---
title: Fars and IRIB sold Alaj as civic healing while it crowdsourced traitor dossiers on Iranians abroad.
url: https://propagandaarchive.org/briefs/20260916-2000Z-alaj-diaspora-traitors/
description: On 14 September 2026 Fars News Agency announced a monitoring system named Alaj (Persian for remedy) to identify and punish traitors abroad.
section: Watch briefs
---

![Illustration: a Cold War intelligence-dossier collage dominated by a distressed world map with connecting routes, coordinates and highlighted regions.](https://propagandaarchive.org/static/generated/detail/hero-map-heavy.jpg)

[Watch briefs](https://propagandaarchive.org/briefs/) · September 16, 2026

# Fars and IRIB sold Alaj as civic healing while it crowdsourced traitor dossiers on Iranians abroad.

- **Filed:** September 16, 2026, 20:00 UTC
- **Actor:** Fars News Agency and IRIB amplifying the unnamed Alaj platform operators, with President Masoud Pezeshkian supplying the same-week traitor-diaspora line; FBI attributes the parallel CHOSEN BRICK leak-and-harass tail to actors working on behalf of Iran's Ministry of Intelligence and Security
- **Target:** Domestic audiences asked to inform on relatives and neighbors abroad, and diaspora critics, journalists and activists meant to hear traitor as a legal status rather than a slogan
- **Source:** Unidentified Source blurred: contractors, cutouts, buried disclosure
- **Confidence:** **documented** Primary documents, court records, official disclosures
- **Techniques:** [Name-calling](https://propagandaarchive.org/techniques/name-calling/) [Scapegoating](https://propagandaarchive.org/techniques/scapegoating/) [Identity fusion](https://propagandaarchive.org/techniques/identity-fusion/) [Fear appeal](https://propagandaarchive.org/techniques/fear-appeal/) [Narrative laundering](https://propagandaarchive.org/techniques/narrative-laundering/)
- **Where:** Iran, Iranian Diaspora, United Kingdom, United States, Netherlands
- **Channels:** Fars News Agency announcement of Alaj, 14 September 2026IRIB framing of Alaj as a monitoring and intelligence platformalajgroup.ir plus Bale and Telegram intake channelsPresident Pezeshkian remarks in Tehran, 14 September 2026, carried by Tehran TimesNCSC-FBI-AIVD joint advisory on CHOSEN BRICK, 15 September 2026Pro-Iranian leak sites that have published stolen personal detailsZoomit report of the Alaj site outage, 16 September 2026

## Summary

On 14 September 2026 Fars News Agency announced a monitoring system named Alaj (Persian for remedy) to identify and punish traitors abroad. IRIB, dpa and IranWire restated the copy: the platform would safeguard national security against anti-homeland currents, separatists, and sanctions or military-attack promoters; betrayal carries a legal price; punishment runs through stripping citizenship privileges and cutting financial and media access via monitoring. Citizens could file names at alajgroup.ir, on Bale as alajgroup, or via Telegram's @AlajGroup4, with informant identity promised secret. The same week President Pezeshkian told a Tehran meeting that Iranians abroad aligning with the enemy seek to incite the public. On 15 September the UK NCSC, FBI and Dutch AIVD published a joint advisory that CHOSEN BRICK spyware, used by Iranian state cyber actors since 2025, has fed personal details onto pro-Iranian leak sites. Zoomit reported the Alaj site went offline a day after launch. Score the Fars text, the presidential line, and the advisory as documented. Score command of Alaj by a named ministry, and any claim that every diaspora critic is a CHOSEN BRICK victim, as not in this file.

## Analysis

The last two briefs in this vault covered a CCP Ethnic Unity Publicity Week and a Lavrov festival speech that treated European troop talk as an attack on Russia. This cycle rotates to an Iranian state-media launch that turns a denunciation portal into a public virtue.

Primary layers agree on the copy and split on ownership. Fars, 14 September 2026, wrote that a monitoring and intelligence system named Alaj had started work to identify and punish abroad-based traitors. The introduction text, reprinted by Rouydad24 and later summarized by dpa, said Alaj's main mission is safeguarding national security and the interests of the Iranian people against anti-homeland currents, separatists, and promoters of sanctions and military attack; that betrayal of Iran has a price and a legal burden; and that punishment would proceed by stripping citizenship privileges and cutting financial and media access, relying on intelligent and continuous monitoring. The same text asked compatriots to register those identities at alajgroup.ir, on the domestic messenger Bale, and at @AlajGroup4 on Telegram, and promised that informant identities would stay confidential, encrypted and preserved. IRIB introduced the same object as a monitoring and intelligence platform aimed at identifying and punishing abroad-based traitors. IranWire, 16 September, recorded subject-code dossiers that listed residence, occupation, social accounts and relatives, and noted an Alaj_Group channel circulating since at least April 2026; the operators' own metrics claimed about 1,600 compiled files, roughly 600 from public reports. President Pezeshkian, speaking in Tehran on 14 September and quoted the next day by Tehran Times, said America has closed the routes and is seeking to create divisions, and that if empathy and cohesion hold, Iran will never bow to America. Separate wires quoted him saying some Iranians abroad, aligning themselves with the enemy, seek to incite the public. On 15 September the NCSC, FBI and AIVD published that CHOSEN BRICK, active against individuals in the UK, US and the Netherlands from at least 2025, collects contacts, mail and messages, and that personal details of some previous victims have appeared on pro-Iranian leak sites. The FBI's Iran cyber page dates that advisory 15 September 2026. A March 2026 FBI FLASH already tied MOIS Telegram-C2 malware to intelligence collection, data leaks and reputational harm, including Handala Hack claims. Score those dated texts as documented. Score a named ministry as the Alaj payer, and any claim the 16 September outage destroyed the dossiers, as not shown.

Mechanism is name-calling doing statute work. Traitor, anti-homeland, separatist, and promoter of sanctions arrive before a named act. Scapegoating parks complex harms — sanctions, war damage, protest, social strain — on a bounded out-group of Iranians who left. Identity-fusion follows: once reporting is framed as protecting the people, a method question about the portal reads as a loyalty question about the asker. Fear-appeal is the prescribed remedy sitting next to the label: citizenship privileges removed, money and media cut, leak-site publication, and, in the advisory layer, device takeover via fake MRI files and fake antivirus. Narrative-laundering is the skin. Healing, monitoring, intelligent continuous watch, and encrypted civic duty make a snitch portal look like a public-health desk. The CHOSEN BRICK social-engineering layer is the covert twin of the same method: the operator pretends to be a known contact or tech support so the file that steals the life looks like care.

This is propaganda because the week is built to move identification and fear, not to try a named person against a published charge sheet. The Alaj launch is white-to-gray: Fars and IRIB are named, the operators of the site are not. CHOSEN BRICK social engineering is black: the source is falsified on the lure. White copy does not make the method civic. It is not a finding that no Iranian abroad has taken foreign money, that sanctions have no authors, that CHOSEN BRICK is invented, or that every critic is a victim of this stack. A same-method test applies in reverse. A Western ministry that opened a Healing portal for citizens to file traitor dossiers on emigre journalists, promised secret informants, and published stolen family details on patriotic leak sites would be this brief with the nouns swapped.

Literacy counter: separate three objects this week stacks. One: a dated Fars announcement and a dated presidential sentence. Those are public. Two: a website and messenger inboxes that collect names. Those are real pipes. Three: the claim that filing a neighbor proves betrayal and that checking the portal is itself disloyalty. If the payload is three, the launch is doing method work. If the payload is one or two, ask which statute, which charge, and which named ministry will stand behind the file.

## Tells

- Healing, monitoring, or public-health language standing in front of a denunciation inbox
- Traitor or anti-homeland used as a status before a named charge sheet
- Secret-informant promises printed next to a request for names, relatives and social accounts
- A presidential unity speech in the same window as a portal that splits the nation into reporters and targets
- Stolen personal details later appearing on patriotic leak sites rather than in a court filing

## Literacy counter

Separate three objects this week stacks. One: a dated Fars announcement and a dated presidential sentence. Those are public. Two: a website and messenger inboxes that collect names. Those are real pipes. Three: the claim that filing a neighbor proves betrayal and that checking the portal is itself disloyalty. If the payload is three, the launch is doing method work. If the payload is one or two, ask which statute, which charge, and which named ministry will stand behind the file.

## Evidence

1. [Fars News Agency, 14 September 2026: Alaj launched to identify and punish abroad-based traitors](https://farsnews.ir/mohammadreza_dehghan/1789398958163734612/%D8%AE%D8%A7%D8%A6%D9%86%D8%A7%D9%86-%D8%AE%D8%A7%D8%B1%D8%AC-%D9%86%D8%B4%DB%8C%D9%86-%D8%A8%D8%A7-%D8%B3%D8%A7%D9%85%D8%A7%D9%86%D9%87-%D8%B1%D8%B5%D8%AF%DB%8C-%D8%B9%D9%84%D8%A7%D8%AC-%D8%B4%D9%86%D8%A7%D8%B3%D8%A7%DB%8C%DB%8C-%D9%85%DB%8C-%D8%B4%D9%88%D9%86%D8%AF)
2. [Tehran Times, 15 September 2026: Pezeshkian on U.S. efforts to sow division and the need for national unity](https://www.tehrantimes.com/news/530027/Pezeshkian-warns-of-US-efforts-to-sow-division-calls-for-national)
3. [UK NCSC, 15 September 2026: joint advisory with FBI and AIVD on CHOSEN BRICK targeting dissidents](https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists)
4. [FBI Iran cyber overview listing the 15 September 2026 CHOSEN BRICK advisory](https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran)
5. [Reuters, 15 September 2026: UK, US and Netherlands issue advisory on Iran-linked spyware](https://www.reuters.com/world/uk-us-netherlands-issue-advisory-iran-spyware-2026-09-15/)
6. [IranWire, 16 September 2026: Alaj subject-code dossiers, IRIB framing, claimed file counts](https://iranwire.com/en/features/157659-alaj-the-rise-of-crowdsourced-surveillance-platforms-in-iran/)
7. [dpa, 15 September 2026: Fars line that betraying Iran has a price; 600 public reports claimed](https://dpa-international.com/politics/urn:newsml:dpa.com:20090101:260915-930-688131/)
8. [bne IntelliNews, 16 September 2026: Zoomit reports Alaj taken offline a day after launch](https://www.intellinews.com/iranian-informant-platform-targeting-citizens-abroad-goes-offline-a-day-after-launch-468123/)

## Related briefs

- Sep 16, 2026Impersonated — [A MEK/NCRI-aligned Claude agent named Viktor cloned a real activist's Telegram voice and sold Rajavi copy as ordinary Iranian speech.](https://propagandaarchive.org/briefs/20260916-0900Z-mek-ncri-viktor/) — [Synthetic media](https://propagandaarchive.org/techniques/synthetic-media/) [Astroturfing](https://propagandaarchive.org/techniques/astroturf/) [Narrative laundering](https://propagandaarchive.org/techniques/narrative-laundering/) [Plain folks](https://propagandaarchive.org/techniques/plain-folks/) [Manufactured consensus](https://propagandaarchive.org/techniques/manufactured-consensus/)