The IRGC’s Digital Warfare: Spying on Citizens and Spreading Disinformation

The Islamic Revolutionary Guard Corps (IRGC) has evolved into one of the most sophisticated digital enforcers of state control and propaganda in the world. Through mass surveillance, cyber warfare, and disinformation campaigns, the IRGC manipulates public perception, suppresses dissent, and spreads its influence beyond Iran’s borders. It has built an extensive digital spying network, monitoring Iranian citizens, activists, journalists, and political opponents at home and abroad. At the same time, it runs covert disinformation operations on social media to control narratives and counter opposition movements.

This report examines how the IRGC exploits digital tools for surveillance, censorship, cyberattacks, and global propaganda, as well as how international actors can respond.

1. The IRGC’s Digital Surveillance System: Spying on Iranian Citizens

The IRGC, in collaboration with Iran’s intelligence agencies, operates an extensive digital surveillance apparatus to monitor, track, and suppress any form of dissent.

A. Internet Censorship and Surveillance

 • The IRGC enforces strict internet censorship, blocking news websites, social media platforms, and communication apps to limit access to outside information.

 • Deep packet inspection (DPI) technology enables the regime to monitor and filter online activity in real-time.

 • Encrypted messaging apps like Telegram and WhatsApp have been compromised by state-backed hacking efforts, putting activists at risk.

B. AI-Driven Facial Recognition and Tracking

 • In 2023, Iran implemented AI-driven surveillance cameras to track women who violate hijab laws.

 • The IRGC has used similar facial recognition technology to identify and arrest protesters.

 • AI-driven surveillance has been expanded to monitor public gatherings and control opposition movements.

C. Targeting Activists and Journalists

 • The IRGC hacks the phones, emails, and social media accounts of activists and journalists inside and outside Iran.

 • It conducts phishing attacks to steal passwords and access private communications.

 • Example: In 2022, Iranian journalist Masih Alinejad, a vocal critic of the regime, was targeted by IRGC cyber operatives in a failed kidnapping attempt.

2. Cyber Warfare: The IRGC’s Global Digital Attacks

The IRGC has expanded its cyber operations beyond domestic repression, targeting foreign governments, corporations, and infrastructure through cyber espionage, hacking, and digital sabotage.

A. Attacks on Critical Infrastructure

 • The IRGC has carried out cyberattacks on foreign governments and corporations, including:

 • U.S. banks (2011-2013) – Large-scale cyberattacks on financial institutions.

 • Saudi Aramco (2012) – The Shamoon virus wiped out 30,000 computers in a devastating cyberattack.

 • Israeli water systems (2020) – Iranian hackers attempted to sabotage Israel’s critical water infrastructure.

B. Cyber Espionage Operations

 • The IRGC’s cyber units steal sensitive data from foreign governments, companies, and human rights organizations.

 • Front companies in the cybersecurity industry allow Iran to develop advanced hacking capabilities under the radar.

 • Iran-linked hackers have been caught stealing research on COVID-19 vaccines, U.S. military plans, and opposition group strategies.

C. Spreading Malware and Ransomware

 • IRGC-backed cyber groups distribute ransomware and spyware to infiltrate computers and disrupt operations.

 • Example: The APT35 (Charming Kitten) hacker group has targeted government officials, academics, and journalists worldwide.

3. The IRGC’s Digital Propaganda Machine: Spreading Disinformation

Beyond hacking and surveillance, the IRGC actively spreads false narratives, manipulates social media, and controls public discourse.

A. Fake Social Media Accounts

 • The IRGC runs thousands of fake accounts on Twitter, Facebook, and Instagram to:

 • Spread pro-regime propaganda.

 • Discredit activists and journalists.

• Manipulate trending hashtags to drown out opposition content.

 • Example: In 2020, Facebook removed over 300 fake accounts linked to the IRGC, which were spreading anti-U.S. and anti-Israel messages.

B. State-Controlled Media and Disinformation

 • IRGC-run outlets like Press TV, Tasnim News, and Fars News spread pro-regime narratives and misinformation.

 • Disinformation tactics include:

 • False reports about opposition protests.

 • Fabricated “confessions” from detainees.

 • Conspiracy theories to blame unrest on “foreign interference.”

C. Targeting the Iranian Diaspora

 • The IRGC launches smear campaigns against Iranian exiles, activists, and opposition leaders.

 • It uses deepfake videos, fake news stories, and false allegations to damage the reputations of human rights advocates.

4. The Impact of IRGC Digital Warfare on Iranian Society

The IRGC’s digital control has significant consequences for Iranian citizens, activists, and the global community.

A. Silencing Dissent and Spreading Fear

 • The constant surveillance and threat of arrest deter many Iranians from speaking out.

 • Protesters and activists live in fear of digital tracking, arrest, and execution.

B. Manipulating Global Perception

 • The IRGC spreads false narratives to discredit opposition movements and downplay human rights violations.

 • International audiences are exposed to manipulated stories, making fact-checking and independent journalism more critical than ever.

C. Disrupting Foreign Governments and Economies

 • IRGC cyberattacks destabilize foreign institutions, harming economies and security infrastructures.

 • The rise in cyber warfare has escalated tensions between Iran and the U.S., Israel, Saudi Arabia, and European nations.

5. How the International Community Can Counter IRGC Digital Warfare

Given the growing threat of IRGC cyber warfare and digital oppression, governments and civil society must take decisive action.

A. Strengthen Sanctions on IRGC Cyber Units

 • The U.S. and EU must impose additional sanctions on IRGC cyber divisions and affiliated hacker groups.

 • Financial restrictions on IRGC-linked technology firms can help cut off access to surveillance tools.

B. Support Digital Freedom for Iranians

 • Provide secure communication tools like VPNs and encrypted messaging apps to protect Iranian activists.

 • Invest in anti-censorship technology to counter IRGC efforts to shut down the internet.

C. Expose and Counter Disinformation

 • Social media platforms must increase transparency and remove IRGC-linked accounts spreading propaganda.

 • Independent fact-checking organizations should focus on debunking IRGC disinformation campaigns.

D. Enhance Cybersecurity Measures Against IRGC Attacks

 • Governments and corporations must strengthen cybersecurity defenses against IRGC-backed hacking operations.

 • International cooperation on cybersecurity can help track and disrupt IRGC digital warfare activities.

Conclusion

The IRGC has weaponized digital tools to spy on Iranian citizens, suppress protests, manipulate public discourse, and launch cyberattacks globally. Through surveillance networks, social media disinformation, and cyber espionage, it has built a powerful digital warfare system that threatens human rights, regional stability, and global security.