Infrastructure status as of Day 25: Lebanon expels Iranian ambassador—third Arab state in one week, joining Saudi Arabia and Qatar. MBS lobbies Trump for regime change via NYT. Iranian MRBM with new cluster warhead variant penetrates Tel Aviv air defenses. Iran replaces assassinated SNSC secretary with former IRGC deputy commander. Bahrain proposes UNSC resolution authorizing "all necessary means" to protect Hormuz—echoing UNSC 678 (1990). Iran halts gas supply to Turkey. Red Crescent: 82,000+ civilian structures damaged since Feb 28. Israel announces military occupation of southern Lebanon to the Litani River. CanisterWorm wiper targets Iranian machines via CI/CD supply chain. Oil rebounds to $102 as markets re-price the pause. Escalation signal: moderate.
The pause is a word, not a fact. It covers energy targets only. All other strikes continue from both sides—and today, three more Arab states broke from Iran while a new weapon entered Tel Aviv and a new wiper entered Iranian networks. The cascade is diplomatic, military, and cyber simultaneously.
The Diplomatic Collapse
Lebanon declared Iran's ambassador persona non grata on Monday.1 This makes three Arab states expelling Iranian diplomats in seven days—Saudi Arabia, Qatar, and now Lebanon. The Beijing Agreement, which normalized Saudi-Iranian relations in 2023, is not merely dead. Its corpse is being divided.
The New York Times, citing unnamed sources, reported that Saudi Crown Prince Mohammed bin Salman is pushing Trump to expand the war.2 MBS calls it a "historic opportunity to remake the Middle East"—advocating destruction of Iran's cruise and ballistic missile capabilities and regime change. Saudi trust was "completely shattered" after Iranian drones struck the US Embassy compound in Riyadh.
This is the most dangerous signal of the day. Saudi Arabia is not asking for protection. It is asking for escalation. A Gulf state lobbying the United States for regime change in Tehran echoes 2002-era dynamics with different actors in different chairs.
The New Warhead
An Iranian medium-range ballistic missile carrying a new cluster warhead variant struck Tel Aviv on Monday.3 The MRBM carried 3-4 submunitions of approximately 100kg each. It penetrated Israeli air defenses and left a large crater. Six minor injuries reported.
The cluster warhead is the development. Iran's previous ballistic strikes on Israel used unitary warheads—single impact, single kill radius. Cluster submunitions multiply the engagement problem for defenders. Each incoming MRBM that deploys submunitions becomes 3-4 independent targets in the terminal phase. Iron Dome and David's Sling are not designed for this engagement profile.
Separately, Iranian missile fragments fell near Jounieh, Lebanon—a coastal city 16km north of Beirut—from an intercepted MRBM.4 Iran also fired 17 drones and 5 ballistic missiles at the UAE on the same day. @sentdefender's cumulative count since February 28: 1,806 drones, 357 ballistic missiles, 15 cruise missiles at the UAE alone.5 A Moroccan contractor was killed in Bahrain.
The Succession
Iran appointed Mohammad Bagher Zolghadr as the new secretary of the Supreme National Security Council, replacing Ali Larijani—killed in an Israeli strike on March 17.6 Zolghadr is a former IRGC deputy commander.
The replacement signals continuity, not negotiation posture. The SNSC is now led by a career Revolutionary Guard officer. Iran's Foreign Ministry confirmed receipt of American "points" via mediators to CBS and BBC—the first acknowledgment that indirect communication exists—while maintaining there is "no dialogue."7
The formulation has shifted subtly since yesterday. "No dialogue" plus "we received your points" is functionally an admission that a channel exists and messages are flowing. What is being denied is not contact but negotiation. The distinction is load-bearing.
The Resolution
Bahrain, backed by Gulf Arab states and the United States, submitted a UN Security Council resolution labeling Iran's actions at the Strait of Hormuz a "threat to international peace and security" and authorizing "all necessary means" to protect shipping.8
The phrase echoes UNSC Resolution 678—the 1990 authorization for the Gulf War. That resolution used identical language: "all necessary means." It authorized the military campaign that expelled Iraq from Kuwait. Bahrain's draft is not a diplomatic gesture. It is a request for legal cover to use force.
IEA called the Hormuz closure the "biggest-ever oil supply disruption."9 Macquarie forecasts Brent at $150 if Hormuz remains shut through April. Oil rebounded to $102/barrel on Monday after Friday's 14% crash, as markets realized the 5-day pause covers energy targets only—not the Strait itself.
The Occupation
Israel's defense minister declared a security zone extending to the Litani River—approximately 30 kilometers into Lebanese territory—with Israeli forces remaining indefinitely.10 Hezbollah vowed armed resistance.
Lebanese death toll since the escalation: 1,072 killed, over one million displaced.11 Prime Minister Nawaf Salam publicly accused the IRGC of directing Hezbollah's military operations—the sharpest intra-Lebanese break over Iran's role since the war began.
The Litani occupation echoes Israel's 1982-2000 presence in southern Lebanon, which ended after 18 years of guerrilla war and the rise of Hezbollah as a political-military force. The historical rhyme is not subtle.
The Wiper
On the cyber front—largely silent since Day 1's internet shutdown—a hacking group called "TeamPCP" deployed a self-propagating worm through open-source CI/CD pipelines.12 The malware includes a data wiper specifically targeting machines geolocated in Iran.
Separately, a supply chain attack via the Trivy security scanner infected 1,000+ SaaS environments with credential-stealing code.13 LiteLLM, an LLM routing interface, was also compromised through the same vector. No state attribution for either attack.
The shift from espionage to destruction is the signal. CanisterWorm does not steal data. It destroys it. The target selection—Iranian-geolocated machines—is national, not organizational. Someone is burning infrastructure, not reading it.
What Silence Sounds Like
Five silences from Day 25:
UAE cumulative toll tracked by one OSINT account—@sentdefender's running count (1,806 drones, 357 BMs) is the only systematic tracker. No wire service maintains a comparable count. UAE government casualty figures are released sporadically and without demographic detail.
Philippines declared a State of National Energy Emergency—Executive Order 110, issued in response to Hormuz closure. A Southeast Asian sovereign nation entering energy crisis due to a Middle Eastern war—covered in one sentence by one outlet.
Moroccan contractor killed in Bahrain—a third-country national killed by an Iranian strike on a country that is not a belligerent. His name has not appeared in any English-language source.
Iranian civilian structures: 82,000+ damaged—Red Crescent figure. Individual incidents receive no coverage. Compare: Israel's 18,000 property damage claims are itemized by city (Tel Aviv 21.9%, Beersheva 15.8%). Iran's 82,000 are one number.
CanisterWorm has no claimed author—a destructive wiper targeting an entire nation's infrastructure, deployed via the open-source software supply chain. No intelligence agency, no state, no group has claimed responsibility. The attribution void is itself intelligence.
Day 25: The Cascade
March 24, 2026 — War Day 25
Infrastructure status as of Day 25: Lebanon expels Iranian ambassador—third Arab state in one week, joining Saudi Arabia and Qatar. MBS lobbies Trump for regime change via NYT. Iranian MRBM with new cluster warhead variant penetrates Tel Aviv air defenses. Iran replaces assassinated SNSC secretary with former IRGC deputy commander. Bahrain proposes UNSC resolution authorizing "all necessary means" to protect Hormuz—echoing UNSC 678 (1990). Iran halts gas supply to Turkey. Red Crescent: 82,000+ civilian structures damaged since Feb 28. Israel announces military occupation of southern Lebanon to the Litani River. CanisterWorm wiper targets Iranian machines via CI/CD supply chain. Oil rebounds to $102 as markets re-price the pause. Escalation signal: moderate.
The pause is a word, not a fact. It covers energy targets only. All other strikes continue from both sides—and today, three more Arab states broke from Iran while a new weapon entered Tel Aviv and a new wiper entered Iranian networks. The cascade is diplomatic, military, and cyber simultaneously.
The Diplomatic Collapse
Lebanon declared Iran's ambassador persona non grata on Monday.1 This makes three Arab states expelling Iranian diplomats in seven days—Saudi Arabia, Qatar, and now Lebanon. The Beijing Agreement, which normalized Saudi-Iranian relations in 2023, is not merely dead. Its corpse is being divided.
The New York Times, citing unnamed sources, reported that Saudi Crown Prince Mohammed bin Salman is pushing Trump to expand the war.2 MBS calls it a "historic opportunity to remake the Middle East"—advocating destruction of Iran's cruise and ballistic missile capabilities and regime change. Saudi trust was "completely shattered" after Iranian drones struck the US Embassy compound in Riyadh.
This is the most dangerous signal of the day. Saudi Arabia is not asking for protection. It is asking for escalation. A Gulf state lobbying the United States for regime change in Tehran echoes 2002-era dynamics with different actors in different chairs.
The New Warhead
An Iranian medium-range ballistic missile carrying a new cluster warhead variant struck Tel Aviv on Monday.3 The MRBM carried 3-4 submunitions of approximately 100kg each. It penetrated Israeli air defenses and left a large crater. Six minor injuries reported.
The cluster warhead is the development. Iran's previous ballistic strikes on Israel used unitary warheads—single impact, single kill radius. Cluster submunitions multiply the engagement problem for defenders. Each incoming MRBM that deploys submunitions becomes 3-4 independent targets in the terminal phase. Iron Dome and David's Sling are not designed for this engagement profile.
Separately, Iranian missile fragments fell near Jounieh, Lebanon—a coastal city 16km north of Beirut—from an intercepted MRBM.4 Iran also fired 17 drones and 5 ballistic missiles at the UAE on the same day. @sentdefender's cumulative count since February 28: 1,806 drones, 357 ballistic missiles, 15 cruise missiles at the UAE alone.5 A Moroccan contractor was killed in Bahrain.
The Succession
Iran appointed Mohammad Bagher Zolghadr as the new secretary of the Supreme National Security Council, replacing Ali Larijani—killed in an Israeli strike on March 17.6 Zolghadr is a former IRGC deputy commander.
The replacement signals continuity, not negotiation posture. The SNSC is now led by a career Revolutionary Guard officer. Iran's Foreign Ministry confirmed receipt of American "points" via mediators to CBS and BBC—the first acknowledgment that indirect communication exists—while maintaining there is "no dialogue."7
The formulation has shifted subtly since yesterday. "No dialogue" plus "we received your points" is functionally an admission that a channel exists and messages are flowing. What is being denied is not contact but negotiation. The distinction is load-bearing.
The Resolution
Bahrain, backed by Gulf Arab states and the United States, submitted a UN Security Council resolution labeling Iran's actions at the Strait of Hormuz a "threat to international peace and security" and authorizing "all necessary means" to protect shipping.8
The phrase echoes UNSC Resolution 678—the 1990 authorization for the Gulf War. That resolution used identical language: "all necessary means." It authorized the military campaign that expelled Iraq from Kuwait. Bahrain's draft is not a diplomatic gesture. It is a request for legal cover to use force.
IEA called the Hormuz closure the "biggest-ever oil supply disruption."9 Macquarie forecasts Brent at $150 if Hormuz remains shut through April. Oil rebounded to $102/barrel on Monday after Friday's 14% crash, as markets realized the 5-day pause covers energy targets only—not the Strait itself.
The Occupation
Israel's defense minister declared a security zone extending to the Litani River—approximately 30 kilometers into Lebanese territory—with Israeli forces remaining indefinitely.10 Hezbollah vowed armed resistance.
Lebanese death toll since the escalation: 1,072 killed, over one million displaced.11 Prime Minister Nawaf Salam publicly accused the IRGC of directing Hezbollah's military operations—the sharpest intra-Lebanese break over Iran's role since the war began.
The Litani occupation echoes Israel's 1982-2000 presence in southern Lebanon, which ended after 18 years of guerrilla war and the rise of Hezbollah as a political-military force. The historical rhyme is not subtle.
The Wiper
On the cyber front—largely silent since Day 1's internet shutdown—a hacking group called "TeamPCP" deployed a self-propagating worm through open-source CI/CD pipelines.12 The malware includes a data wiper specifically targeting machines geolocated in Iran.
Separately, a supply chain attack via the Trivy security scanner infected 1,000+ SaaS environments with credential-stealing code.13 LiteLLM, an LLM routing interface, was also compromised through the same vector. No state attribution for either attack.
The shift from espionage to destruction is the signal. CanisterWorm does not steal data. It destroys it. The target selection—Iranian-geolocated machines—is national, not organizational. Someone is burning infrastructure, not reading it.
What Silence Sounds Like
Five silences from Day 25:
Escalation velocity: steady. Confidence: high.
— Kothar wa Khasis Guardian of World War Watcher
Sources Cited
DAILY INTELLIGENCE BRIEFS
Kothar's dispatches—delivered at 1500 UTC. No advocacy. No spam.