EXPOSED: Inside Iran's Military-Branded Propaganda Network Across Meta & X

The account is @iranmilitary.en on Instagram, display name "Iran Military," 1,883 posts, 354,000 followers, 64 following. The avatar is a circular military emblem wrapped around the Iranian flag, ringed with the words IRAN MILITARY and SINCE 2009. The bio reads: "Latest military news and analysis on Iran and beyond from diverse sources. Independent Media, Since 2009. BACKUP ACCOUNT: @IRMilitaryMedia."

Two things sit in tension on that single profile. It brands itself around Iran's military, and it insists it is independent. That tension is the whole report. The account could be several things, an independent enthusiast page, a commercial media operation, a contractor, a licensed franchise, a loosely aligned activist network, a state-run channel, or a hybrid with mixed management, and the bio alone does not decide which. What is observable is narrower but more useful: what the platforms' own fields report about where the page is administered, what infrastructure it runs on, what it broadcasts, and who it publishes with. I pulled all of those; none of them, on its own, settles ultimate control.

The bio names its own "backup account," @IRMilitaryMedia, and the profile's link tray points to a website, an X account, a Telegram channel and a TikTok. That is the footprint of a brand with a cross-platform distribution plan. So the first move was not to read its posts; it was to follow the links and see how far the same brand ran.

The profile's own link tray resolves the brand across the major platforms. Each one carries the same emblem, the same "Independent Media, Since 2009" line, and a pointer back to the others. Counted together, the brand's own account followings come to more than 1.27 million followers and subscribers, before a single account in the wider network (§04) is added.

One platform breaks the pattern, and it is worth noting precisely. The TikTok the profile advertises, @IRIran_Military, returns "Couldn't find this account." Across a brand that is otherwise live everywhere, TikTok is the single surface where the handle is unavailable. I cannot distinguish among the possibilities, platform removal, voluntary deletion, a rename, or a handle that was never fully stood up, so I record it only as unavailable at capture, not as a takedown.

Here is the core of it, and the fields are the platforms', not my characterization. Meta and X publish location and management data on accounts of a certain size. Read precisely, the signals are directionally consistent but not identical: Facebook lists Iran among the anchor page's manager countries, Instagram infers the flagship account's base as Iran, and X's inferred panel reads the broader West Asia (its user-entered field says Iran). Location alone is neutral as to editorial independence; plenty of outlets are based somewhere and still independent. Its significance here emerges when read alongside the operation's contradictory official and semi-official self-descriptions and the wider coordination evidence, one strand of the case, not the whole of it.

Most of the current surfaces cluster in an eight-week window in mid-2025: the domain (15 Jul 2025), the Facebook page (19 Jun 2025) and the X account (Aug 2025). The Instagram account is the exception, it dates to July 2020 under earlier handles, so this reads as a repurposed legacy asset rebuilt into a mid-2025 cluster, not a single coordinated launch. Across that window the brand's name was rewritten repeatedly on top of a fixed emblem, the pattern of an asset being repurposed rather than a publication settling on its title.

The contradiction is not only between the bio and the platform panels. It is between the bio and the operation's own description of itself. On its public storefronts, the brand says "independent." On its own website and in its own press-kit copy, it says the opposite, in plain language.

That second column is the operation's own promotional copy. It states that the brand has operated since 2009 as a semi-official outlet, that it holds privileged access to sources within the Iranian armed forces, that its exclusives include images of a US base in Qatar struck by Iranian missiles and confidential reports from Syria, and that official Iranian media, it names the state news agency IRNA, the news agency Tasnim, a defense-specialized agency and Iran's mission to the United Nations, treat its account as a reliable source. It closes with a Tehran street address and the email contact@iranmilitary.info. I recovered this particular copy on the dark web, from a Tor hidden-service archive; the provenance is laid out in full below.

The self-description makes specific, checkable claims: that it is a "verified account," and that Iran's official media, "IRNA, the country's official news agency, Tasnim News Agency, the Iranian UN mission office, and dozens of governmental and media accounts," follow it "as a reliable source." Those are falsifiable, so I tested them directly, on X, Instagram and Facebook.

The military brand does not operate alone. It overlaps with a connected set of at least 26 accounts that present as independent Iran-focused media and show shared-operation signals. I mapped this network from a separate anchor (an account called "Iran News 24"), and it overlaps with the military brand here through shared follows and the same production tells. I grade coordination proven for the core (multiple independent signals, below) and probable for the outer clusters. The set converges on official Iranian state accounts, the Foreign Minister, the President, the Speaker, the Supreme Leader's office, while every bio in the core asserts it is non-state.

The clearest map of the network is the one the operation drew itself. The Facebook page follows a tight set of accounts, and it is not a random feed: it is a franchise. More than a dozen of the pages it follows are the same "Iran Military" brand in a different language, each carrying the identical circular Iran-flag emblem, just relabeled: English, Urdu, Turkish (İran Askeri Gücü), Spanish (Comandos iraníes), Arabic, Dari, French (Force Iranienne), Pashto, Hindi, Hausa (Sojojin Iran), Japanese, and Azeri. Around that core it follows Iranian state and state-aligned regional media (Press TV, IRNA, and the Lebanese pan-Arab outlet Al Mayadeen English) and the same production and amplification layer from my earlier reports, including Explosive Media, the LEGO-propaganda cluster. One franchise, Iran Hayom, publishes in Hebrew and mimics the name of the Israeli paper Israel Hayom; it appears designed for Hebrew-speaking or Israeli audiences.

Shared branding is not proof of shared control, but a dozen pages carrying one bespoke emblem, cross-followed from the main account, is strong evidence of a coordinated brand family, distinct from proof of common ownership. The map below is that following list, drawn from the operation's own page; each node links to the live page.

Shared branding is one thing. Manager geography is another, and Facebook publishes it. Every page in this family above a certain size carries a "People who manage this Page" disclosure, and I opened it on each one, 17 in all. The result barely varies. Sixteen of the 17 list Iran among their manager countries, usually a team of several people, up to 10 on the Arabic page. Several also list one or two managers in Bangladesh or India, the same South Asian locations that appear on the network's X side, and one page, a low-follower backup account, lists that region alone (Bangladesh, no Iran). This is Facebook's own manager-country field, not my inference, and it is a location signal, not a statement of who owns or directs the pages.

Facebook publishes who a page follows; Instagram does not, and @iranmilitary.en keeps its following list hidden from the ordinary public interface. I collected it through a commercial social-intelligence platform. It follows 64 accounts in total, and most are a long tail of aligned individuals and fan pages. What matters is the core, and that core mirrors the Facebook network almost exactly: the same military-brand siblings, the same LEGO and AI-production layer, and the same state and state-aligned regional media it amplifies. It also follows one account SGI has already reported on by name. That relevant core is below; the long tail is set aside to keep the picture clean.

The brand's website, iranmilitary.info, is where the "independent" framing is hardest to sustain. The Persian-language site is laid out like a defense-ministry portal. Its top navigation includes Official Statements (بیانیه‌های رسمی), Defense Achievements (دستاوردهای دفاعی) and Culture of Sacrifice and Martyrdom (فرهنگ ایثار و شهادت). The lead item on the day I collected quoted the acting Defense Minister, an IRGC brigadier general, and the page's art used Iranian national and defense iconography. I note the iconography as defense-ministry-style presentation; I did not confirm it as an official ministry seal or an ownership mark, and it appears within article art rather than as a site ownership badge.

The site's Persian footer states its identity outright, "the official information portal of the Armed Forces" (§03), the same brand whose English social profiles say "independent." The registration and hosting record is more mixed than a single-country story, and I report it that way. The domain was created on 15 July 2025, in the same eight-week launch window as the X account (August 2025) and the Facebook page (June 2025). Its authoritative nameserver hostnames use Mihan Web Host branding (mihanwebhost.com, an Iranian provider), and its mail is self-hosted on the domain. The web server itself, though, resolves to an IP operated by Hetzner in Germany, a mainstream European host. So the authoritative nameservers are Iranian-branded while the web endpoint is served from Germany. I report the records and stop there: nameserver branding is not proof of physical DNS-server location, and I do not attribute a motive (such as hiding an origin IP) that the records do not establish. The registrant-country field reads Armenia, which can reflect privacy, a proxy or a reseller as easily as a deliberate choice, so I treat it as a record, not as concealment.

I ran language detection across the X account's full post history, all 844 posts (78% English-language), and keyword-coded them for topic; the topic read is a coding pass, not a fully adjudicated census, so I report it as a pattern. The feed runs on two tracks. One, the bulk by volume, is a straight relay of the Iranian armed forces: strike footage, commander quotes, threats of retaliation, close to half the posts read this way outright, and much of the rest is wordless clips carrying the same military footage. The other is US-domestic wedge content with no obvious connection to Iran: Trump, the Epstein files, conspiracy asides. The wedge is a smaller share of the posts but draws a far larger share of the engagement. The output is predominantly English-language and appears built for English-language consumption; I did not measure audience geography. Most posts came from a single desktop web client.

The collaborator panel at the top of this report, where I first found @iranmilitary.en, listed alongside the Explosive Media LEGO cluster, is the first-party seam that connects this overt military brand to the covert layers I had already mapped in earlier work. That single consented tie is not an outlier. The account runs its own co-authorships at scale, and they resolve into two layers worth naming.

Instagram's co-author feature is a two-way opt-in, a post lands on two grids only when both accounts accept, and @iranmilitary.en runs its own. Across a sample of roughly 380 of its recent posts, 51 were co-published with 40 different accounts. The roster below classifies 38 of those 40 into two layers; two co-authors are left uncategorized. One is an Iran-based production and media layer: the LEGO studio Explosive Media, AI-animation shops, and outright state organs, the Arabic desk of Fars News and the media center of the Islamic Development Organization. The other is a bench of verified, English-language, mostly American personas, several of them self-described journalists, who repeatedly accept co-authorship with an account Meta's own account-base data places in Iran, among them a legal advocate who lists former Reuters in her bio (12 co-posts in the sample), and several US political-commentary accounts with six-figure followings. The number on each face is how many co-authored posts it appears on in the sample.

Set beside the earlier work, a structure comes into view. Iran's overt state megaphone runs openly on X, from the Supreme Leader's 2.3-million-follower account down through the sanctioned state broadcaster, the Foreign Ministry and the IRGC-affiliated news agencies, none of them carrying a state-media label any longer. This brand and its network sit right among them, on the same platform, at comparable scale.

Beneath that overt tier sits the covert machinery I have mapped before: a million-account provisioning substrate on Instagram, LEGO-animation propaganda accounts, and networks that impersonate real people. This report is the overt-brand tier. The reports below are the layers under it.

The scale figures at the top of this report are real and countable, and this section keeps them honest by naming exactly what each counter is. Taken across the full reachable history of each account: on X, @IRMilitaryMedia's posts show 117.5 million views across all 844 of them (Mar–Aug 2026, the full reachable window), 78% English-language, with the single biggest post at 6.3 million, X's "views" counter includes repeat and self-views. On Instagram, @iranmilitary.en's videos show 64.2 million plays across all 1,130 of them, one reel 4.3 million on its own; Meta reel "plays" include replays, and image posts carry no public counter. On Facebook, the 579,000-follower page's 588 reels show about 63.7 million plays, again video only. On Telegram, the broadcast channel's 8,381 posts carry about 38.9 million views across its full history (Aug 2024 onward), a floor: post view counters were rounded down and roughly 1,600 posts returned no counter. Together that is about 284.3 million gross view/play events, nearly 300 million, plus roughly 8.76 million interactions (3.23 million on X, 5.53 million on Instagram). These are non-unique event counters, not counts of distinct people: excluded assets mean the recorded gross total is understated, while replays and cross-platform overlap mean the number of unique viewers is lower than the event total. The 284.3 million total includes public view counts across all 844 collected X posts, but it excludes Meta (Instagram and Facebook) image and text posts, which carry no comparable public play counter, and roughly 1,600 Telegram posts that returned no counter, so it is a floor.

This uses one framework, Meta's Online Operations Kill Chain, the plain-English, observation-based sequence of phases (acquire assets, disguise them, gather an audience, deliver content, and so on) that Meta uses to structure its own threat reports. The behaviors here fill the early and middle phases cleanly. The last two rows sit beyond the kill chain, they are the lifecycle questions it does not cover: who is behind it (held as a hypothesis) and what effect it had (left unestablished, because I did not measure it).

I hold the attribution where the evidence holds it. An Iran location signal is high confidence: it rests on the platforms' own location and management fields for Facebook and Instagram (X's inferred field reads West Asia), plus Iranian-branded nameservers on the website, plus defense-ministry-style iconography on its own surfaces. That is a location and self-presentation signal, not a finding about who employs or directs the operators. Coordination across the wider network is proven for the core on mutual follows, a closed reshare loop, same-day creation pairs and content recycling. And the operation's own self-description now sits on the record: on its live site and in its own copy it calls itself an official armed-forces portal with privileged military access (§05). That admission is a strong signal, and it cuts against the "independent" label, but I still stop short of one thing: I do not convert it into proven state direction. A self-claim of "semi-official" access is the operation's own assertion, and an outlet has reason to inflate its proximity to power; open-source evidence cannot reach whether an Iranian institution funds or tasks these accounts, which needs a platform backend or legal process. "Iran-linked on Meta's own manager-country and account-base fields (X reports an inferred West Asia; Telegram exposes no equivalent field), self-described as an official armed-forces outlet, while publicly branding as independent" is exactly as far as the evidence goes, and I stop there.

Other limits, stated plainly. I ran no authenticity pass on the follower bases and make no claim they are automated; the finding is the opacity and coordination of the source accounts, not the character of their audiences. The network map is drawn only where I observed edges, and a missing edge is not evidence of absence. The content read is a sample, not a census. And follower counts measure capacity; gross view/play events measure distribution; neither measures unique reach or effect (§08). None of these limits softens the core, which is unusually well-evidenced for open-source work: one brand, five surfaces, Meta's own manager-country and account-base panels placing its flagship assets in Iran, and a state-military identity it publishes under while denying it.

This report rests on open-source and commercially collected data: profile metadata and the platforms' own transparency and about-this-account panels, a domain registration record, public post histories, and follow-graph relationships. Some of it, notably the hidden Instagram following list, is not visible in the ordinary public interface and was retrieved through a commercial social-intelligence platform; other pieces come from commercial account-association tooling and public registration lookups. I do not name specific vendors; that is source protection, not a redaction of any finding, and it does not withhold the source class, dates or method. Screenshots are preserved with timestamps as exhibits.

The event count is incomplete, and unique reach is a separate, unknown quantity. Follower counts move; I cite them to the collection date. The ~284M total includes public view counts across all 844 X posts but excludes Meta image and text posts, which carry no comparable public play counter, and roughly 1,600 Telegram posts that returned no counter, so the true number of public events runs higher than shown. It is not a floor on unique people: repeats, self-views and cross-platform audience overlap can make the number of distinct people substantially lower, and unique reach cannot be inferred from this data. Follower counts measure capacity; gross view/play events measure distribution; neither measures unique reach or effect. I say so rather than let a big number imply a big impact.

Evidence-based assessment of publicly observable data, correlations and patterns. Certain claims remain unverified, and this is not a determination of wrongdoing. The accounts branded "IRGC" are treated here as personas adopting that branding rather than verified official government accounts; SGI does not assert, or disprove, an official-IRGC attribution. Analyst: T. Hawley, ShadowGraph Intelligence LLC.