On 19 August 2026, the Financial Times reported that Iran had assessed strikes on US and allied targets in Europe. Two named sites: Bezmer Air Base in Bulgaria, where US KC-135 tankers now sit, and RAF Akrotiri on Cyprus, hit by a proxy drone in March. Within hours, the pro-Kremlin channel Rybar took that reporting, wrapped it in a reachability map, and pushed it to Russian-speaking and MENA audiences. The facts were real. The frame was not.
That is the whole problem in one move. Rybar did not fabricate. It laundered a paywalled Western story, added a persuasive graphic, then hedged its own alarm to build analyst trust while seeding the core message: US bases drag small allies into war, and any base is a legitimate target. The UK sanctioned Rybar in December 2025 as a directed state information asset. The threat is genuine. The amplification is the operation.
This assessment reads both layers at once. It separates what Iran can do from what Russia wants you to feel.
The near-term kinetic read is steady. A direct missile strike on either base is Unlikely (15 to <45%) and self-deterring, because it would trip NATO Article 5 or the EU’s Article 42.7 and close Tehran’s only exit ramp. Deniable, sub-threshold action is Likely (55 to <85%): proxy drones, shipping and cable coercion, cyber, and diaspora operations. This is not pre-war Iran. Supreme Leader Khamenei was killed on 28 February 2026. His hardline son Mojtaba now leads a decapitated, cornered regime running the war inside an economic collapse, with inflation near 62 percent. That widens the miscalculation tail even as a deliberate strike stays unlikely.
Three findings move the picture the most
Two bases, one shield — not really
Bezmer is undisputed NATO territory. Akrotiri is a British Overseas Territory on non-NATO Cyprus, and its Article 5 coverage is contested and untested. When Akrotiri was struck in March, London responded nationally, with no NATO consultation. Akrotiri is the softer target, and the record proves it.
The sanctions lever is spent
E3 snapback completed on 27 September 2025, before the war. There is no fresh UN card left to play against European escalation. That removes a lever the West would otherwise assume it still holds.
The target may remove itself
Bulgaria’s authorization for the Bezmer tankers expires on 1 October 2026, and a fresh parliamentary vote is required to continue. Make extension impossible in Sofia and the tankers leave on their own — a cheaper endpoint than a missile, with none of the Article 5 risk.
The contest through September is political, in Sofia, not kinetic. That serves Moscow and Tehran better than a strike. It carries none of the Article 5 risk, and it turns local opposition around a single air base into the decisive terrain.
The full 24-page assessment carries the capability breakdown, the order of battle and supply-chain interdiction, the economic-coercion analysis, the structured analytic techniques, the ASA tri-score and NATO 6×6 evidence grading, and thirteen figures. Read it for the collection requirements and the counter-influence recommendations.
Read the full assessment
The complete Treadstone 71 product, with figures, probability bands, and the counter-influence playbook. Built for analysts, boards, and decision-makers who need signal, not noise.
Treadstone 71 open-source defensive threat intelligence. Probability language uses Sherman Kent half-open bands. Facts and adversary claims are kept separate. No operational content by design. Direct link to this brief: treadstone71.com/crosshairs