Abstract This report analyzes Iran’s information warfare during the December 2025 – January 2026 protests…
This report analyzes Iran’s information warfare during the December 2025 – January 2026 protests and its parallel influence efforts targeting Israel and the West. Facing widespread economic unrest, the regime used physical repression and a coordinated narrative campaign, labeling demonstrators as agents of the United States and Israel. Analysis of official and affiliated Telegram channels shows that regime messaging shifted from partial grievance acknowledgment to blaming external actors to a victory narrative stressing national unity, and ultimately to framing the unrest as part of an ongoing conflict with Israel and the U.S.
The findings reveal a centralized information system in which leadership directives are amplified by state media and semi-official digital networks across multiple languages. Amid domestic instability, Iran maintained and increased its foreign influence efforts, showing that information warfare is central to regime survival and ideological control.
The protests that started in Iran in late December 2025, caused by economic hardship, mobilized a significant part of the population to demonstrate against the regime.[1] In addition to physical repression, the Iranian regime initiated an information campaign that depicted the protests as the result of foreign interference. Demonstrators were characterized as “Zionist and American agents” or terrorists, rather than as participants in legitimate civil protest.[2] As unrest escalated and internet access was restricted[3], the Iranian regime reinforced this narrative by controlling information regarding detainees and casualties, portraying them as operatives of external actors.
This report analyzes Iran’s information warfare strategies in response to the December 2025- January 2026 protests. It identifies the primary narratives that frame these events, examines their evolution and structure, and presents Iran’s ongoing influence effort against Israel and the West during this internal crisis.
The research is based on an analysis of posts published on both official and unofficial Telegram channels affiliated with the Iranian regime and the “axis of resistance,” covering the period from the outbreak of protests on 28.12.25 to 23.01.26. The analysis examines central narratives and recurring linguistic frames. Findings were compared over time in relation to developments.
This data collected was based on key channels linked to Iran (but not limited to them): Khamenei’s official Telegram channel in English (Ayatollah Khamenei), which features formal statements from the Iranian regime; the Revolutionary Guards’ news channel in Persian[4] (کانال اخبار سپاه پاسداران 🏴), which provides official statements, local news from their perspective, and interviews with Iranian citizens; Tasnim News Agency (خبرگزاری تسنیم),official news channel affiliated with the Iranian regime; ResistanceTrench, a channel in english supporting the Shiite axis of resistance (ResistanceTrench), which reports on axis actors with a favorable bias; and the PressTV channel, in both English and Hebrew, which presents Iran’s ongoing influence strategy against Western countries. These sources were selected for their role within the Iranian regime’s media coverage.
The following paper reviews Iran’s information warfare strategy, provides insight into the development and phases of Iran’s narrative control during the protests, and showcases a reflection of what is happening in the influence domain.
Information warfare now plays a central role in modern conflict. It involves the planned use of information, disinformation, hacking tools, and media manipulation to influence how target audiences think and act. Information warfare supports the physical operations by shaping opinions and decisions before, during, and after a conflict.[5]
Iran’s information warfare strategy, developed as a practical response to its limited military power, has become a central part of its military security doctrine and its “soft war” strategy, against the West.[6] To advance this strategy, Iran uses a combination of ideological messaging (the dissemination of political or religious beliefs), psychological tactics (methods to influence emotions and attitudes), hacking, media control (government influence over information channels), and narrative framing (the presentation of events from a particular perspective). These efforts reach both internal (Iran’s supporters and opponents) and external audiences,[7] where the goal is to damage Western image, portray the United States as hypocritical and aggressive, and present Israel as the main enemy in a broader conflict.[8] Activities in this capacity are also used as influence operations to cause rifts within Israel, the U.S., and other states of interest. In this case, Iran uses unofficial outlets, online personas, or non-state actors instead of direct state channels.
This centralized approach extends to domestic crises, such as large-scale protests. While Iran once relied on traditional media censorship, it has since adopted more advanced forms of information control. Early protests were managed by suppressing state TV and print media, whereas later protests included SMS shutdowns, internet shutdowns, and platform bans. Since 2019, Iran has escalated to large-scale or selective internet shutdowns and coordinated information strategy to deal with internal crises. Through the protests during the years, it seems that the regime worked to portray and delegitimize protesters as foreign-driven.[9]
Phase one: partial recognition of protest and the distinction between legitimate and mercenary violence
Following the outbreak of protests in Iran on December 28, the Iranian regime has sought to differentiate between legitimate economic grievances and illegitimate violent riots. This distinction enabled the regime to recognize, on the one hand, public frustration and, on the other hand, to deny the legitimacy of the political criticism posed by the protests. Framing the case as an intentional infiltration by hostile actors seeking to destabilize the regime.
In a speech delivered on January 3, Supreme Leader Ali Khamenei stated that “the shopkeepers’ protest over the excessive rise in foreign currency is justified.” However, he also asserted that “a number of mercenaries, hiding behind the shopkeepers, are chanting slogans against the Islamic Republic.” He further argued that a clear distinction exists between legitimate civil protest and riots, and that “rioters,” as he defined them, should be dealt with harshly.
This distinction became a central theme in the regime’s messaging during the initial phase of the protests. By distinguishing between demonstrations and violent riots, Khamenei established a narrative that justified severe responses against the protests. Simultaneously, he attempted to showcase that the regime was attentive to the people’s economic grievances, while dismissing the legitimacy of political opposition expressed in the ongoing demonstrations.
It should be noted that during the first days of the protests, pro-regime channels minimized their reporting, with many making little to no reference to the domestic riots.
This narrative is primarily addressed to the internal Iranian audience, particularly to those affected by the economic crisis. It might be that they hoped the protest would end as if they never started, as the regime has recognized the problem and is working to help. At the same time, the message is also directed at the Iranian security forces and the law enforcement as a basis for justifying the selective suppression of violence.
Image: Poster of Ayatollah Khamenei published on his official Telegram Channel: “Protesting is legitimate, but protesting is different from rioting”.[10]
Phase two: The “foreign agent” narrative and attribution of blame to the United States and Israel
Initially, the Supreme Leader Khamenei suggested that “mercenaries” were responsible for inciting violence during the early stages of the protests, implying U.S. and Israel involvement. However, it was not until his January 9 speech that the Iranian regime explicitly accused the United States of orchestrating the protests. In the days following, the discourse on Iranian-linked Telegram channels systematically repeated specific terms, characterizing violent protesters as “hirelings of foreign powers” or “Zionist terrorists”.
After establishing this framework of U.S. and Israel foreign orchestration of the protests in Khamenei’s January 9th speech, the regime developed a systematic typology of how this foreign intervention unfolded. According to a statement published on Khamenei’s Telegram channel, the first category included “agents” who were carefully selected by the intelligence agencies of the US and Israel, who received special funding and training, and some of whom were even captured “thanks” to the activities of the Iranian security forces. The second category was defined as “innocent” young men who were not in direct contact with external agents, but who were manipulated and incited by the first group to commit acts of violence. This division allowed the regime to emphasize the depth of the external conspiracy and, at the same time showcase the young population as victims of the U.S. and Israel intervention.
Alongside statements of external intervention, the regime presented what it describes as “concrete field evidence.” They claim that the events between January 8 and 10 (the days reported[11] as the most violent in the protest, when the regime used excessive force, and the reported death and wounded toll was in the thousands) were not spontaneous riots. Instead, they claim the events were a coordinated operation, allegedly supported by the United States and Israel. For example, the IRGC news channel has reported arrests of external agents. Additionally, the channel has released documentary videos that claim to show the process of recruiting a protester into Mossad’s spy service and the distribution of weapons during the protests.
The issue goes beyond the regime’s accusations of foreign U.S. agents. During his January 9 speech, Khamenei assigned responsibility and articulated three central messages aimed at the United States. The first is the portrayal of American hypocrisy. Khamenei stated that the United States, which had previously harmed Iranians during the “12-Day War”, was now attempting to present itself as a defender of the Iranian people’s well-being. The repeated message that “the US President has Iranian blood on his hands” served to reinforce this accusation.
IRGC news channels also echoed this narrative, such as the statement of Major General Fakpour, Commander of the IRGC. He claimed that Trump and Netanyahu are responsible for the deaths of “Iranian youth” and to “those defending the country’s security”. He further asserted that the crimes committed by their mercenaries would not be forgotten and would be met with a response at an appropriate time.
The pro-regime supporters’ channels further emphasized this message by sharing a video of President Trump published during the “12-day war,” in which he is presumably bombing Iran, and now assert that he wants to help the Iranian people, under a title of hypocrisy.
The second message asserted that US involvement in the protest and threat of attack on Iran is driven by economic interests and not so-called morality. Khamenei’s statements on January 9th emphasized that the United States “will fail as it has failed in the past” and attributed its intervention to economic motives, primarily oil, drawing parallels to its actions in Venezuela[12] (which occurred just a few days earlier, on January 3rd).
Image: Poster of Ayatollah Khamenei published on his official Telegram Channel: “The shamelessly say it’s for Oil”.[13]
The third message shifts the focus of criticism toward President Trump’s governance capability in the United States amid the Protests[14] in Minneapolis. Khamenei’s statements referenced Trump as part of a broader category of “tyrants and arrogant rulers” who, he asserted, would ultimately fall. Various posts on the regime’s associated media and supporters’ channels circulated videos of protests and violent incidents within the US, accompanied by the suggestion that if the US president is “so talented,” he should focus on domestic governance.
This narrative is constructed to address multiple audiences simultaneously. Domestically, it targets both the general public and security forces by characterizing the protests as threats orchestrated by foreign actors; in this way, the narrative shifts responsibility away from Iran and legitimizes forceful responses. Meanwhile, for international audiences, particularly in the United States and Western countries, it frames the American threat of involvement as hypocritical, economically motivated, and lacking moral legitimacy.
Image: Poster published on Ayatollah Khamene’s official Telegram channel under the title: “Hirelings of foreign powers”. Written in the poster: The US President confessed that the Iranians’ blood was on his hands. Now he’s saying that he’s on the side of the Iranian nation! A bunch of naïve, unaware, unthinking people believed and accepted what he said, and they acted the way he wanted. They set rubbish bins on fire in order to please him. Everyone should know that the Islamic Republic won’t back down in the face of those causing destruction. It will not tolerate the hirelings of foreign powers. Imam Khamenei Jan. 9, 2026”[15]
Phase three: Victory narrative and the decline of the protest
On January 12, the Iranian regime adopted a new narrative, showcasing the decline of the protests and proclaiming victory. Pro-regime demonstrations that occurred that day were framed as a historic achievement that thwarted the “plots of foreign enemies”. Messaging by Ayatollah Khamenei and other officials in Iran highlighted that the “great Iranian nation had demonstrated its strength and identity in opposition to its adversaries”, frequently employing terms such as “strong and powerful” to refer to the Iranian people’s “win” against the “Enemy”.
In the following days, the regime reinforced the narrative of widespread popular support through official and unofficial channels and included interviews, videos, and field testimonies of pro-regime demonstrators. These demonstrations aimed to project, both domestically and internationally, an image contrary to that depicted in Western media: not of a society in revolt, but of a unified nation supporting its leadership. The events featured flags of the Islamic Republic, religious symbols, and at times, the presence of President Pazakhian, as part of a coordinated effort to establish broad public legitimacy. This was also prominent in posts on the regime’s supporters’ channels, which also showcased people’s support from outside, such as a solidarity march with Iran in Indian Kashmir. As well as a rally in support of the Islamic Republic of Iran in Istanbul.
Image: A picture distributed on Ayatollah Khamenei’s official Telegram channel showcasing a pro-regime demonstration of support for the Iranian regime.[16]
The victory narrative primarily targeted the Iranian public to foster a sense of closure, restored control, and national cohesion. It also addressed external audiences by rejecting the crisis narrative and presenting the regime as stable, publicly supported, and resistant to international pressure.
Phase Four: the protest as a critical front in the ongoing conflict with Israel and the United States
In the most recent phase of the protests, particularly after Kaminei’s January 17 speech (which followed the intensified threat by the U.S. to attack Iran), the narrative highlights the broader and ongoing conflict involving Iran, Israel, and the U.S. The protests were characterized not solely as the outcome of an external plot, but as another front in a prolonged conflict.
In a statement issued on January 17, Supreme Leader Ali Khamenei attributed direct responsibility for all casualties and damage during the protests to US President Donald Trump. He asserted that these events resulted not from internal dynamics but from deliberate American planning, coercion, and execution targeting the Iranian nation. Khamenei identified the personal involvement of the US president as a distinctive aspect of the current protest wave, citing open threats, encouragement of demonstrators, and assurances of US support, including potential military assistance. Consequently, Khamenei labeled the US president as a criminal, attributing this to both the casualties and damage to Iran.
According to Kaminei’s perspective, Iran remains engaged in a campaign that has not ended with a peace agreement or binding ceasefire of June 2025. The “12-Day War” is seen as a tactical truce rather than the end of the conflict. The current protests are described as a new phase of that war: “They launched this sedition with extensive preparations for larger actions.” The Revolutionary Guards supported this view in its linked channels, and claimed that “the American-Zionist conspiracy of January was the cowardly revenge of the enemies of the Iranian nation for the defeat in the 12-Day War.”
The narrative that presents the protests as an extension of the ongoing conflict with Israel and the West primarily targets the local Iranian audience, seeking to situate the events within a familiar national-security framework. This reframing transforms the protest from a civil matter into a security crisis, compelling the public to support the state for the sake of collective survival. Simultaneously, this narrative serves as an external signal, providing preliminary justification for any future Iranian responses in both domestic and international contexts.
The influence efforts directed against the West and Israel continued throughout the internal protest crisis in Iran. Monitoring of Telegram channels in Hebrew and English affiliated with Iran and known to target an international audience, such as the Hebrew channel PressTV, which distributes content leveraging events within Israel to portray Israel as weak. For example, articles were published that presented Israel as economically weak, socially fragmented, and politically corrupt, emphasizing claims of economic decline and its poor position in global indices, increasing reports of internal protests and clashes with security forces in Jerusalem, and distributing emotionally charged content claiming harm to children and failures in public services, as well as events depicting harsh treatment of ultra-Orthodox protesters. Additional narratives frame Israel as a failed state, highlighting political instability, coalition tensions, disputes over military service exemptions, demographic pressures, and claims that Israel is no longer a liberal democracy. Together, these themes written in Hebrew are designed to erode Israeli public morale and reinforce the perception of internal decline.
The narrative on the English-language PressTV Telegram channel was particularly prominent, focusing on anti-US sentiment and strongly emphasizing the protests in Minneapolis. More importantly, the content highlights recurring central narratives, including depictions of widespread social unrest, internal division, and systemic instability within the US, suggesting an attempt to frame the protests as evidence of a deeper structural failure rather than isolated incidents.
During the protest period, and in addition to Telegram channels, Iranian-affiliated initiatives have been reported to be attempting to directly engage with the Israeli public by sending messages to personal phones using scare tactics. Such an example is the distribution of messages urging recipients to “look to the sky at midnight” and prepare for an alleged Iranian attack, representing a deliberate attempt to instill fear and undermine the sense of security among Israelis.[17]
The study reveals that the Iranian regime responded to the protests in December 2025 and January 2026 with a structured and layered approach. Controlling the narrative was key to maintaining the regime’s stability. The authorities saw the protests as a challenge to both public order and, more importantly, their legitimacy. As a result, they used both physical repression and cognitive tactics to manage the situation.
The staged approach illustrated above shows how Iranian narrative control evolved. Initially, the regime acknowledged that unrest existed without accepting the protests as a genuine political challenge, while also setting the stage for targeted repression. As the protests grew, the regime made the “foreign agent” narrative more direct. It openly blamed the United States and Israel, and portrayed violent protesters as terrorists and mercenaries. This marked a shift from defensive language to more offensive rhetoric. As the protests subsided, the regime changed its tone again, focusing on victory, resilience, and national unity. Claims of victory and pro-government rallies reinforced the narrative. In the final phase, the focus shifted to dealing with the threat of an upcoming war. Iran framed the protests as part of an ongoing conflict that did not stop in the 12-day war, and the protests constituted a narrative of a common enemy to mobilize the masses in favor of the regime.
Furthermore, the analysis demonstrates a clear top-down structure of how the narrative is being set and disseminated. In Iran, initial messages are issued by the Supreme Leader. Ali Khamenei’s speeches and statements set the main direction for the entire regime’s messaging apparatus.
Once the leadership establishes the narrative, security and media organizations affiliated with the regime disseminate and reinforce it. The IRGC, and especially their intelligence and media divisions, translate these directives into operational content, including reports of arrests, “confessions,” videos, and alleged evidence of armed activity. At the same time, a wide network of supposedly unofficial channels, supporters of the “axis of the Resistance” on their Telegram channels in various languages, serves as another echo chamber. These channels do not require precise or formal wording and therefore allow for rhetorical extremism, intimidation, and the dissemination of graphic or emotional content, while maintaining consistency with the central narrative. It is evident that when the regime’s initial messaging lacked clarity, affiliated supporter channels were uncertain how to frame the internal protests and largely refrained from addressing them, in some cases almost ignoring the events altogether.
A prominent feature of Iran’s actions during the protests is that the regime’s continued, even intensified, efforts to influence Israel and the West. Instead of reducing its foreign activities to address domestic social and economic challenges, it continued its efforts in the sphere of influence through channels directed at the publics of Israel (in Hebrew) and the United States and the West (in English). This highlights how much, from the regime’s perspective, the external arena remains a critical tool for stabilizing domestic conditions, and how it has already constructed a working system that is not dependent on internal crises.
The Iranian case shows that an authoritarian regime relies on ideological warfare as a central part of managing internal crises, and not just as an adjunct to physical repression. If the regime can present civil protest as part of an external threat, it believes it can maintain its political and ideological control. Moreover, Iran has also used operational tools to manage the crisis, such as restricting the internet and, in effect, trying to prevent information from leaving and entering Iran, thereby enhancing its control over its actual narrative.
The broader implication of this study is that information warfare has become an integral component of what can be described as the “new war”, a conflict environment in which cognitive influence, narrative dominance, and perception management are as consequential as conventional military force. Iran’s conduct during the December 2025–January 2026 protests demonstrates that narrative control and foreign influence operations function as strategic tools of regime survival, not merely as propaganda efforts. Domestic unrest and external messaging are interconnected: Monitoring Iran’s foreign information campaigns can provide early indicators of shifts in regime messaging and reveal where its narrative is headed. More broadly, the case illustrates how modern authoritarian regimes have developed a narrative control mechanism together with tools such as internet restriction and even disinformation and AI that were not discussed specifically in this research , in order to overcome internal protest and crisis over the years.
[1] ICT (2026, January 11) Iran wave of protest: Overview and regional implications. International Institute for Counter-Terrorism (ICT). https://ict.org.il/iran-wave-of-protest-overview-and-regional-implications/
[2] Khamenei_en. Telegram channel. Telegram. https://t.me/Khamenei_en
[3] Fassihi, F., Baskar, P., & Mahoozi, S. (2026, January 8). Iran is cut off from internet as protests calling for regime change intensify. The New York Times. https://www.nytimes.com/2026/01/08/world/middleeast/iran-protests-internet-shutdown.html
[4] All content in Persion was translated using online translation tools. Features limitations were taken under consideration.
[5] Molander, R. C., Riddile, A. & Wilson, P. A. (1996). Strategic Information Warfare: A New Face of War. RAND Corporation.
[6] Price, M. E. (2012). Iran and the “soft war”. International Journal of Communication, 6, 239–256. https://ijoc.org/index.php/ijoc/article/download/1654/799/7024
[7] Haiminis, I. (2019). Iran’s information warfare. In Y. Kuperwasser & D. Siman-Tov (Eds.), The cognitive campaign: Strategic and intelligence perspectives (Memorandum No. 197, pp. 135–147). Institute for National Security Studies. https://www.inss.org.il/wp-content/uploads/2019/10/Haiminis.pdf
[8] Yasur, N., & Citrinowicz, D. (2024, November 12). Iranian foreign information manipulation and interference during the Swords of Iron War. Institute for National Security Studies. https://www.inss.org.il/publication/iran-influence/
[9] Akbarzadeh, S. (2025). The web of Big Lies: State-sponsored disinformation in Iran. Global Media and Communication.
[10] https://t.me/Khamenei_en/9820
[11] Times of Israel Staff. (2026, January 13). Report claims at least 12,000 dead in Iran, in ‘largest killing in Iran’s modern history’. The Times of Israel. https://www.timesofisrael.com/liveblog_entry/report-claims-at-least-12000-dead-in-iran-in-largest-killing-in-irans-modern-history/
[12] Evans, G. (2026, January 4). Spies, drones and blowtorches: How the US captured Maduro. BBC News. https://www.bbc.com/news/articles/cdred61epg4o
[13] https://t.me/Khamenei_en/9820
[14] Cineas, F. (2026, January 31). More than 300 anti-ICE protests planned across US this weekend. The Guardian. https://www.theguardian.com/us-news/2026/jan/31/anti-ice-protests-weekend
[15] https://t.me/Khamenei_en/9927
[16] https://t.me/Khamenei_en
[17] N12. (2026, January 10). “אנחנו באים, תביט בשמיים בחצות”: ההודעה שהתקבלה בישראל [Threatening SMS message received in Israel]. Mako. https://www.mako.co.il/news-military/2026_q1/Article-dec54115708ab91026.htm