Guest Post: Basij is not Bussin: Iranian Bots Spam X with Counter-Protest Messaging in Persian

Welcome to Memetic Warfare.

My friend and colleague Max Lesser has a new guest post to share, in what I believe is the first attributed case of Basij-run IO, so with no further ado, check it out below:

Basij is not Bussin: Iranian Bots Spam X with Counter-Protest Messaging in Persian

My name is Max Lesser, and I am the Senior Analyst on Emerging Threats at the Foundation for Defense of Democracies. I am sharing research I have worked on with my research assistant Maria Riofrio and my interns Kellie McSween and Ethan Sheinker.

A coordinated network on X promotes Persian language pro-regime messaging, and many of the accounts share content that appears sourced from websites associated with the Basij, which is the Iranian Revolutionary Guard Corps’s paramilitary volunteer militia focused on enforcing ideology and suppressing dissent.

The network includes at least 289 accounts on X that post identical content synchronously (within a minute of each other), providing a strong indicator of automated activity. Identical content was defined as exact string matches, excluding retweets. This analysis focuses on these 289 accounts that engage in high-signal bot-like behavior, however, many other accounts post identical content asynchronously with these accounts, suggesting that a larger coordinated network exists.

For example, four accounts posted an identical message within one minute of each other on January 4, 2026, sharing that Iran’s supreme leader claimed that the regime’s enemies are seeking to inflame protests to undermine public trust, all accompanied by an identical hashtag.

Figures: Four accounts in network posting identical criticism of protests within one minute of each other on January 4, 2026. (Link to posts: 1, 2, 3, 4)

A majority (92%) of the synchronous posting happens not in original posts, but replies. For example, between January 2-3 2026, 5 accounts posted an identical English-language hashtag, #ShutUpTrump, in response to different posts in 3 distinct, one minute bursts.

Figures: Four accounts in network replying an identical hashtag in one minute bursts. (Link to posts: 1, 2, 3, 4, 5, 6)

While every account in the network engages in at least one synchronous identical posting event, synchronous identical posting represents a small (2.5%) of the network’s broader activity between December 26 and January 21, suggesting a mix of automation and human operation. This type of activity is often called a “hybrid bots” approach.

Overall, a significant portion (52%) of posts in this period have at least one identical post, confirming a high degree of coordination. A total of 610 distinct messages were repeatedly posted by groups of at least four different users. In a particularly large example of coordinated activity, 81 accounts in the network posted an identical message – “اللهم صل علی محمد و آل محمد و عجل فرجهم” (translated into English: “O Allah, send blessings upon Muhammad and the family of Muhammad and hasten their relief”) – 895 times between December 26, 2025 and January 8, 2026.

Asynchronous identical posts could be coordinated by a central “command-and-control” channel, a tactic that regime-linked actors have used in previous influence operations. It could also mean that automated posting is staggered to avoid detection through content moderation. Regardless, the network likely combined automation with human operation, as around 48% of total posts are unique.

Figure: Visualization of accounts that repeatedly posted the same content within one minute of other accounts. Only accounts that coordinated with at least 10 different accounts are displayed. Each circle represents an account, and each line indicates a coordination relationship. Larger circles represent accounts that coordinated with more unique accounts, and thicker lines represent pairs of accounts that coordinated more frequently.

A broader analysis of all content – not only identical synchronous posts – posted between December 26 and January 21 by the 289 accounts demonstrates the primary narratives pushed by the network immediately before the onset of the ongoing protests and throughout their course.

Much of the network’s activity defends the regime. One primary narrative distinguishes lawful protests from unlawful riots. Persian terms used by the network to describe the second category include اغتشاش (“riot”), آشوب (“turmoil”), فتنه (“sedition”), مزدور (“paid agent”), and variants. The network also acknowledges economic hardship but defends the regime’s economic policies as necessary reforms for stabilizing the economy and fighting corruption. Notably, one of the factors motivating the ongoing protests is Iran’s extreme economic stress. Common related hashtags include #شفافیت_اقتصادی (economic transparency), #پایداری_مالی (financial stability), and #مبارزه_با_فساد_اقتصادی (fight economic corruption). The network also goes on the offensive against the regime’s external enemies, claiming that the United States and Israel are capitalizing on the protests to exacerbate civil unrest.

Figure: 2 different accounts in the network posted within hours of each other on January 3, sharing a quote (which other posts attribute to Khamenei) distinguishing protests from riots (اغتشاش) and warning that rioters should be “put in their place.” (Link to posts: 1, 2)

The network also often attacks the regime’s perceived external and internal enemies. Many posts warn that the U.S. and Israel allegedly seek to exacerbate civil unrest to weaken Iran, using hashtags like #امپراطوری_دروغ (Empire of Lies) and #پادوهای_ترامپ (Trump’s lackeys). Other posts attack Reza Pahlavi, the exiled heir of Iran’s last Shah, whom many Iranian protesters have called to return to power. Many posts attack Pahlavi with hashtags like #پهلوی_صهیونیست (Pahlavi the Zionist) and #از_تهران_پهلوی_خفه (From Tehran: Pahlavi Shut Up). Other posts attack Iranian reformist figures who have criticized the regime, including Mohammad Khatami, Hassan Rouhani, and celebrities like Taraneh Alidoosti.

Figure: Identical tweets from 5 different accounts referring to an alleged scheme to fabricate deaths in Iran, accompanied by hashtags accusing Pahlavi of being a Zionist and telling him to “shut up.” Posts accompanied by a photo depicting Pahlavi with Netanyahu that includes a small logo for the Basij-affiliated MATNA group in the upper left corner. (Link to posts: 1, 2, 3, 4, 5)

Other activity by the network aligns closely with patterns commonly observed in regime-aligned messaging. These include posts praising Qasem Soleimani, the IRGC officer assassinated by the United States, and broader martyr symbolism, as well as expressions of allegiance to Iran’s supreme leader, Ali Khamenei. 26 accounts include the number 313 in their usernames, a number with religious significance in Shia Islam. The network also performs national unity messaging, often posting hashtags claiming representation from different regions of Iran. These include #از_طرف_تهرانی_ها (on behalf of the Tehranis), #از_طرف_کردستانیها (on behalf of the Kurdistanis), #از_طرف_خوزستانیها (on behalf of the Khuzestanis), and hashtags associated with other regions. It also commemorates December 30 as the Day of Sacred Unity, often using the hashtag #روز_اتحاد_مقدس (Day of Sacred Unity), referring to the regime’s commemorations of counter-protest activity on the same day in 2009 in response to Iran’s Green Movement.

Figure 4: Examples of two accounts in the network mass replying with identical messages, including the hashtag از_طرف_کردستانیها# (“on behalf of the Kurdistanis”). (Link to posts: 1, 2)

X’s transparency feature labels 226 of the 289 accounts as either based in Iran or connecting via the Iran Android App. Of the accounts that do not say this, 37 say that they connected via the West Asia Android App, which is common for Iranian accounts.

It is very likely that the entire network operates out of Iran. The network dramatically dips from 4,705 posts on January 8 to 17 posts on January 9, 2026. This closely coincides with the internet blackout imposed by the regime on January 8. The network posts nothing between January 10-12, and on January 13 it posts 8 times. There are no posts again until January 17, when there is one post, and then the network gradually builds up to 220 posts on January 20.

Figure 5: Timeline of daily posts by the network between December 26, 2025 and January 21, 2026.

At least 176 accounts in the network share content branded with logos associated with the Basij. These include logos for the Basij Cyberspace Organization’s Shamsa, the “Popular Cyber Network” branch that conducts influence operations and doxxing campaigns against the regime’s enemies domestically and abroad, and logos for MATNA, the Center for Digital Production and Distribution of the Islamic Revolution that produced digital and multimedia content. One account in the network even explicitly identifies itself as a member of the Basij.

Figure: An account in the network explicitly identifying itself as a member of the Basij. (Link to post)

The 289 accounts in this network occasionally post identical content synchronously, and more often post identical content asynchronously. Given that the Basij is a voluntary paramilitary force, it is plausible that centralized command-and-control coordinates human operators – as seen in previous Iranian influence operations – while some operators employ automation.

X is officially banned in Iran. However, a Basij-linked network would plausibly post on X to reach Iranians who use the platform, especially dissidents who may not follow official bans, as well as members of the Iranian diaspora. Regime-linked actors have turned to X in attempts to manipulate Persian-language online discourse during previous protests.

As mentioned earlier, this analysis was limited to accounts that posted identical content synchronously, because this was a high-signal indicator of tightly coordinated, and likely automated, behavior. At the same time, initial triage suggests a larger network very likely exists, which engages in more loosely coordinated behavior.

For example, the post detailed above with the message — ‌توافق برای کشته‌سازی در ایران – and the hashtags ‌#پهلوی_صهیونیست and ‌#از_تهران_پهلوی_خفه were posted on January 8 by 13 accounts, 8 of which fall outside the network of 289 accounts discussed here. The research community can continue to track Basij-linked Iranian activity on X to get a sense of the full scale of this activity. Tracking this activity builds a better understanding of how the regime uses social media as a tool of repression, and enables platforms to take action against activity that violates their policies.