Independent investigation reveals cyber activities by the Iranian regime on networks promoting the son of Iran's deposed Shah

The recently published independent investigation entitled ‘Coordinated Inauthentic Behaviour: Deceptive Amplification’ exposes a sophisticated digital influence operation related to the online ecosystem promoting Reza Pahlavi, the son of the deposed Shah of Iran, a figure who lacks democratic mandate and popular support in Iran.

The main conclusion of the research is unequivocal: actors in cyberspace and the Iranian regime's intelligence services have actively infiltrated and exploited networks that artificially amplify Pahlavi's online presence. What is publicly presented as popular support is, to a large extent, an invention created through automated accounts, pre-scripted discourse, synchronised posts, and recycled images designed to inflate his legitimacy and visibility.

The investigation reveals a crucial point: how cyber units linked to the regime and operating from within Iran—in particular, resources linked to the Islamic Revolutionary Guard Corps (IRGC) and intelligence services—have been active within these same monarchist networks. Thanks to ‘white’ SIM cards and state-authorised unfiltered internet access, these actors were able to post directly from Iran, infiltrate fervently pro-Pahlavi accounts, and steer online discourse from within.

This is not a mere coincidence. The research describes a deliberate “Trojan horse” dynamic: a pre-existing, artificially inflated monarchist network provided ideal cover for the regime’s cyber operators. Once infiltrated, these actors amplified divisive slogans, encouraged toxic behaviour, and then exploited the content thus created to claim that the Iranian opposition is fragmented, extremist, or manipulated from abroad.

The operation offers undeniable strategic advantages to Tehran: it fragments the opposition, brings a controllable but politically ineffective figure to power, and provides ready-made propaganda material to discredit genuine resistance movements.

This investigation was conducted by Treadstone 71 and written by Dancho Danchev, an independent analyst specialising in cyber operations and influence warfare. It is based on more than 70 million data points from Twitter, Instagram and Telegram, and uses reproducible methods rather than political interpretations.