Three-minute read
Iran’s regime has established a formidable cyber apparatus to serve its dual objectives of suppressing dissent domestically and engaging in cyber warfare internationally. At the core of this network lies Parsian Afzar Rayan Borna, a Tehran-based company operating under the guise of an IT services provider. Tied closely to the Ministry of Intelligence and operating with the cooperation of the Ministry of Foreign Affairs, this entity is implicated in surveillance, manipulation of public opinion, and large-scale cyberattacks on foreign targets.
Parsian Afzar Rayan Borna: Activities and Operations
Parsian Afzar, with its offices located on Amir Kabir Boulevard in western Tehran, plays a central role in Iran’s cyber strategy. While officially presenting itself as a computer services company, evidence reveals its deep integration into the regime’s cyber warfare infrastructure.
Key Operations
- Albania Cyberattack: One of Parsian Afzar’s most prominent operations was the 2022 attack on Albania’s infrastructure. This cyber offensive not only crippled critical systems but also led to the closure of Iran’s embassy in Tirana and the severance of diplomatic ties between the two nations.
- Fake Social Media Accounts: The company manages thousands of fake profiles on platforms such as X (formerly Twitter) and Instagram. These accounts are used to:
- Disseminate disinformation favoring the regime.
- Discredit opposition groups, including the MEK and NCRI.
- Amplify state propaganda.
- Cyber Espionage and Surveillance:
- Monitoring online activities of activists.
- Identifying and targeting dissidents.
- Training cyber operatives through Ravin Academy, a Ministry of Intelligence-affiliated institution specializing in hacking and espionage.
Iran’s Cyber Army: A Force of Disinformation for a Cursed Causehttps://t.co/S3LusEN4HB
— NCRI-FAC (@iran_policy) April 26, 2023
Cooperation with the Ministry of Foreign Affairs
Parsian Afzar’s operations are closely coordinated with the Ministry of Foreign Affairs, amplifying the regime’s international propaganda and diplomatic maneuvers. This collaboration involves:
- Utilizing diplomatic platforms to counter criticism of Iran’s human rights record.
- Deploying cyber strategies to sway international opinion in favor of Tehran.
- Facilitating activities through organizations like the Foundation for Dialogue and Friendship of Nations, which acts as a façade for cyber and propaganda campaigns.
The Ministry of Foreign Affairs’ involvement highlights the regime’s integrated approach, combining cyber tactics with diplomatic tools to suppress dissent and project influence globally.
Leadership and Training
The company has consistently been led by individuals with strong ties to the Iranian regime. Ali Eslami, the former CEO, was replaced in late 2022 by Reza Ghasemi, who also heads the Foundation for Dialogue and Friendship of Nations. This foundation, ostensibly a non-governmental organization, is a diplomatic tool used to shape global narratives and divert attention from the regime’s human rights violations. One of its key events, the Future of Peace and Human Rights in West Asia conference, featured figures like Alena Douhan, UN Special Rapporteur, and Christophe Peschoux, a former senior official of the UN Human Rights Council.
Ruhollah Mo'men Nasab, parliamentary special advisor on the so-called "internet users projection bill" and former commander of the cyber army reveals how #Tehran has been using @Twitter for #propaganda.
#Iran #InternetFreedom pic.twitter.com/kHzjtlEFvR— NCRI-FAC (@iran_policy) March 29, 2022
Exposed Operatives
Recent leaks have identified at least nine individuals involved in Parsian Afzar’s operations, including:
- Ali Talebi, Mohammad Rahimzadeh, and Ali Ansari Pouya (programmers and intelligence operatives).
- Others such as Mehdi Ebrahimi, Hamed Cheraghi, Hossein Ghasemi, Morteza Talebi, Mohammadreza Sheikhbahaee, and Morteza Jameaee.
These operatives are subjected to strict restrictions, including travel bans and close monitoring by the Ministry of Intelligence.
Broader Cyber Operations
Parsian Afzar’s activities are part of a larger framework orchestrated by Iran’s cyber army:
- Critical Infrastructure Attacks: Targeting systems in Europe, the U.S., and the Middle East.
- Phishing Campaigns: Extracting sensitive data from journalists, dissidents, and foreign targets.
#Iran News in Brief:
Basij chief calls for reinforcing the regime’s #cyber armyhttps://t.co/0KTt0uEdsW pic.twitter.com/aFeB9Xxwpm
— NCRI-FAC (@iran_policy) May 11, 2022
The Iranian regime’s Supreme Leader Ali Khamenei has explicitly endorsed cyber operations, framing them as a form of “Explanation Jihad” critical to advancing the regime’s objectives. This mandate underscores the strategic importance of these operations in promoting Tehran’s agenda both domestically and internationally.
In addition to international cyber offensives, Parsian Afzar’s activities directly undermine the rights of Iranian citizens. The company plays a pivotal role in surveilling activists, suppressing free speech, and aiding in the detention of dissidents. These actions, coupled with its cyberattacks on foreign infrastructure, place Parsian Afzar at the center of global scrutiny.
Efforts to Deflect Accountability
Through entities like the Foundation for Dialogue and Friendship of Nations, and in collaboration with the Ministry of Foreign Affairs, the regime attempts to mask its human rights abuses. Events and campaigns organized by this foundation aim to shape international opinion, portraying a façade of dialogue and peace while concealing Iran’s repressive tactics.
Study of #Iran’s Regime Cyber Activity Exposes Demonization Campaign Against the Iranian Resistance#ShutDownIranTerrorEmbassies #WeStand4FreeIran https://t.co/yplhMGpzEn pic.twitter.com/cymd5pMH5Q
— NCRI-FAC (@iran_policy) December 12, 2020
Conclusion
The revelations about Parsian Afzar Rayan Borna and its affiliates underscore the Iranian regime’s strategic use of cyber capabilities as a tool for repression and global influence. From large-scale cyberattacks to pervasive surveillance, the company’s activities exemplify the dual threat posed by Tehran’s cyber apparatus—violating both the rights of its citizens and the sovereignty of other nations. Addressing these operations is integral to safeguarding digital freedoms and countering human rights abuses.