Iranian Influence Operation Floods X With Anti-Protest Messaging

Following weeks of intense protests against the ruling regime across Iran’s 31 provinces, Tehran is continuing to flood social media with bots, turning social media into a tool of domestic repression. The Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies (FDD) has identified an influence operation likely linked to the regime that delegitimizes dissent, intimidates protesters, and reinforces regime narratives.

While the network pays lip service to the enormous economic hardships currently facing Iranians, amid a collapsing currency and soaring food prices, it frequently demonizes the protests as unlawful riots. A small minority of posts take an even harsher tone. Some label protesters as “seditionists” and include calls for rioters to be “put in their place.” A smaller subset uses more aggressive language, referring to protesters as “thugs,” and a limited number advocate extreme punitive measures, including calls for execution. Other posts blame foreign adversaries, principally the United States and Israel, for domestic unrest.

A Hybrid Network of Bots and Humans

The coordinated network includes at least 289 accounts on X that post identical Persian-language content within one minute of each other. Additional accounts post identical content asynchronously, suggesting the broader network is likely larger. The network’s behavior suggests a hybrid model combining automated posting with human operation.

Most coordinated activity occurred in replies rather than original posts, suggesting an effort to hijack conversations and suppress dissent within broader discussions. Accounts in the network also frequently replied to one another’s posts, which manufactures inauthentic engagement and creates a sense of organic consensus.

Accounts in the network frequently paired posts with coordinated hashtags such as #ShutUpTrump and references to the son of the deposed Shah of Iran, Reza Pahlavi, as a “Zionist.” Posting identical hashtags in coordinated bursts can artificially boost visibility in platform ranking and trending algorithms, amplifying regime narratives at scale. The network appears to be based in Iran, as indicated by X transparency features and the sharp decline in activity following nationwide internet shutdowns on January 8.

While individual posts generally received limited engagement, a small number of posts reached a wider audience, including one tweet that received nearly 3,000 likes and more than 50,000 views. In total, content posted by the network generated more than 18 million views and over 800,000 likes across over 30,000 posts

The Online Wing of the Regime’s All-Volunteer Paramilitary of Repression

The network appears to be linked to the Basij — the volunteer paramilitary force operating under the Islamic Revolutionary Guard Corps. The Basij Cyberspace Organization oversees online psychological operations intended to counter domestic dissent. Most accounts post content branded with Basij logos, and one explicitly self-identifies as a Basij member.

A key component of this apparatus is MATNA, a Basij subdivision responsible for producing and distributing ideological content across social media platforms. Another unit, Shamsa, coordinates disinformation campaigns and trains operatives to identify, harass, and discredit regime critics online. Most accounts amplify graphics with Shamsa or MATNA’s logos and reuse hashtags posted on their associated Telegram channels.

The United States Should Sanction Key Personnel from the Basij, Shamsa, and MATNA

To further counter the regime’s repression tactics, Washington should expand previous sanctions targeting Basij cyber leadership to include key personnel from its digital entities like Shamsa and MATNA.

Moreover, the leading social media platform X recently replaced the Iranian flag emoji with the pre-1979 monarchy flag. If the platform intends to support the Iranian people, it should pair such symbolic changes with enforcement actions by investigating regime-linked, coordinated activity, and removing accounts that violate its policies on manipulation and spam.

Max Lesser is a senior analyst on emerging threats at the Foundation for Defense of Democracies’ (FDD’s) Center on Cyber and Technology Innovation, where Maria Riofrio is a research assistant. For more analysis from the authors and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on foreign policy and national security.