The new tactics of Khamenei's cyber army

photo_camera ali-jamenei-iran-ciberejercito

Since September 2022 and the uprising sparked by popular anger at the assassination of Mahsa Amini, the Iranian authorities have used every possible means to dissipate the revolt and expel the resisters. Visible and radical means: violent repression, torture, public executions. But also more "discreet" means. As a paradox, the power with medieval laws promotes cyberwarfare as one of its most serious levers. The fact is that, after China, Iran has the second largest cyber army in the world... 

The Armed Forces General Staff recently informed all military forces that cyber battalions would be required to conduct exercises. These exercises are currently underway, and will continue at least until the end of the Iranian yeari, in all provinces of the country. In addition, the regime's virtual space organisation is obliged to check the performance of these battalions on a weekly basis and report on them to the army commander in Tehran in all regions.  

Image warfare 

The regime's propaganda methods have thus evolved. From now on, the cyber-army focuses on the production of content on the web; texts, photos, video clips, slogans, headlines... Everything is done to give the impression of spontaneous posts or comments praising the regime and intended to create doubts in rebellious minds. However, in the emergency, the Iranian authorities had to go through the motions and internet users are not fooled for long by these messages praising the supreme guide... It seems that one of the most frequent messages these days on the networks is: "Is your post paid for?" It even seems that, for the sake of discretion and total anonymity, the famous payments are now being made on gift cards! 


Another common phenomenon in recent months, especially on social networks used by the regime, is so-called "cyberbullying". It is defined in such a way that various types of information and communication technologies are used in a planned, repeated and hostile way by an individual or group (more or less anonymous) for the purpose of harassment. Sexual messages, physical and psychological threats, gratuitous obscenities, defamation, mockery, publication of reputation-damaging lies.... All means are good. Regularly raised since 1999 as a social problem on the virtual web, cyberbullying has now become a weapon designed to break the ties that bind ordinary people together, to shatter their trust and destroy their psyche. 

The regime's cyber tactics 

The fact is that, since the beginning of the revolt, the old methods used by the government (public accounts on social networks) are no longer effective, as the population frustrates the propaganda presented by the state. The latter has had to evolve and now uses "disguises" to continue its undermining work. It is not uncommon to find among the defenders of the current power a narrative that calls for the overthrow of the regime. Broadly speaking, social media accounts can be divided into five categories: 

First category: high-volume, robotic accounts

This is an old and revived method called "operation like". These accounts operate in high volume with classic robotic work, i.e. saturating, overwhelming or even cluttering the virtual space with pro-regime messages in order to minimise the impact of pro-revolution messages and hashtags.   

Second category: accounts that vary according to the regime's daily needs 

Many accounts created by the regime's cyber-army change their nature, name and even political colour on a daily basis. One day monarchist, the next fundamentalist or reformist, and the following week revolutionary, according to the regime's communication needs. These accounts maintain a totally free and fearless exposure. Moreover, the history of these accounts gives away their functions, as many messages contradict each other. The aim of feeding these bots is to create division, distrust in Iranian society and desperation with fear of protest. Thousands of accounts repeat the same formulations at the same moments, giving the impression of a wave of spontaneous expression aimed at keeping the people under the regime's thumb. 

Third category: accounts named as "insurgents" or "monarchists" or... 

There is also a whole series of accounts supposedly attributed to insurgents from various groups or groups of people who wish to overthrow the regime. However, these accounts are attached to the Ministry of Information and their purpose is to gather information on insurgents and resistance fighters who are connected. The other interest of these accounts for the regime is to sow doubt in the minds of exiles, making them believe, for example, that royalists have a large base in the population, thus creating fear, deception and even artificial divisions among opponents.  

Fourth category: accounts known as Twitter and Instagram accounts and ..... 

These accounts, with their deliberately rogue behaviour, operate under the guise of fighting the regime. Their names are often bizarre. Firstly, they try to attract followers by continuously writing daily content in order to have a base. Secondly, they may widely publish fake and specifically anti-resistance news. Their aim is to create deviant waves and spread fake news attacking resistance forces. 

Fifth category: tapping into influential accounts 

The fifth category is not a new phenomenon, but its expansion in the recent uprising is very impressive. This category includes influential accounts with known identities and faces. Most of these people are yesterday's ideologues (e.g. supporters of Khatami or Rohani) or people with interests in the regime, and some are in fact employees of the regime whose income comes from the social network used. Most of them live outside Iran. Their social media content is apolitical, but when the regime needs it, they do better than any paid regime advertisement by publishing a post, filling out a clip and spreading it widely. Their main objective is the demonisation of the resistance, intimidating and creating a wave of pressure and threats against those who support the resistance in Iran and have taken a stand against the regime. The owners of these sites are abroad, but they have officially tweeted and posted that they voted for Rohani in the previous elections! Of course, some of them have deleted their previous content due to the revolt-related atmosphere, but in any case, they are openly engaged in helping the regime at different times. 

The cyber-regime and the democratic uprising of the Iranian people 

The spread of the democratic uprising of the Iranian people has led the regime, in addition to all the above-mentioned cases, to resort to complementary actions such as buying people, using sleeper cells and swallowsii. We see lobbyists, journalists, analysts and professors working for the regime. Some of them are former representatives or ambassadors of the regime and now work as university professors, for example. There are also famous sons of the regime and businessmen abroad, who appear in the movement and work according to the regime's interests. Among them, there are also non-Iranians serving the regime's interests, active against the uprising in addition to their usual stances against the Iranian resistance, their main cause. 

These people work in different sectors of activity, from language teaching to selling sex for health, from bodybuilding to newspaper writing and fashion. The aim of these pressure groups is always the same, to try to discredit the CNRIiii, to make people believe in the rise of the monarchists in order to assert that the only permanent political solution is embodied by the supreme guide and theocracy. No doubt many of these "good thinkers" will know how to turn their backs when the time of collapse comes. But then they will do their best to promote an authoritarian alternative to the mullahs, once again disguising it as democracy.... 


[i] The Iranian calendar sets the new year on the day of the spring equinox, around 21 March.  

[ii] In the language of the Iranian regime, swallows are women recruited by the Ministry of Information.  

[iii] The National Council of Resistance of Iran, which groups together all the groups opposing the theocratic regime and is chaired by Maryam Rajavi.