On 18 May 2026, Europol announced acoordinated action against 14,200 pieces of online content linked to the Islamic Revolutionary Guard Corps(IRGC). The operation targeted a digital ecosystem used to spread propaganda, recruit supporters and support fundraising activities.

The action was led by the EU Internet Referral Unit, Europol’s unit specialising in identifying and reporting terrorist and violent content online, operating within the European Counter Terrorism Centre.

Nineteen countries against IRGC propaganda

The operation involved 19 countries: Austria, Belgium, Bosnia-Herzegovina, Bulgaria, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, the Netherlands, Portugal, Spain, Sweden, Ukraine and the United States.

Activities took place between 13 February and 28 April 2026. National authorities worked in synchronised phases, under the coordination of Europol, collecting intelligence information, verifying targets and sending coordinated alerts to online platforms.

The identified content circulated on social platforms, streaming services, blogs, independent websites and hosted infrastructures in several jurisdictions. The material appeared in multiple languages, including Arabic, English, French, Persian and Spanish.

The propaganda included politico-religious sermons, martyrdom narratives, artificially generated videos and content glorifying the Revolutionary Guards. Some messages even called for the revenge of Ayatollah Ali Khamenei.

TheIRGC‘s main X account, with over 150,000 followers, was blocked in the EU. Thousands of other links have been removed or are still being analysed by the platforms.

The IRGC as a terrorist organisation: the transition that changed everything

Behind this important achievement is the designation of theIRGC as a terrorist organisation by the European Union.

On 19 February 2026, the EU Council formally placed the Islamic Revolutionary Guard Corps on the European list of terrorist organisations. The decision was adopted by Decision (CFSP) 2026/421.

On a digital level, the designation of theIRGC as a terrorist organisation allows European authorities to treat its online propaganda no longer merely as disinformation or hostile influence, but as possible terrorist content. This facilitates referrals, takedown orders and coordinated interventions on platforms, targeting not only accounts, but also posts, links, videos, channels and sites used for recruitment, glorification, intimidation or operational support.

The consequence is concrete. The alerts sent to the platforms were not only based on the internal rules of the providers. They were also based on the European legal qualification of the organisation responsible, making the action more coherent, solid and incisive.

From propaganda to proxies: a transnational digital network

According to Europol, the analysis of the interconnection between sites linked to theIRGC offered important insights into the online architecture of the network. The dissemination of content did not follow a random pattern.

The ecosystem made it possible to amplify messages in multiple languages and reach different audiences. This structure also helped to relaunch content produced by proxy groups or aligned entities.

References to Hezbollah, Ansar Allah, Hamas, PIJ and HAYI appeared in the material analysed.

The objective was not only communicative. Such a network can support consensus, mobilisation, radicalisation, fund-raising and political legitimisation of violence.

The multilingual dimension is a central element. It allows messages to be adapted to different audiences and to cross national borders. In a fragmented digital environment, this capacity increases the resilience of propaganda.

Hosting providers, cryptocurrencies and online resilience

The operation also highlighted the evolution of theIRGC‘s digital tactics.

Investigators identified a network of hosting providers spread across multiple jurisdictions, from Russia to the United States. This fragmentation helps hostile operators maintain an online presence even after removal or blocking.

The point is relevant for investigations: when content, domains and infrastructure are located in different countries, authorities need to coordinate requests, alerts and technical activities quickly.

Europol also reported the use of cryptocurrency transactions to support and amplify online transactions, bypassing traditional financial controls and complicating the traceability of flows.

ProtectEU: European Internal Security in the Digital Dimension

The operation is part of the ProtectEU strategy , presented by the European Commission on 1 April 2025. ProtectEU is the new European internal security strategy.

The strategy aims to strengthen the capacity of Member States to protect societies and democracies from online and offline threats. It includes terrorism, organised crime, hybrid threats and hostile actions of foreign actors.

ProtectEU starts from a clear premise. Threats to European internal security no longer develop in separate compartments. Terrorism, propaganda, cybercrime, disinformation and illicit financing can converge in the same digital environment.

The operation against theIRGC represents the concrete translation of these principles. The terrorist designation provided the legal basis for the operation; Europol ensured coordination between the authorities involved; the participating states turned available intelligence into targeted operational initiatives.

Coordinated pressure on online terrorist networks

The result of the operation should not only be measured in the number of identified links. The 14,200 contents indicate the size of the ecosystem, but do not exhaust the meaning of the action.

The main value concerns the pressure exerted on theIRGC‘s digital network. Blocking accounts, removing content and reporting infrastructure reduces the ability to propagate the message.

At the same time, the operation produces investigative knowledge. Every link, domain, cryptocurrency wallet or account can offer information on how the group operates.

Counter-terrorism is not only played out on the physical terrain. It is also played out in the ability to map, disrupt and undermine complex digital ecosystems.

In this perspective, Europol is increasingly becoming an operational node of European security. The fight against online terrorist propaganda requires intelligence, law, technology and international cooperation. None of these elements alone is sufficient.