14,200 URLs Identified Tied to IRGC, Alleged Iraqi Kata’ib Hizballah and IRGC Leader Charged for Global Attacks
Published
Key Takeaways
- IRGC propaganda: A law enforcement operation identified and disrupted the IRGC's online presence used to spread propaganda, recruit supporters, and raise funds.
- Operation span: The operation involved 19 countries and ran in synchronized phases between 13 February and 28 April.
- Charged operative: An Iraqi national suspected to be connected to Kata'ib Hizballah and Iran's Islamic Revolutionary Guard Corps faces terrorism charges.
A coordinated crackdown on online content linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) identified 14,200 links tied to propaganda, recruitment, and fundraising activity between February 13 and April 28. Investigators found content across social media, streaming platforms, blogs, and standalone websites in multiple languages, including Arabic, English, Persian, and Spanish.
Meanwhile, an Iraqi national, allegedly a senior member of U.S.-designated foreign terrorist organization Kata'ib Hizballah and an IRGC operative, was arrested and charged with six terrorism-related offenses, including his involvement in nearly 20 attacks and attempted attacks throughout Europe and the U.S.
International Coordination
Authorities also traced and removed statements and videos produced by proxy groups and aligned entities, including Hezbollah, Ansar Allah, Hamas, PIJ, and HAYI. The IRGC’s main X account, with more than 150,000 followers, was withheld in the EU, Europol said today.
“The material ranged from speeches blending religious martyrdom narratives with highly charged political messaging to AI-generated videos glorifying the IRGC and calls to avenge the Ayatollah Ali Khamenei,” the report says. IRGC leveraged hosting service providers across multiple jurisdictions, from Russia to the U.S.
On Friday, U.S. Department of Justice (DOJ) documents allege Mohammad Baqer Saad Dawood Al-Saadi, 32, was an operative for both organizations. The complaint attributes at least 18 European attacks and two Canadian attacks to Harakat Ashab al-Yamin al-Islamiya, an affiliated operational cell. The individual claimed the attacks via social media posts.
Documented allegations include a March 15, 2026, explosives attack targeting the Bank of New York Mellon in Amsterdam. Subsequent violence allegedly coordinated by this network involves an April 12, 2026, arson attack against a synagogue in Skopje, North Macedonia, alongside the April 29, 2026, stabbing of two Jewish men in London, U.K.
IRGC Operative Penalties
The complaint outlines six charges that include conspiring to provide material support to Kata’ib Hizballah and the IRGC and conspiring to bomb public places, each with maximum penalties of 15 or 20 years. The attempted destruction of property by means of fire or explosive charge carries a mandatory minimum term of 5 years in prison.
In March 2026, Iranian communications and sensors were disrupted by the U.S. Cyber Command, prompting researchers to warn of retaliatory cyberattacks. Around the sme time, over 1,100 hours of terrorist audio propaganda were found in 17,000 URLs across 40 online platforms.
In November 2025, the SpearSpecter cyberespionage campaign targeting high-value officials was linked to the Iranian IRGC.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular