Iran's February 28 Retaliation
Insight into the logic behind Iran’s open strike campaign
The IRGC's retaliatory campaign of February 28, 2026 constitutes the most geographically expansive single-day Iranian strike operation in the history of the Islamic Republic. Within eighteen hours of the opening of US-Israeli strikes under Operations Epic Fury and Lion’s Roar, Iranian forces had conducted coordinated ballistic missile, cruise missile, and one-way attack drone strikes against military and civilian infrastructure across eight countries simultaneously.
A serious analysis of Iran’s February 28 operations has to begin with the conditions under which they were carried out. U.S. and Israeli forces began conducting joint strikes on Iran at approximately 09:45 IRST, launching nearly 900 strikes in the first twelve hours. The opening wave reportedly targeted the compound of Supreme Leader Ali Khamenei, killing him alongside dozens of senior officials. In parallel, U.S. Cyber Command appears to have been the operational first mover, initiating cyber operations before any kinetic strikes were launched. These attacks targeted Iran’s digital backbone, degrading internet connectivity to an estimated one to four percent of normal levels through layered disruptions to BGP routing, DNS infrastructure, and industrial control systems. Within the same operational window, IRGC commander Mohammad Pakpour and Defense Minister Aziz Nasirzadeh were also killed.
That Iranian ballistic missiles were already in flight against targets across the Gulf within hours of these strikes is therefore the central operational fact that requires explanation. The near-simultaneity of retaliatory launches across multiple countries, carried out under conditions of leadership decapitation and severe communications disruption, suggests that elements of Iran’s retaliatory architecture were either pre-delegated, pre-planned, or capable of functioning under highly degraded command-and-control conditions.
Following Khamenei’s death, Foreign Minister Abbas Araghchi announced that Iran had activated what he described as its Mosaic Defense strategy (I wrote about this a bit in my previous post). The concept, developed over the past two decades within the IRGC, is designed to disperse command structures, weapons systems, and operational units across wide geographic areas so that the system can continue functioning even after leadership decapitation or severe disruption to communications.
In practical military terms, such a framework relies on pre-delegation of authorities and preplanned strike packages. IRGC Aerospace Force missile brigades and battalions appear to operate with assigned target sets and contingency launch procedures designed to be executed if communications with higher headquarters are severed. Provincial and regional commanders are widely believed to hold sealed operational instructions or conditional orders intended for precisely this scenario, allowing retaliatory operations to proceed even in a degraded command-and-control environment.
The sustained and geographically distributed missile launches in the hours following the initial strikes, therefore, suggest that elements of Iran’s command-and-control architecture remained functional. However, it is difficult to determine from open sources the degree to which these launches reflected surviving centralized coordination versus execution of pre-delegated contingency plans.
Three Parallel Targeting Campaigns
When examined at the operational level, Iran’s February 28 retaliation does not appear as a single undifferentiated strike campaign. Instead, the attacks can be disaggregated into three overlapping targeting efforts that unfolded in parallel, each with a distinct set of targets, a different mix of weapons, and a different strategic logic. These campaigns were not perfectly executed, and the available information remains incomplete, but the overall pattern suggests a degree of planning and prioritization rather than indiscriminate retaliation.
Attacks on U.S. Command, Control, and ISR Infrastructure
The most operationally significant pattern on February 28 was the concentration of strikes on American command, control, communications, and intelligence (C2/ISR) infrastructure across the Gulf. Many of the strikes appear to have focused on specific nodes that enable U.S. power projection in the region, particularly the communications architecture that links forward bases, naval forces, and airborne ISR platforms into a single operational network.
Several of the early attacks were directed at facilities that serve as communications hubs for U.S. regional operations. At Camp Arifjan in Kuwait, Iranian drones reportedly struck and destroyed multiple radomes—large geodesic dome structures that protect satellite communications antennas. These radomes house equipment used for long-distance command links and ISR data transmission, allowing U.S. forces in the Gulf to maintain connectivity with theater command centers and with assets operating across the region. Radomes are precise and technically identifiable aimpoints. Their selection suggests that Iranian planners were drawing on a targeting database developed over time, likely informed by satellite imagery, long-term observation of U.S. installations, and detailed analysis of publicly visible basing infrastructure—potentially supplemented by intelligence or technical insights from partners such as Russia.
A similar pattern appeared at the Naval Support Activity in Bahrain, where a drone strike reportedly destroyed two AN/GSC-52B satellite communications terminals, which support communications for the United States Fifth Fleet headquarters. Naval Support Activity Bahrain hosts the Fifth Fleet’s operational command facilities and serves as the central hub for U.S. naval operations in the Persian Gulf, the Red Sea, and parts of the Arabian Sea. The AN/GSC-52B terminals function as high-capacity satellite ground stations within the U.S. military’s wideband communications architecture, enabling the transmission of operational orders, intelligence data, and targeting information between fleet headquarters and deployed ships, aircraft, and surveillance platforms.
These systems handle large volumes of secure voice and data traffic, allowing maritime forces operating hundreds or thousands of kilometers away to remain integrated into the theater command structure. The destruction of such terminals would not disable the Fifth Fleet or sever communications entirely, since U.S. military networks are designed with redundancy and alternative routing pathways. However, they are high-value communications nodes, and damage to them can temporarily complicate the flow of operational information between command elements and deployed naval forces
Likewise, at Al Udeid Air Base, drones damaged communications and satellite equipment associated with U.S. air operations. Al Udeid functions as a major operational hub for American airpower in the Middle East, hosting command facilities and communications systems that support the coordination of strike aircraft, surveillance platforms, and aerial refueling assets.
Elsewhere, a radar installation at Muwaffaq Salti Air Base was struck by a ballistic missile. The base hosts U.S. and coalition aircraft and functions as an important forward operating location supporting air operations over Syria, Iraq, and the eastern Mediterranean. Open-source reporting indicates that the strike damaged infrastructure associated with a THAAD missile-defense battery, including the AN/TPY-2 radar, a high-power X-band system used for long-range detection and tracking of ballistic missiles. The radar feeds data into the broader regional air and missile defense architecture linking interceptors, command centers, and early-warning networks across the Gulf and Levant.
A strike against radar infrastructure at such a location is consistent with a broader effort to disrupt the sensor layer that enables air defense and air operations coordination. Systems like AN/TPY-2 provide early detection and tracking information that allows interceptors to engage incoming missiles and enables commanders to maintain situational awareness across a wide battlespace. Even temporary degradation of such sensors can reduce detection timelines, complicate interception sequences, and force greater reliance on more distant or redundant sensors. In that sense, the strike fits the wider pattern of Iranian attacks on communications and ISR infrastructure across the region, targeting the technical nodes that underpin U.S. operational networks rather than simply the bases themselves.
From an Iranian perspective, this type of targeting would make operational sense in the opening phase of a conflict. U.S. and Israeli forces were conducting strikes inside Iran at a moment of maximum operational tempo, relying heavily on ISR networks, satellite communications, and inter-base coordination to sustain the pace of operations. Even limited disruptions to those systems could complicate targeting cycles, delay information flows, and increase friction within the operational network during the first hours of the war.
This targeting pattern is also notable because it differs in important ways from earlier Iranian strike campaigns, including the June 2025 twelve-day war and previous Operation True Promise retaliatory strikes. In those earlier operations, Iranian missiles and drones were primarily directed toward air bases, runways, and symbolic military targets, often in large salvoes designed to demonstrate reach and impose psychological pressure rather than to systematically degrade operational networks. The February 28 strikes, by contrast, appear more focused on technical infrastructure that enables U.S. and coalition operations—radomes, satellite terminals, and radar systems. Rather than emphasizing visible kinetic damage to bases themselves, the targeting suggests an attempt to disrupt the enabling architecture behind those bases, particularly the communications and sensor networks that allow dispersed forces to function as an integrated operational system. Even if the physical damage was limited,
Whether the strikes actually produced meaningful operational degradation is difficult to determine from open sources. U.S. systems are designed to absorb damage and maintain continuity through redundant pathways. But the broader point remains: the pattern of Iranian targeting suggests a deliberate attempt to disrupt the communications architecture that underpins U.S. regional military operations, rather than simply to strike American forces wherever they were located.
Economic Infrastructure
A second campaign unfolded simultaneously against Gulf Cooperation Council (GCC) states hosting U.S. military infrastructure, but here the targeting logic looks different from the strikes on U.S. C2 and ISR nodes. Iran reportedly launched 137 ballistic missiles and 209 drones toward the UAE, the largest single-country barrage of the day. Bahrain received dozens of missiles and drones, while Qatar was also struck repeatedly. In many cases the excess volume was directed not at military installations but at civilian and economic infrastructure.
Much of it landed on or near civilian and economic infrastructure, a pattern too consistent and too dispersed to be incidental. Several of the struck targets carried obvious signal value. A drone ignited the outer façade of the Burj Al Arab, one of the most globally recognized symbols of Gulf prosperity and ambition. The passenger terminal at Kuwait International Airport was damaged, injuring migrant workers and grounding commercial flights at a hub central to regional connectivity. A residential tower on Palm Jumeirah was hit, bringing the conflict into one of the most internationally visible real estate developments in the world. Drones also struck buildings in Seef, Bahrain’s financial district. None of these targets was militarily decisive. All of them were chosen, or at a minimum resulted in effects that were economically and psychologically legible to governments, investors, and insurers watching from outside the region.
Iran’s apparent logic was cost imposition on the host states as political actors, not merely as platforms for American power. Gulf economies are structurally exposed to exactly the kind of disruption these strikes were designed to generate. Aviation connectivity, tourism receipts, financial services, and maritime trade form the backbone of economic diversification programs that Gulf governments have staked considerable domestic legitimacy on. Even limited and localized attacks can produce outsized downstream effects: war-risk insurance premiums rise, airlines reroute or suspend service, hotel occupancy falls, and foreign direct investment decisions are quietly deferred. Tehran’s calculation appears to have been that inflicting these costs would create internal pressure within Gulf governments to seek an off-ramp, either by directly lobbying Washington for de-escalation or by quietly withdrawing the operational cooperation that sustains American strike capacity in the theater.
The political logic rests on a longstanding Iranian reading of the Gulf security environment. GCC states host the infrastructure that makes sustained U.S. military operations in the region possible. However, Tehran has consistently assessed that Gulf governments are not fully committed partners of Washington but rather states managing a precarious balance, seeking the security guarantee the U.S. presence provides while remaining wary of the costs that come with it. By striking economic infrastructure rather than confining itself to American military targets, Iran appears to have been testing whether that balance could be disrupted — whether the cost of hosting U.S. forces could be made tangible enough, and visible enough to domestic audiences and foreign investors alike, to shift the political calculus in Riyadh, Abu Dhabi, Manama, and Doha.
Israeli Population Centers
Unlike the June 2025 Twelve-Day War, the initial retaliation against Israel occurred relatively quickly after the opening strikes on Iran, suggesting that the IRGC Aerospace Force was able to begin launches even under conditions of leadership decapitation and communications disruption. At the same time, the overall volume of missiles fired was lower than during the earlier conflict. This likely reflects a combination of factors, including the degradation of Iranian launch infrastructure from the initial air campaign and the need to disperse strikes across multiple regional theaters.
Iran launched roughly 20 separate ballistic missile barrages that day, typically consisting of only two to four missiles each, for a total of approximately 125 missiles. The majority of the strikes were directed toward central urban areas, including Tel Aviv, Bnei Brak, Kafr Qaseem, Tirat Carmel, Jerusalem, Beer Sheva, Ramat Gan, Petah Tikva, and Rosh Haayin. Several missiles penetrated Israeli air defenses and landed in populated areas. One strike in Tel Aviv killed a civilian and injured dozens, while fragments and impacts caused injuries and property damage across the greater Tel Aviv metropolitan area.
The geographic distribution of strikes—heavily concentrated in Israel’s main population and economic corridor—suggests that the primary objective was not to destroy Israeli military infrastructure but to impose civilian disruption and psychological pressure. Rather than relying on a small number of large missile waves, Iran fired smaller barrages repeatedly throughout the day, sustaining frequent alerts and forcing civilians across central Israel into shelters.
This targeting pattern differs from earlier Iranian operations such as Operation True Promise I and II, where missile strikes were largely framed as retaliation against Israeli military infrastructure, including airbases and security installations. For example, Operation True Promise II in October 2024 targeted Israeli military facilities such as Nevatim Airbase and Tel Nof Airbase, emphasizing symbolic retaliation and the demonstration of Iranian reach. On February 28, by contrast, the strikes appear more consistently directed toward urban and economic centers, particularly in the Tel Aviv metropolitan region.
In many ways, the approach more closely resembles the later stages of Operation True Promise III during the Twelve-Day War, when Iranian launches increasingly shifted toward sustained disruption of civilian life rather than purely military targets. The apparent lesson Tehran may have drawn from that conflict was not simply to fire more missiles, but to structure missile use in ways that maximize societal and economic disruption, even when the overall volume of fire is lower.
The initial strikes on February 28 are likely to stand as one of the most analytically important days of the conflict. It marked the largest geographically coordinated Iranian strike operation in the history of the Islamic Republic, with missiles and drones launched across multiple theaters simultaneously—from Israel to the Gulf and beyond—raising important questions about the resilience of Iran’s command architecture and the degree of pre-delegation embedded in IRGC retaliatory planning. The strikes also reveal a shift in Iranian targeting logic. Rather than focusing primarily on symbolic military targets, as in earlier operations such as Operation True Promise I and II, the campaign emphasized the enabling infrastructure behind military power—communications nodes, radars, and satellite terminals—while simultaneously imposing economic pressure on Gulf host states and directing strikes toward civilian centers in Israel. Finally, the operation provides an early indication of how Iran may attempt to fight under conditions of leadership decapitation and degraded communications, as retaliatory launches still occurred across several regions within hours despite the killing of senior officials and widespread disruption to Iran’s communications networks.
I will try to post additional day-by-day analysis of the strikes and targeting patterns as more information becomes available. Much of what we currently know comes from fragmented reporting, satellite imagery, and early official statements. As more imagery, technical assessments, and operational details emerge, the picture of how these strikes were planned and executed will likely become clearer.