Independent investigation finds Iranian regime cyber activity inside networks promoting son of Iran’s deposed Shah
Independent investigation finds Iranian regime cyber activity inside networks promoting son of Iran's deposed Shah
1/26/2026
This is an independent investigation titled "Coordinated
Inauthentic Behaviour – Deceptive Amplification", which exposes a sophisticated
digital influence operation linked to the online ecosystem promoting Reza
Pahlavi, the son of Iran's deposed Shah, a figure lacking both democratic
mandate and organic support inside Iran
The investigation's central finding is unambiguous: Iranian regime cyber and intelligence actors have actively infiltrated and exploited networks that artificially amplify Pahlavi's online presence. What is presented publicly as grassroots support is, to a significant degree, manufactured through automated accounts, scripted language, synchronised posting patterns, and recycled imagery designed to inflate legitimacy and visibility.
Crucially, the investigation documents how regime-linked cyber units operating from inside Iran—including assets connected to the Islamic Revolutionary Guard Corps (IRGC) and the intelligence apparatus—have operated within these same monarchist networks. Using "White SIM" cards and state-authorised, unfiltered internet access, these actors were able to post directly from Iran, embed themselves among aggressively pro-Pahlavi accounts, and steer online discourse from within.
This is not incidental overlap. The investigation describes a deliberate "Trojan Horse" dynamic: a pre-existing, artificially inflated monarchist network provided ideal cover for regime cyber operators. Once embedded, these actors amplified polarising slogans, encouraged toxic behaviour, and later weaponised the resulting content to claim that Iran's opposition is fragmented, extreme, or foreign-manufactured.
The operation delivers clear strategic gains for Tehran: it fragments the opposition, elevates a controllable and politically ineffective figure, and supplies ready-made propaganda material to discredit genuine resistance movements.
The investigation was produced by Treadstone 71 and authored by Dancho Danchev, an independent analyst specialising in cyber operations and influence warfare. It draws on more than 70 million data points across X (Twitter), Instagram, and Telegram, using reproducible methods rather than political interpretation.
Link to download the PDF file :