances of its loss have not yet been independently established. MALDs were likely used at least in the opening stages of Operation Epic Fury, as well.

With that being said, the showing off of the MALD wreckage, regardless of its original use case, is something of a reminder that U.S. and Israeli forces are continuing to evaluate Iran’s electronic order of battle, which can include probing activities that leverage deception and decoys to better understand the state of Iran’s air defenses and command and control architecture. This is critical information that needs to be constantly updated for contingency and future potential air campaign purposes.

Iranian sources today reported the destruction of an Orbiter-type reconnaissance drone over the Strait of Hormuz, before the separate imagery emerged showing what appears to be the wreckage of a MALD. It is not yet clear whether the two reports refer to the same incident or separate losses.

The appearance of the wreckage could also shed a light on how the U.S. and Israel can conduct ongoing air operations against Iran, even if kinetic actions have largely slowed to a trickle.

MALD is an expendable store, launched from another aircraft. The ADM-160 family was developed to provide a flexible way of decoying and distracting an enemy’s air defenses, while also adding to the survivability of allied aircraft and standoff weapons. Raytheon won the U.S. Air Force development contract for the current-generation ADM-160B in 2003. The B design is significantly different from the initial A-model from Teledyne Ryan (later Northrop Grumman), the development of which had started in the late 1990s. The B also features a more powerful turbojet engine and possesses greater range.

The ADM-160B is approximately 6.5 feet long, has a wingspan of roughly 5.6 feet when deployed, and is powered by a small turbojet. It has an operational range of around 550 miles.

Rather than carrying a conventional warhead, the MALD carries equipment intended to reproduce the radar signature of specific aircraft or standoff weapons. It can therefore provide additional and often highly enticing tracks for an adversary’s radar operators and surface-to-air missile crews to respond to. It can be programmed to fly intricate routes to better rival the target it is emulating and to provoke the attention of air defenders.

The related ADM-160C MALD-J adds an electronic warfare capability, allowing it to perform stand-in jamming and other forms of active electronic attacks against enemy air defense nodes. Further improved variants of the MALD, which the U.S. Navy has also been acquiring, have since been developed as you can read more about here.

The exact variant involved in today’s incident cannot be established from all publicly available imagery at this stage.

The possibility that the United States had used MALDs against Iran had already attracted considerable attention following Operation Midnight Hammer, the U.S. strike against Iranian nuclear facilities in June 2025.

During the operation, U.S. officials described a complex deception plan involving aircraft and other decoy measures designed to prevent Iran from determining the true direction and composition of the attack.

This strongly pointed to MALD as one likely component of that deception architecture.

The opening hours and days of Operation Epic Fury also likely saw MALD employments. ADM-160s have also been used extensively by Ukraine against Russia, primarily for provoking air defense systems into radiating and as penetration aids for cruise missiles.

MALD® Operational Scenario & Capabilities

In the Strait of Hormuz context, the MALD could serve a dual purpose. It could act in its primary role, as a defensive measure for allied aircraft and standoff weapons, drawing Iranian air defense systems away from it and toward the decoy. It can also be used more independently, triggering Iranian defenses and revealing their locations and operating characteristics, as well as the state of Iran’s command and control for those assets. Surveillance platforms, especially those in the air, can then soak up all that signals data. This can then be used to generate intelligence for future operations, and all without putting a person or an expensive piece of equipment at risk.

The unique nature of the current state of the Iran conflict would allow for MALD to be used in this unique manner. While kinetic actions have become sporadic, they are still occurring, so firing a decoy that looks like something much more threatening to Iranian air defenders would not be an unprecedented escalation.

Iran has characterized the incident as a shoot-down. If Iranian forces did successfully engage the MALD, that would represent a real air defense interception of a U.S. deception system, although these are expendable by design. It is equally possible that the MALD malfunctioned or just flew its route and ran out of fuel and crashed, as designed.

The wreckage also does not, by itself, identify the aircraft that launched the MALD.

The system has been integrated with a broad range of U.S. aircraft. In the course of U.S. operations against Iran, we have notably seen Air Force A-10C Thunderbolt II attack jets returning from theater with markings depicting MALD missions.

It is also worth noting that the MALD wreckage has appeared at the same time as reports of unusual, UAP-like objects over Iran, with videos and eyewitness accounts circulating online. Their authenticity and nature remain unclear.

A number of videos are circulating showing an unidentified object in the skies above Tehran, Iran, it’s not immediately clear what is being filmed. pic.twitter.com/bHNAQGFPNv

— OSINTdefender (@sentdefender) September 21, 2026

Such reports come amid an increasingly sophisticated use of low-end drones, decoys, and other forms of deception. These kinds of systems can be employed not only to stimulate adversary air defenses, but also to distract populations and probe how information moves out of a denied area. In such an environment, unusual aerial sightings should be viewed with caution — but not necessarily dismissed as irrelevant. We have been talking about how new forms of misdirection and guile will leverage relatively low-end technologies in future conflicts for many years now. While it isn’t clear if this light show in the sky over Iran was such an activity, it is certainly a reminder to keep that possibility in mind.

I don’t know what this is, or if it’s legit BUT remember we are in a new age of misdirection, decoy and guile. Specifically using low end drone technology. There are more ways to stimulate an enemy air defense system, distract a populous, assess the flow of public info from a… https://t.co/wW7YVlbayB

— Tyler Rogoway (@Aviation_Intel) September 21, 2026

Meanwhile, the prospect of renewed U.S. strikes is increasingly being raised on both sides. Iran’s central military command said Sunday that it had received information that Washington was preparing to resume attacks, while President Donald Trump told Fox News that he was in a “deciding mode” and was considering further military action alongside economic pressure and a deal.

Trump had also told Axios last week that he was approaching a major decision on whether to resume large-scale military operations, with U.S. forces in the region being maintained at current levels through the end of the year.

Iranian officials have warned that a renewed U.S. attack would trigger retaliation against American forces and interests across the region. At the same time, Qatar and Pakistan are pursuing diplomatic efforts to restart negotiations.

This situation is exactly why keeping as detailed intelligence on the status of Iran’s air defense overlay would be so critical. Building a highly detailed electronic order of battle and maintaining it is critical to the effectiveness of future air operations. There is usually an observable burst of such activity prior to a major operation kicking off, as well. There are also many unseen assets that help with this, from those in space to those in the air and even those under the sea. There have been reports of Israel’s secretive RA-01 stealth flying wing drone being spotted over Iran and of course the U.S. has its own RQ-170 and RQ-180 aircraft, just to name a couple known penetrating assets that are likely highly capable of collecting this information.

Regardless, the U.S. and Israel will have a lot of ‘maintenance’ to do in order to roll back any air defense capabilities Iran has been able to reconstitute should hostilities break out in full again, and a lot of critical intelligence data will need to be up-to-date in order to support such an operation.

Contact the author: thomas@thewarzone.com

The move comes after the EU lifts sanctions on oligarchs following what diplomats described as pressure from Baku.

Azerbaijan’s President Ilham Aliyev has pardoned Martin Ryan, a French national who was serving a 10-year prison sentence on spying charges.

The move on Wednesday came a day after the European Union lifted sanctions on Russian billionaire Alisher Usmanov following what diplomats described as pressure exerted by Baku.

Ryan, who was arrested in 2023 and sentenced in March, was among 20 people pardoned by Aliyev’s office, alongside Azerbaijani, Turkish, Russian-Israeli and Pakistani nationals, Reuters news agency reported.

Aliyev’s website said the president took into account their “personalities, state of health, family circumstances” and other reasons in deciding to grant pardons.

France welcomed “with relief the decision to grant clemency” to Ryan, calling it “a humanitarian gesture”, according to a French Ministry of Foreign Affairs statement. “This decision is the result of patient and exacting dialogue with the Azerbaijani authorities.”

It remained unclear whether Ryan had been released.

Spying charges

Prosecutors alleged Ryan gathered information on Azerbaijan’s military ties with Turkiye, Iran and Pakistan, as well as on companies linked to Russia and China.

Ryan, who also holds British citizenship, denied the charges. France said the allegations against him were false and had called for his immediate release, arguing he had been caught in the crossfire of diplomatic tensions.

The delisting of Usmanov ⁠and fellow Russian billionaire Mikhail Fridman was the first time the EU removed sanctions on the wealthiest members of Russia’s billionaire elite who had not publicly condemned the war on Ukraine.

Usmanov, who once held a minority stake ⁠in Arsenal football club, graduated from the same prestigious diplomatic school in Moscow as the presidents of Azerbaijan and Kazakhstan and knows them personally.

Diplomatic response

European diplomats told Reuters and AFP news agencies that France had privately indicated Baku was using Usmanov’s sanctions status to pressure Paris over its detained citizens.

A second Frenchman, Anass Derraz, an employee of the French water company Saur who was sentenced to 12 years on corruption charges, was not included in the pardons.

An Azerbaijani diplomat rejected suggestions of a pressure campaign as “categorically unfounded”.

Ukrainian President Volodymyr Zelenskyy said the move reflected Russian efforts “to break the West’s unity”, while his Foreign Minister, Andrii Sybiha, said Moscow was “celebrating, because it got what it wanted: a sense of impunity, the humiliation of the EU, and division among Europeans”.

Latvia abstained from the vote and said it would impose its own sanctions on the two men, with Foreign Minister Baiba Braze calling the EU decision “dangerous”.

Slovakia initially called for Usmanov’s removal, with France later backing the move.

Relations between Baku and Paris have long been strained by France’s support for Armenia, even as ties between Moscow and Baku have also deteriorated since the accidental downing of an Azerbaijani passenger jet by Russian forces in December 2024.

SAN FRANCISCO, California: Anthropic said Thursday it shut down multiple cases of state-sponsored surveillance operations that used its artificial intelligence (AI) models, and warned that governments and state-aligned actors are increasingly using AI to spy on ethnic minorities and dissidents.

The incidents were found and disrupted between January and July, and they originated in China, Iran and west Africa, Anthropic said in a report about misuse of its models.

These surveillance campaigns “targeted the same diaspora and dissident communities these regimes have historically targeted. These include pro-democracy figures in Hong Kong, Tibetan and Falun Gong communities across Asia, and Iranian minority communities and opponents of the Iranian regime abroad,” the report said.

In one case, Iranian actors developed a way to identify people through their social media accounts; in another, a contractor working for Malian national security authorities used Claude “to design the underlying software that enabled the intelligence gathering.”

“AI is now being used in place of an engineering workforce,” the report said.

Anthropic also disrupted efforts by users to design weapons, conduct questionable biological research, and create dating scams.

The San Francisco-based AI lab also accused Chinese developers of deceptively using Claude to produce responses to user queries while simultaneously “distilling” that data to improve their own models.

Distilling is an industry term that refers to a process where one AI model is used to train another one.

Chinese developers have previously been accused of using that technique without permission, essentially stealing resources from American labs such as Anthropic and OpenAI.

Now Anthropic alleges that China’s Moonshot and Deepseek have also secretly used Claude to generate answers given to its users.

“In one instance, over a ten-day period, Moonshot relayed almost 300,000 customer requests to Anthropic” through a “network of 5,380 fraudulent accounts, most of which appeared to be located in Singapore and Japan,” the report said.

Some of that data contained sensitive user information, potentially in violation of privacy agreements.

“We do not know if Moonshot notified their customers that their requests were being rerouted to Anthropic and exposed to a third party,” the report said.

Deepseek used similar techniques.

When it comes to the research Anthropic detected and blocked that was related to biological weapons, the intent of the actors was less clear-cut and the AI lab did not identify them.

“The individuals implicated in these case studies are working scientists. We do not assert that they intended harm, and identifying them or their labs could expose them to harm,” the report said.

The scientific research in those cases involved work around the mosquito-born chikungunya virus, a “highly-pathogenic” strain of the bird flu, a family of viruses that include smallpox and mpox, venoms and other toxins.