Briefing Summary

Understanding Influence, Behaviour and Emerging Online Risk

In the current conflict, the information environment is as contested as the battlefield. Iran's regime has invested billions in a sophisticated media machine - and with AI-generated content now scaling at speed, the line between real and fabricated has never been harder to identify. For businesses and compliance teams, the risks extend well beyond reputational damage into sanctions exposure, fraud and financial crime. This briefing maps how Iran's disinformation ecosystem operates and what it means for your organisation.

‍

What's Inside

• An inside look at Iran's social media machine - including the IRGC's sprawling media ecosystem, IRIB's estimated $1 billion annual budget, and a network of 7,500 coordinated X accounts amplifying regime-aligned narratives during major events, with spikes in account creation timed to coincide with domestic internet shutdowns
• A case study on Iraqi militia fundraising disguised as informal voluntary aid - how groups including Asaib Ahl al-Haq and Harakat Hezbollah al-Nujaba use Telegram, Facebook, and X to circulate cash-only donation appeals under humanitarian cover, blending formal political status with parallel financing structures that bypass regulated financial systems‍
• An analysis of Telegram and the muqawama media space - including Sabreen News, a 1.19 million-subscriber IRGC-linked channel combining real and fabricated content with direct fundraising activity, and the Houthi arms trade openly operating across X accounts despite platform bans‍
• A deep dive into AI as a new lever of power - from Lego-style satirical animations pulling millions of views to fabricated footage of an Iranian shoot-down of a US F-35, and how state-backed narratives, opportunistic creators, and profit-driven content are converging into an indistinguishable and distorted information space‍
• An examination of Iran's disinformation playbook - deliberate saturation of platforms with contradictory and emotionally charged material designed not to mislead but to corrode trust entirely, supported by Russian state amplification and Hezbollah disinformation networks trained since 2012‍
• A sanctions exposure risk snapshot - covering IRIB's designation for broadcasting forced confessions, the compliance obligations for media and technology firms with exposure to state-linked content, and why Iran's fragmented media ecosystem is well suited to support sanctions circumvention and revenue diversion‍
• Practical guidance on incorporating social media monitoring into your risk framework - including how Themis screens social media across 12 risk categories to detect propaganda, illicit fundraising, money mule recruitment, and sanctions-linked activity in real time