Social Media as a Weapon: Narrative Warfare Against the Iranian Uprising

An OSINT Investigation into Coordinated Influence Operations Linked to the Islamic Republic on X During Iran’s 2026 Uprising

 

Introduction

An ongoing investigation conducted by Golden Owl® has identified a sophisticated, state-aligned influence network operating in support of the Islamic Republic regime in Iran. This network consists of thousands of coordinated accounts exhibiting behavioral patterns consistent with systematic efforts to manipulate public perception, disseminate propaganda, and suppress dissenting voices of the Iranian people.

Important Distinction: Throughout this report, we deliberately distinguish between the Islamic Republic regime that has ruled Iran since 1979 and Iran itself, its people, culture, and millennia of civilization. The Iranian people are the first and foremost victims of this regime, and many of the accounts identified in this investigation operate in ways that suppress their voices on the international stage.

This blog presents findings from our analysis of the X (formerly Twitter) component of a broader campaign spanning more than 15,000 accounts across X and Instagram. Some datasets have been published open-source on GitHub for independent verification and further research; others remain under review pending publication or submission to relevant authorities.

 

Understanding Influence Operations: A Brief Primer

Before presenting the findings, it is important to outline how modern state-aligned influence campaigns typically operate. Such operations often employ a hierarchical structure:

Seeds / Originators

These are content-producing accounts with significant reach that generate original narratives, talking points, and messaging. They establish agenda-setting content that propagates through the network. Originators typically exhibit high follower counts, elevated engagement rates, and often present themselves as journalists, analysts, or commentators.

Amplifiers

Amplifiers function as force multipliers. These accounts primarily retweet, repost, or otherwise boost content produced by originators. They frequently operate at high volumes, sometimes posting dozens or hundreds of times per day, contributing to the appearance of organic, widespread support. Many exhibit behavioral patterns commonly associated with automation or centralized management.

The Coordination Factor

What distinguishes coordinated influence operations from organic discourse is synchronization. Large numbers of accounts created within narrow time windows, repeatedly sharing identical or near-identical messaging, activating during specific geopolitical events, and exhibiting temporally aligned behavior patterns indicate the presence of operational infrastructure rather than spontaneous participation.

 

The Investigation: Methodology & Scope

Data Collection

The investigation analyzed 7,924 total account records across two interconnected datasets:

 

Key Metrics Uncovered

Account Classification (of 7,924 total records)

Methodology note: “Bot-type” refers to behavioral indicators consistent with automation or centralized management and does not constitute a definitive determination of fully automated accounts.

 

Key Coordination Indicators

 

Monthly Creation Patterns & Geopolitical Correlation

Key Finding:
The network shows clear temporal correlation with major geopolitical events. The 27% of all accounts (2,139) created after October 7, 2023 represents a statistically significant surge; nearly one-third of the entire network was built following recent crisis events.

The 5.44% overlap between datasets is particularly notable. In organic networks, minimal overlap would be expected between followers of a political leader and a separate influence network. This overlap represents 409 accounts functioning as bridge nodes, forming the connective tissue of a coordinated operation.

The Originators: 510 Accounts Driving the Narrative

Our analysis identified 510 accounts functioning as originators within this network. These accounts share common characteristics:

• Combined reach: Over 12 million followers

• Average follower/following ratio: 285:1, indicating influence rather than reciprocal following

• Geographic distribution (declared): United States (62), Iran (21), United Kingdom (18), Yemen (15), Nigeria (14)

Notable Originator Patterns

The top originators include a mix of:

• Official regime media accounts (e.g., Tasnim News, Fars News)

• Regime-aligned influencers with hundreds of thousands of followers

• Pseudo-independent “analysts” promoting regime narratives

• Activist accounts that systematically attack opposition voices

Many of these accounts have operated for years, building credibility while consistently advancing Islamic Republic talking points. The most influential originator in the dataset commands over 1.1 million followers, providing a substantial platform for narrative control.

 

The Amplification Machine: 2,503 High-Activity Accounts

Some amplifier accounts post over 500 times per day, a rate impossible for genuine human users to sustain. These accounts serve as the "echo chamber" that makes regime narratives appear more popular and widespread than they actually are.

 

What They're Spreading: Content Analysis of Originator Accounts

Content analysis of tweets from a representative sample of the 510 identified originators reveals four recurring thematic categories. Content is described analytically without reproducing harmful material.

Content Category 1: Anti-Pahlavi Campaigns

Pattern Analysis:
The network systematically targets the Pahlavi name and constitutional monarchy advocates — a central opposition movement with substantial popular support among Iranians. The sustained focus on this target indicates regime recognition of the movement as a primary political threat. Messaging repeatedly attempts to associate this opposition with foreign enemies in order to undermine domestic and international legitimacy.

 

Content Category 2: Anti-Semitism

Pattern Analysis:
The network produces anti-Semitic content ranging from coded language to overt hate speech. Multiple originators exceed platform Terms of Service thresholds. This messaging aligns with longstanding elements of the Islamic Republic’s official ideological discourse since 1979.

 

Content Category 3: Regime Glorification & Theocratic Promotion

Pattern Analysis:
Originators consistently frame the regime as a religious and moral authority while portraying opposition movements as enemies of religion or foreign agents. Content mirrors official regime messaging and military rhetoric.

 

Content Category 4: MEK & Separatist Alignment

Pattern Analysis:
The dataset includes accounts promoting regional fragmentation narratives and MEK-aligned messaging. Despite historical conflict between MEK and the Islamic Republic, both converge tactically on a shared target: the Pahlavi legacy and constitutional monarchy advocates.  

 

Summary: Content Typology

Methodology Note:
Content categories were derived through thematic clustering of observed patterns in sampled originator content.

 

Timeline Analysis: The October 2023 Surge

The timing is not coincidental. On October 7, 2023, Hamas, an organization publicly supported and funded by the Islamic Republic, carried out a massacre in Israel. In the weeks and months that followed, the network experienced a pronounced surge in account creation.

Peak Creation Periods

Twelve specific days exhibited anomalously high creation rates (five times the baseline average), clustering around crisis events, protest crackdowns, regional escalations, and international pressure points. This batch-creation behavior is a recognized hallmark of coordinated influence infrastructure scaling.

 

Activity During Iran’s Digital Blackout

One of the most significant findings concerns account activity during periods when the Islamic Republic regime imposed internet restrictions on the Iranian population.

During the January 2026 uprising, a large-scale protest movement associated with demands for political change and the return of the exiled Crown Prince Reza Pahlavi, the regime implemented a near-total internet blackout. This communications shutdown served to restrict public expression, limit documentation of events, disrupt coordination among protesters, and control outbound information flows.

Despite these restrictions, accounts within the analyzed network maintained high levels of activity.

This is only possible if:

1. The accounts operated from outside Iran, or

2. They had access privileges unavailable to ordinary Iranian users.

Either scenario sugests that these accounts do not represent organic, civilian Iranian voices. The observed behavior is consistent with organized, privileged, or state-aligned operations functioning while the broader population was denied access to the internet, amid widespread and well-documented lethal repression, including massacres of protesters, thousands reported killed, and many more injured, arrested, or executed. While exact figures remain difficult to verify due to information suppression, the existence of large-scale violence is not in dispute and is corroborated by multiple independent and credible sources.

 

Geographic Distribution: The Global Footprint

The declared locations of accounts in this network indicate a global footprint:

The low level of declared presence in Iran (0.6%) is striking. During periods of nationwide internet blackout, ordinary users inside Iran were unable to access the internet. Accordingly, the observed pattern may indicate one or more of the following:

• Operational security measures, including deliberate concealment of true location

• Use of VPNs or other technical means to mask geographic origin

• Recruitment or participation from diaspora communities

• Activity by a limited set of selected individuals with privileged or unrestricted internet access inside Iran, operating under special connectivity arrangements unavailable to the general population during blackout periods

This distinction is relevant, as sustained online activity during blackout periods is inconsistent with ordinary civilian access and suggests the involvement of privileged or unrestricted connectivity.

 

Note: A separate dataset of accounts reportedly operating with so-called “white SIM cards” (government-issued SIMs that may allow unrestricted internet access during blackout periods) from within Iran has been published in our GitHub open-source repository. This dataset provides additional context supporting the presence of privileged or non-standard connectivity during periods of widespread civilian internet restriction.

The concentration of declared locations in Western countries (including the United States, the United Kingdom, Germany, and Canada) suggests that a primary focus of the network’s activity may be the shaping of Western public opinion and engagement with policymakers, rather than domestic Iranian audiences.

 

Bot Indicators: The Inhuman Scale

Our technical analysis identified multiple bot-like and inauthentic behavior indicators across the network:

More than 40% of accounts in the network exhibit at least one bot-associated indicator. This does not imply that all such accounts are fully automated; some may involve human operators managing multiple accounts or semi-automated workflows. However, the prevalence and concentration of these indicators are inconsistent with organic, civilian-driven participation and support the assessment that this network does not represent a spontaneous or authentic online community.

 

Conclusion: The Digital Battlefield

The evidence presented in this investigation supports the conclusion that the Islamic Republic regime has developed a sophisticated, multi-layered influence operation designed to:

• Shape narratives about Iran on global social media

• Suppress Iranian voices seeking freedom and democratic change

• Disseminate propaganda aligned with regime ideology

• Influence Western public opinion and policy discourse

These findings are grounded in reproducible data and observable patterns, including 7,515 unique accounts, 510 originators, 2,503 amplifiers, and 409 bridge nodes, alongside coordinated account creation and sustained activity during nationwide internet blackouts.

The Stakes

While this may appear to be an abstract “information war,” the consequences are concrete and measurable:

• Iranian protesters have been identified and arrested based on social media activity

• Diaspora activists face sustained harassment and threats

• Western policymakers are exposed to distorted or manipulated information

• The Iranian people’s call for freedom and regime change is drowned out by manufactured noise

 

What Happens Next

Golden Owl will continue to investigate this network. Additional datasets are currently under review for:

• Publication on GitHub for independent verification

• Submission to platform integrity and trust-and-safety teams

• Provision as evidentiary material to relevant authorities

We call on:

• Social media platforms to investigate the identified accounts and enforce their applicable policies

• Researchers to independently verify, replicate, and expand upon these findings

• Policymakers to recognize the scale and impact of influence operations linked to the Islamic Republic

• Media organizations to critically evaluate sources connected to this network

• The public to remain aware that not all apparent “voices” on social media represent genuine, organic participation

 

About This Research

This investigation was conducted by Golden Owl®, an independent research initiative focused on identifying and analyzing authoritarian influence operations and supporting digital transparency and freedom.

Methodology: Open-source intelligence (OSINT) techniques, including account metadata analysis, temporal pattern detection, network overlap analysis, and behavioral indicator assessment.

Data Availability: Select datasets are available on GitHub. Additional datasets remain under review pending publication or submission to relevant authorities.

Contact: E-mail · Contact Form · X

 

We stand in solidarity with the people of Iran, whose voices are repeatedly constrained through repression and information control. Raising awareness is the first step in confronting disinformation and narrative warfare.