A total of 14 200 posts linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), now designated as a terrorist organisation by the European Union (EU), have been targeted in a coordinated action against terrorist content online.
Led by Europol’s EU Internet Referral Unit (EU IRU), the action focused on identifying and disrupting the group’s online presence used to spread propaganda, recruit supporters and raise funds.
The IRGC, a central pillar of Iran’s military apparatus, was formally designated as a terrorist organisation by the European Union on 19 February 2026 under Council Decision (CFSP) 2026/421. This designation allows law enforcement to take action against activity of its members and its supporting entities in the EU.
The EU IRU, based at Europol’s European Counter Terrorism Centre (ECTC), detects, analyses and refers terrorist and violent extremist content online.
19 countries join forces in synchronised waves of action
A total of 19 countries joined forces to identify and disrupt IRGC-linked content across the internet:
- Austria, Belgium, Bosnia and Herzegovina, Bulgaria, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Netherlands, Portugal, Spain, Sweden, Ukraine, and the United States of America.
Between 13 February and 28 April, authorities worked in synchronised phases, under the coordination of Europol: collecting intelligence, cross-checking targets and carrying out joint referrals to online platforms.
The content was spread across mainstream social media platforms as well as streaming services, blog hosting sites and standalone websites. Propaganda was identified in several languages, including Arabic, Bahasa Indonesia, English, French, Persian, and Spanish. The material ranged from speeches blending religious martyrdom narratives with highly charged political messaging to AI-generated videos glorifying the IRGC and calls to avenge the Ayatollah Ali Khamenei.
The interconnectedness of IRGC-linked websites operating across multiple languages offered important insights in the network’s online architecture. Investigating how IRGC propaganda was disseminated and amplified online also supported efforts to trace and remove statements and videos produced by proxy groups and aligned entities, including Hezbollah, Ansar Allah, Hamas, PIJ, and HAYI.
In total, investigators identified 14 200 links tied to IRGC activity. Coordinated referral waves took place across the operational phase. The IRGC’s main X account, boasting over 150 000 followers, was withheld in the EU following this action, and thousands of other links on several platforms were taken down or are in the process of being investigated and removed.
Networks exposed, tactics evolving
Beyond the volume, investigators uncovered how the IRGC continues to grow its digital playbook.
The action revealed the group’s reliance on a network of hosting service providers across multiple jurisdictions, from Russia to the United States, helping it to maintain resilience online. Such providers may have also been offering hosting services before the IRGC’s formal designation, and Europol continues to engage positively with involved Member States and private parties.
Authorities also identified the use of cryptocurrency transactions to sustain and amplify its online operations – a tactic designed to bypass traditional financial controls.
Sustained pressure on terrorist networks online
This referral action forms part of the ongoing support provided by Europol to EU Member States in tackling terrorist activity online, in line with the EU’s ProtectEU Internal Security Strategy.
Through capabilities such as the EU IRU, Europol supports coordinated, cross-border efforts to identify and disrupt terrorist networks operating in the digital space.
It comes against a backdrop of a complex and evolving threat environment. Terrorist networks are becoming more fluid and continue to adapt their methods, making sustained and coordinated action essential to limit their reach and impact.
Further insights into these developments and the broader terrorist threat landscape will be made available in Europol’s upcoming EU Terrorism Situation and Trend Report (EU TE-SAT).
