U.S. and Europe in coordinated action against IRGC’s online presence

Europol announced today (May 18) that a total of 14,200 posts linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) have been targeted in a coordinated action against terrorist content online. The operation involved 19 countries* coordinated by Europol and working in synchronized phases to collect intelligence, cross-check targets and carry out joint referrals to online platforms.

Led by Europol’s EU Internet Referral Unit (EU IRU), the action focused on identifying and disrupting the group’s online presence used to spread propaganda, recruit supporters and raise funds.

The IRGC, a central pillar of Iran’s military apparatus, was formally designated as a terrorist organisation by the European Union on February 19, 2026 under Council Decision (CFSP) 2026/421. This designation allows law enforcement to take action against activity of its members and its supporting entities in the EU.

The operation, which concluded on April 28, found that content was spread across mainstream social media platforms as well as streaming services, blog hosting sites and standalone websites. Propaganda was identified in several languages, including Arabic, Bahasa Indonesia, English, French, Persian and Spanish. The material ranged from speeches blending religious martyrdom narratives with highly charged political messaging to AI-generated videos glorifying the IRGC and calls to avenge the Ayatollah Ali Khamenei.

The interconnectedness of IRGC-linked websites operating across multiple languages offered important insights in the network’s online architecture, Europol said. Investigating how IRGC propaganda was disseminated and amplified online also supported efforts to trace and remove statements and videos produced by proxy groups and aligned entities, including Hezbollah, Ansar Allah, Hamas, PIJ and HAYI.

The IRGC’s main X account, boasting over 150,000 followers, was withheld in the EU following this action, and thousands of other links on several platforms were taken down or are in the process of being investigated and removed.

Investigators also uncovered how the IRGC continues to grow its digital playbook.

“The action revealed the group’s reliance on a network of hosting service providers across multiple jurisdictions, from Russia to the United States, helping it to maintain resilience online” Europol said. “Such providers may have also been offering hosting services before the IRGC’s formal designation, and Europol continues to engage positively with involved Member States and private parties.”

Authorities also identified the use of cryptocurrency transactions to sustain and amplify online operations.

In addition to IRGC-originated content, Iran has been expanding its information operations campaign to include attacks, such as that on Bluesky earlier this year. The pro-Iran hacking group The Islamic Cyber ​​Resistance in Iraq – 313 Team claimed it disrupted Bluesky with what the social media site called a “sophisticated” attack. Other pro-Iranian actors have been spreading propaganda, such as the AI videos of Lego characters, which have been widely viewed around the world.

*The countries that participated in the coordinated action against IRGC content were: Austria, Belgium, Bosnia and Herzegovina, Bulgaria, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Netherlands, Portugal, Spain, Sweden, Ukraine and the United States.