The Sound of Silence: Detecting Influence Operations Through Internet Blackouts

Background

In August 2025, we published a CRC Spotlight report on a suspected Iranian influence network. The malign activity cluster consisted primarily of English- and Spanish-language X (formerly Twitter) accounts, each addressing distinct political narratives aligned with specific geopolitical objectives.

The English-language cluster focused heavily on Scottish and Irish independence, persistent anti-England rhetoric, and sustained narrative pressure against British political institutions. In contrast, the Spanish-language cluster has been consistently promoting pro-Maduro content, anti-U.S. framing, and broader Latin American anti-Western narratives. This thematic separation, coupled with observed cross-account amplification and unique biographical features, pointed to a coordinated hostile influence campaign (HIC), rather than organic political discourse.

From the outset, many of these profiles exhibited non-authentic behavioural signals: unusually high posting frequency, limited personal interaction, narrative rigidity, and synchronised activity patterns tied to external events rather than domestic UK or European news cycles.

If that was not enough, in November 2025, the launch of X’s new location transparency feature provided condemning evidence, by showing that most of the network was in fact being operated from Iran using proxy services (For more information, read the CRC Spotlight Article: From Rollout to Fallout: The Impact of X’s Location Transparency Feature).

Internet Blackouts as an Attribution Indicator

A crucial indicator of foreign coordinated inauthentic behavior (CIB) was the apparent correlation between Iranian internet shutdowns and the sudden inactivity of identified sockpuppet clusters. This pattern was first observed during the Iran–Israel escalation in June 2025, when Iranian internet connectivity collapsed following Israeli and U.S. strikes.

Figure 1: Iran's internet shutdown during the Iran-Israel war (June 2025), Courtesy of Netblocks.org

At that time, many pro-Scottish Independence assets fell silent almost simultaneously, despite having posted intensively in the preceding days. Disinformation watchdogs reported that the network went dark immediately after Iran’s internet infrastructure was disrupted on 13 June 2025.[i] The simultaneity of the silence served as a key confidence booster for the identification of operational dependence on Iranian internet connectivity.

The findings were widely published by media outlets and narrative intelligence vendors, resulting in a limited number of deactivations of inauthentic accounts.

A Repeated Pattern

Between 5 and 7 January 2026, localised internet disruptions were reported across parts of Iran, particularly in urban areas associated with rising protest activity. These disruptions escalated on 8 January 2026, when Iranian authorities cut off global internet access nationwide, citing national security concerns.

According to network monitoring organization NetBlocks, the imposed internet blackout was part of a series of censorship measures that “restricted the public’s right to communicate at a critical moment”[ii].

Figure 2: Iran's internet shutdown during the December 2025-January 2026 protests, Courtesy of Netblocks.org

Similarly, Cloudflare reported a near-total collapse in Iranian web traffic, with a reduction approaching a 100% after earlier declines of approximately 90%. Limited access reportedly remained available to elements of the Iranian government, military, and security apparatus.[iii]

According to CRC analysts, every operational asset within the monitored dataset ceased posting between 5 and 8 January. This second instance of coordinated silence aligns precisely with the documented nationwide internet blackout in Iran:

Figure 3: Cumulative Account Activity - Total posts from the Iranian HIC operational assets cluster, Courtesy of XPOZ.

Figure 4: Individual Account Activity - Daily posting patterns across individual accounts associated with the Iranian HIC, Courtesy of XPOZ.

The Show Must Go On

Recent reporting, including publications by multiple investigative outlets, was followed by a new wave of account deactivations. As of January 14, 2026, several identified inauthentic accounts were either deleted or suspended. Among these are prominent personas that disappeared entirely, reinforcing the assessment that mounting asset exposure triggered mitigation or shutdown by the threat actor.

Figure 5: Examples of recently suspended X sockpuppet accounts associated with the Iranian hostile influence campaign, Courtesy of X

However, at present, the network has not been dismantled in its entirety, and some inauthentic accounts remain technically operational, albeit temporarily inactive due to the internet shutdown. If not suspended or removed by X, these accounts are likely to resume content proliferation.

Figure 6:  X sockpuppet accounts linked to the Iranian hostile influence campaign that remain unsuspended, Courtesy of X

Implications for Counter Influence Operations

The repeated synchronization between Iranian connectivity loss and the sudden inactivity of suspected sockpuppet accounts contributed to the attribution of these operational assets to Iranian threat actors. It enhanced the understanding of their technical practices, infrastructure dependencies, and overall existing operational limitations.

Although the investigation –like Iranian hostile influence efforts themselves – remains ongoing, several methodological and practical conclusions can already be drawn for threat researchers and counter-HIC practitioners:

1. Internet connectivity disruptions as detection signals - national or regional internet access fluctuations serve as a valuable confidence booster, enabling both correlation and attribution of suspected activity clusters.

2. Bottom-up detection approaches – Documented, large-scale internet connectivity shutdowns (an exceptionally rare occurrence) should be automatically ingested and incorporated into agnostic detection frameworks.

3. Condemnation does not equate to remediation – Even compelling, well-documented exposure of hostile influence campaigns does not result in immediate platform takedowns. The gradual remediation observed in this case highlights the persistent challenge of countering HICs, even after networks have been mapped and verified.

4. Sustained mitigation requirements - Effective mitigation requires continuous monitoring, proactive reporting, and community-driven engagement. Prolonged remediation demands consistent defender investment and substantial resource allocation, while allowing threat actors continued opportunities to disseminate adversarial narratives.

The CRC continues to monitor the reported threat clusters and will publish further findings as additional data becomes available.

---

[Footnotes:]

[i] Cyabra. Uncovering Iran’s Online Manipulation Network. [online] Published 9 July 2025. Available at: https://cyabra.com/reports/uncovering-irans-online-manipulation-network/; UK Defence Journal, B. Davis. Figures claim 26% of recent Scot independence posts by Iran. [online] Published 23 August 2025. Available at: https://ukdefencejournal.org.uk/figures-claim-26-of-recent-scot-independence-posts-by-iran/; Scottish Daily Express, D. Walker, Politics. Iranian pro-Scottish independence accounts go silent after Israel attacks. [online] Published 25 June 2025. Available at: https://www.scottishdailyexpress.co.uk/news/politics/iranian-pro-scottish-independence-accounts-35450209; MSN (via Forward), P. Cramer. When Iran’s internet went down during its war with Israel, so did bot networks spreading disinformation: Report. [online] Published 14 July 2025. Available at: https://www.msn.com/en-us/news/world/when-iran-s-internet-went-down-during-its-war-with-israel-so-did-bot-networks-spreading-disinformation-report/ar-AA1IAx29

[ii] NetBlocks. Update: #Iran has now been offline for 48 hours, as telemetry shows the nationwide internet blackout remains firmly in place. [online] Published January 2026. Available at: https://mastodon.social/@netblocks/115880269709982943

[iii] The New York Times, F. Fassihi & P. Baskar & S. Mahoozi. Iran Is Cut Off From Internet as Protests Calling for Regime Change Intensify. [online] Published 8 January 2026. Available at: https://www.nytimes.com/2026/01/08/world/middleeast/iran-protests-internet-shutdown.html; Deutsche Welle, K. Sexton & W. Dockery & S. Sobhan. Iran: Internet cut off as protests spread nationwide. [online] Published 9 January 2026. Available at: https://www.dw.com/en/iran-internet-cut-off-as-protests-spread-nationwide/a-75440793