Bulgaria among 19 countries co-operating to identify and disrupt Iran’s IRGC online presence
Bulgaria was among 19 countries involved in identifying and disrupting the online presence of Iran’s Islamic Revolutionary Guard Corps, according to a May 18 statement by European police co-operation agency Europol.
A total of 14 200 posts linked to IRGC, now designated as a terrorist organisation by the European Union, have been targeted in a coordinated action against terrorist content online, Europol said.
Led by Europol’s EU Internet Referral Unit (EU IRU), the action focused on identifying and disrupting the group’s online presence used to spread propaganda, recruit supporters and raise funds.
The IRGC, a central pillar of Iran’s military apparatus, was formally designated as a terrorist organisation by the EU on February 19 2026. This designation allows law enforcement to take action against activity of its members and its supporting entities in the EU.
A total of 19 countries joined forces to identify and disrupt IRGC-linked content across the internet: Austria, Belgium, Bosnia and Herzegovina, Bulgaria, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Netherlands, Portugal, Spain, Sweden, Ukraine, and the United States.
Between February 13 and April 28, authorities worked in synchronised phases, under the coordination of Europol: collecting intelligence, cross-checking targets and carrying out joint referrals to online platforms.
The content was spread across mainstream social media platforms as well as streaming services, blog hosting sites and standalone websites.
Propaganda was identified in several languages, including Arabic, Bahasa Indonesia, English, French, Persian, and Spanish.
The material ranged from speeches blending religious martyrdom narratives with highly charged political messaging to AI-generated videos glorifying the IRGC and calls to avenge the Ayatollah Ali Khamenei.
The interconnectedness of IRGC-linked websites operating across multiple languages offered important insights in the network’s online architecture.
Investigating how IRGC propaganda was disseminated and amplified online also supported efforts to trace and remove statements and videos produced by proxy groups and aligned entities, including Hezbollah, Ansar Allah, Hamas, PIJ, and HAYI.
In total, investigators identified 14 200 links tied to IRGC activity. Coordinated referral waves took place across the operational phase. The IRGC’s main X account, boasting over 150 000 followers, was withheld in the EU following this action, and thousands of other links on several platforms were taken down or are in the process of being investigated and removed.
Beyond the volume, investigators uncovered how the IRGC continues to grow its digital playbook.
The action revealed the group’s reliance on a network of hosting service providers across multiple jurisdictions, from Russia to the US, helping it to maintain resilience online. Such providers may have also been offering hosting services before the IRGC’s formal designation, and Europol continues to engage positively with involved Member States and private parties, Europol said.
Authorities also identified the use of cryptocurrency transactions to sustain and amplify its online operations – a tactic designed to bypass traditional financial controls.
(Photo: André Rainaud/ freeimages.com)
