How the Iranian regime uses monarchist networks, cyber operations, and the Lion and Sun Associations to divide the opposition and undermine protests for a democratic alternative.

In April 2018, two intelligence officers visited Hashem Khastar at his garden. Khastar was a teacher, a trade-union activist and an outspoken opponent of the Iranian regime. He had no reason to expect encouragement from the security apparatus. Yet the men who came to see him offered precisely that.

“Why don’t you cooperate with Prince Reza Pahlavi?”

They offered to give him Pahlavi’s telephone number.

Months later, Khastar was approached again. This time, the request was different. Two security officers wanted him to issue a statement against the People’s Mojahedin Organization of Iran, or MEK, after the group had expressed support for him. Their real sensitivity, they explained, was the MEK itself.

The contrast was revealing. The Iranian regime’s security apparatus did not appear to treat all of its opponents in the same way. One opposition figure could be recommended. Another was a red line.

That distinction would become more visible over the following years. The first sign appeared in the streets.

During the protests of late 2017 and early 2018, a slogan that had been virtually absent for decades suddenly entered the political vocabulary: “Reza Shah, rest in peace.”

Its appearance was presented as proof that Iranians, particularly younger generations, were rediscovering the monarchy. But the slogan’s early history contained a detail that was difficult to reconcile with that interpretation.

In the middle of a factional dispute, the state-run newspaper Jomhouri Eslami described a group being sent toward parliament chanting “Reza Shah, rest in peace.” They were able to move freely, the newspaper wrote, “under police escort.” More importantly, it identified them as familiar participants in Tehran Friday prayers and government-organized marches.

The accusation had not come from an opposition organization abroad. It had come from inside the political system itself.

Once the slogan had appeared, the state’s media machinery did something seemingly contradictory: it amplified it.

Fars examined the slogan. Hamshahri discussed it. Fararu analyzed it. Defa Press debated whether it was logical. Aparat produced programs about its origins. Other outlets asked why protesters were saying it and what nostalgia for Reza Shah supposedly revealed about the younger generation.

The slogan was criticized, but it was also repeated. A phrase heard in a limited gathering could have disappeared within hours. Instead, it was carried into headlines, television discussions, and political commentary. Under the language of criticism, the slogan became nationally recognizable.

Foreign Persian-language broadcasters completed the circuit. Footage containing monarchist chants was replayed outside Iran, often as evidence of a broader transformation in public opinion. Genuine monarchists embraced the images. Political actors abroad circulated them further. In some cases, videos were manipulated or dubbed. In others, a small cluster of people chanting monarchist slogans was filmed in a much larger anti-government gathering.

This method would later become a recurring feature of Iran’s protest politics.

A genuine demonstration would form around inflation, repression, political prisoners, corruption, or the overthrow of the Iranian regime. A small group would introduce a monarchist slogan. Someone would record a few seconds. The clip would circulate online. Persian-language broadcasters outside Iran would repeat it. Genuine supporters of Reza Pahlavi would share it further. The size of the original group became almost irrelevant.

What mattered was which image survived.

A protest of thousands could contain dozens of slogans, yet a ten-second clip of “Javid Shah” could become the political identity of the entire gathering. The street produced the raw material; social media multiplied it; television converted it into a national narrative.

By 2025, the political utility of this process was no longer being discussed only by critics of the regime.

Tasnim, the news agency affiliated with the Revolutionary Guards, published an article whose conclusion was startlingly candid: “The existence of a weak and rootless current such as monarchism can help the survival of the Islamic Republic.”

Tasnim described this as a “service” performed by the royal family.

Vatan-e Emrooz advanced the same argument in a different language. A weak rival, it suggested, could be useful to a government, especially if that rival divided its enemies. Pahlavi supporters, by deepening fractures within the opposition, had provided a benefit to the Islamic Republic.

KhabarOnline later devoted an editorial roundtable to a blunt question: was the promotion of Reza Pahlavi itself a project manufactured by the Islamic Republic?

Hossein Dehbashi, a documentary filmmaker long associated with the establishment, went further. “The most important and successful security project of the Islamic Republic,” he wrote, “was to establish a Zionist prince as the principal symbol of its opponents.”

The strategic logic was simple. The most useful opponent was not necessarily the weakest or the most obscure. It was one prominent enough to occupy the political field, divisive enough to fracture the opposition, and insufficiently organized inside Iran to threaten the state directly.

Reza Pahlavi fit that requirement unusually well. His name carried international recognition. Foreign Persian-language media covered him extensively. His supporters could generate images of a visible alternative. But his elevation also revived the old binary that the Islamic Republic had every reason to preserve: Iran must choose between the clerical dictatorship and the monarchy that preceded it.

Other possibilities could then be pushed out of sight. The strategy became particularly visible after 2022, when the regime’s cyber apparatus expanded a large pro-Pahlavi network across social media.

These were not simply monarchist users expressing support for Reza Pahlavi. The network examined here was operated from inside Iran by accounts presenting themselves as hard-line royalists while functioning as part of the Iranian regime’s cyber operation. Their profiles were deliberately constructed to look like the regime’s monarchists: Lion and Sun flags, portraits of Reza Shah and Mohammad Reza Shah, crowns, imperial insignia and slogans such as “Javid Shah” and “Reza Shah II.” They insulted Khamenei, demanded the overthrow of the Islamic Republic, and cultivated the appearance of militant anti-regime activists.

Their real political function, however, became visible in what they did beyond attacking the regime.

Republicans were denounced. Leftists were denounced. Ethnic activists were branded separatists. The MEK was attacked obsessively. Journalists, celebrities and political activists who refused to endorse Pahlavi were subjected to coordinated waves of abuse. The network reduced the opposition to a binary formula: either one stood with Reza Pahlavi and “Javid Shah,” or one was treated as part of the enemy camp. The slogan that most clearly expressed this line was: “Death to the three corrupt forces: the mullah, the leftist and the MEK.”

When X began displaying account-location and connection information, large numbers of accounts that presented themselves as monarchists were exposed as operating from inside Iran. Many were shown as based in Iran or West Asia while connecting through the Iran Android App. Because X was filtered inside Iran, this pattern pointed to privileged access associated with the state’s so-called “white SIM card” system rather than ordinary domestic users.

The screenshots preserved from this period show account after account displaying royalist imagery while X identified them as based in Iran. After the location data became visible, many of the same accounts began masking or changing their locations. Some moved from Iran to the United States, Germany, Denmark, or other countries; others shifted from “Iran” to the broader label “West Asia.” Their political identity did not change. Their location did.

The significance was not merely that some monarchist accounts happened to be located in Iran. The pattern showed a coordinated regime cyber network operating under monarchist cover: accounts based inside Iran, using privileged access, displaying almost identical political loyalties, attacking the same opposition currents and amplifying the same slogans. Their anti-regime appearance was not evidence that they stood outside the security apparatus. It was the cover that allowed the apparatus to enter opposition space while appearing to belong to it.

Then, in February 2026, the operation moved onto the campuses.

The universities were reopening after the suppression of the January uprising. Students began gathering to commemorate those killed forty days earlier. For the Iranian regime, campuses had always been dangerous ground: concentrated, politically active populations with a long history of turning local grievances into national revolt.

Almost as soon as the protests began, new organizations announced themselves. They called themselves the Lion and Sun Associations.

Within roughly three days, more than forty Telegram channels appeared, each claiming to represent a different university. Tehran University had one. Amir Kabir had one. Iran University of Science and Technology had one. Similar channels appeared for universities across the country.

Their timing was extraordinary. So was their uniformity.

The statements differed in design but repeatedly used the same political vocabulary: the “Lion and Sun Revolution,” the leadership of Reza Pahlavi, “Javid Shah,” and “Pahlavi will return.” The channels had emerged not gradually, through months of campus organizing, but almost simultaneously at the exact moment that student protests resumed.

The visual material made the coordination difficult to miss. Formation statements reproduced from the associations’ channels were saturated with the same imagery—crowns, imperial emblems, the Lion and Sun, Pahlavi portraits and pre-1979 national colors. The individual universities appeared different; the political product was remarkably consistent.

At the center of this network stood the Amir Kabir Newsletter.

The name carried historical weight. The original Amir Kabir student publication had emerged from the university movement of the late nineteen-nineties and had become associated with student dissent. The contemporary publication operating under the same name had no institutional connection with that earlier newsletter, but the inherited name supplied something valuable: credibility.

Until late 2025, the publication had largely reported student arrests, campus repression and university affairs. Then its editorial direction shifted sharply toward promoting Pahlavi. When the Lion and Sun Associations appeared, the newsletter became their principal media platform.

It published their formation announcements. It amplified their statements. The association channels referred back to it. Within days, students began describing what the associations were actually doing on campus.

On February 24, around seventy politically active students participated in a Clubhouse discussion about the demonstrations. One participant said the associations had appeared just as the movement was “beginning to flare up.”

At Amir Kabir and Tehran universities, he said, members of the associations intervened against further demonstrations. At Tehran University, students were told to remain silent and refrain from chanting. The protest ended early.

“They appear to declare their opposition to the regime,” the student concluded, “but in practice they are helping to suppress the students.”

Another student, Sima, had spoken that day with students at Tehran University, Iran University of Science and Technology and Shahid Beheshti University. The accounts she received were strikingly similar.

Republican students were being prevented from making themselves heard. Pro-Pahlavi slogans were being promoted. The associations were cooperating with Herasat, the university security apparatus. And names were being collected.

At the University of Gilan, one student had agreed to participate in an evening demonstration but refused to chant for Pahlavi. Members of the association threatened him: either repeat the preferred slogan or have his personal information circulated.

Sima added that activists’ names were being handed, one by one, to security offices at some universities. The Gilan episode exposed the political function of the associations more clearly than any declaration could.

این بخش از صحبت‌های دانشجویان را با دقت بشنوید: انجمن‌های شیروخورشید که در دانشگاه‌ها مشغول تشکیل‌اند، در حال سرکوب سایر دانشجویان دگراندیش هستند / خبرنامه امیرکبیر اکاذیب‌نامه است.
ویدیوی کامل اتاق گفت‌وگوی دانشجویان پیشرو را در پست کوت‌شده پیدا کنید. https://t.co/j0QtvDQ09V

— Kambiz Ghafouri (@KambizGhafouri) February 24, 2026

The student was not being asked merely to oppose the regime. He already did.

He was being asked to accept a specific political identity—to turn his opposition to the regime into support for Pahlavi. When he refused, the response was not persuasion. It was a threat.

The boundary between political campaigning and security work became even more difficult to distinguish when channels connected to the associations announced branches of the “Immortal Guard” and, at Iran University of Science and Technology, the creation of a campus “SAVAK” intended to identify individuals.

Lion_and_Sun_Associations

Other posts accused active students of receiving money from the MEK and threatened them with pursuit by the student “Immortal Guard.”

An organization claiming to represent a revolution against the regime was now using the language of surveillance while students accused it of passing names to the Islamic Republic’s own security offices.

Within five days, the university protests had largely been extinguished. The associations had promoted Pahlavi, marginalized rival voices, pressured students, collected identifying information and, according to student testimony, cooperated with Herasat.

What happened in the universities was therefore not an isolated dispute between monarchist and republican students.

It was the concentrated version of a political method that had been developing for years.

A monarchist slogan could enter a protest under the protection of the security apparatus. State media could condemn it until everyone knew it. Cyber accounts could transform it into evidence of national consensus. Foreign broadcasters and genuine supporters could carry the message further. And finally, organizations could appear inside the universities claiming that the same political line represented the students themselves.

The Iranian regime did not need to restore the monarchy. It only needed monarchy to occupy the space where an alternative capable of overthrowing it might otherwise emerge.

Tasnim had already explained why. A weak monarchist current could help the Islamic Republic survive.

The Lion and Sun Associations were the campus expression of that logic: royalist in appearance, security-minded in behavior, and most effective precisely when the students they claimed to represent were struggling to keep their own movement alive.