- Filed
- September 18, 2026, 04:14 UTC
- Actor
- Operators of the Elaj / Alaj platform at alajgroup.ir, promoted on 14 September 2026 by Fars News Agency and IRIB without a named ministry, judiciary, or intelligence letterhead on the launch copy
- Target
- Iranians inside the country asked to treat reporting on the diaspora as civic security work, and Iranians abroad asked to treat published dossiers as the start of a legal and financial punishment track
- Source
- Unidentified Source blurred: contractors, cutouts, buried disclosure
- Confidence
- high Multiple independent open sources, low disagreement about the facts
- Techniques
- Name-callingScapegoatingFear appealSemantic hijackingDisclosure theater
- Where
- Iran, Iranian Diaspora, Europe, North America
- Channels
- alajgroup.ir launch page and public-report form
- Fars News Agency 14 September 2026 launch item by Mohammadreza Dehghan
- IRIB / IRIB News Telegram amplification
- Bale handle alajgroup and Telegram @AlajGroup4
- Published diaspora dossiers with national ID fields
- 16 September 2026 operator suspension notice on Bale
Summary
On 14 September 2026 Fars News Agency announced that a monitoring platform named Elaj (علاج, Cure) had begun work to identify and punish khainan-e kharej-neshin, expatriate traitors. The Fars copy said the site's mission was to guard national security against anti-homeland currents, separatists, and promoters of sanctions and military attack, and that betrayal of Iran carries a legal price through revocation of citizenship privileges and the cutting of financial and media access. Fars pointed readers to alajgroup.ir, a Bale handle, and Telegram @AlajGroup4, and promised that informant identities would stay encrypted. IRIB amplified the same launch. IranWire recorded published profiles that included names, photographs, national ID numbers, birth dates, and fathers' names, and relayed the operators' claim of 1,600 files with 600 from public reports. By 16 September Zoomit showed the site suspended; operators blamed traffic and cyber attacks by satliha. Score the Fars text, the domain, the IRIB lift, and the suspension notice as high. Score a named ministry owner and the 1,600 count as not independently shown.
Analysis
The last two active briefs covered an Israeli Diaspora Ministry UN-week site and a U.S. House Trojan Horses hearing. Rotation this cycle is Iranian state-adjacent work aimed at the diaspora, not another Knesset or Capitol frame and not the IRGC CyberAv3ngers water-PLC file already scored on 17 September.
Fars on 14 September 2026 is the primary. The headline and lead use the same noun: khainan-e kharej-neshin. The mission sentence names anti-homeland currents, separatists, and promoters of sanctions and military attack. The penalty sentence says betrayal of Iran has a legal price and that punishment runs through revocation of citizenship privileges and the cutting of financial and media access, backed by continuous intelligent monitoring. The same item points the public to alajgroup.ir, a Bale address, and Telegram @AlajGroup4, and promises that informant identities will remain confidential and encrypted. Radio Farda recorded a parallel IRIB item the same Persian date, 23 Shahrivar 1405, on citizenship privileges and financial and media cutoffs. IranWire on 15-16 September described published profiles that included real names, photographs, national ID numbers, birth dates, and fathers' names, and relayed the operators' own count of 1,600 monitored files with 600 from public reports. Zoomit on 16 September documented the site going to a suspended state and quoted the operators blaming extraordinary traffic and cyber attacks by satliha. Score those dated texts, the domain, and the takedown notice as high. Score a signed Ministry of Intelligence or IRGC-IO ownership memo, and any independent audit of the 1,600 figure, as not shown.
Mechanism is name-calling first. Traitor, separatist, and anti-homeland do the work before a statute, a court file, or a named act appears. Scapegoating parks a stack of harms — sanctions, war talk, ethnic unrest, inflation-era anger — on a bounded out-group that already left. Fear-appeal is the prescribed remedy: report the name, wait for the privileges to fall. Semantic-hijack sits in the title. Cure and national security are stretched until a public doxxing form reads as treatment. Disclosure-theater is the costume of process: encrypted informant IDs, a judiciary-forwarding promise, no named legal authority, no named office on the Fars launch, and a site that vanished inside two days while the labels kept traveling on state wires.
This is propaganda on the method test where origin is an unnamed shop plus two state amplifiers, form is a civic reporting portal, and the design goal is to move identification so a neighbor's report reads as security hygiene and a published dossier reads as a verdict. Gray color does not cancel the method. A state may lawfully prosecute a named crime. Publishing national ID numbers of people abroad under a traitor heading, while hiding the operator and blessing the form on Fars and IRIB, is the influence layer. A same-method test applies in reverse. A Western interior ministry that launched cure.gov to crowdsource files on emigre critics, stamped them traitor, promised encrypted tips, and had the public broadcaster sell the portal as national security would be this brief with the letterhead swapped.
Literacy counter: keep three objects apart. One: the 14 September Fars item, the alajgroup.ir address, the IRIB lift, the dossier fields IranWire recorded, and the 16 September suspension notice. Those are records. Two: traitor, cure, and citizenship-privilege as operator frames. Those are readings. Three: the instruction that object one proves every listed exile is a tasked agent of sanctions, or that object two proves the site was only a joke because it went down. If the payload is two or three, the stack is still doing method work. If the payload is one, open the Fars launch, the IranWire dossier description, and the Zoomit suspension quote on the same screen.
Tells
- A virtue title (Cure) on a public doxxing form with no named office
- Traitor used as the heading before a statute or court file appears
- Encrypted informant promise that does not travel with the published dossier
- State wires selling a site whose operator will not put a ministry on the masthead
- A two-day disappearance explained as traffic and enemy hacking rather than a legal defect
Evidence
- Fars News, 14 Sep 2026: Elaj launch, traitor heading, alajgroup.ir, encrypted-tip promise
- IranWire, 15 Sep 2026: IRIB promotion, published ID fields, 1,600/600 operator claim
- IranWire feature, 16 Sep 2026: Subject Code 005 dossier fields and crowdsource-to-judiciary path
- Radio Farda, 16 Sep 2026: IRIB 23 Shahrivar item on privilege and access cutoffs
- Zoomit, 16 Sep 2026: site suspended; operators blame traffic and satliha attacks
- DW Farsi, 15 Sep 2026: Fars and IRIB framing of expatriate traitors
Related briefs
- Sep 17, 2026UnidentifiedIRGC-affiliated CyberAv3ngers used cheap PLC lockouts and defacement slogans so U.S. water incidents would read as a homeland terror front.
- Sep 17, 2026UnidentifiedThree Iranian propaganda offices used Claude as a staff shop to plan soft-war personas and paste IRGC lines onto Western think-tank letterhead.
- Sep 18, 2026IdentifiedIsrael's Diaspora Ministry timed a govextra site and U.S. ad burst so UN Gaza reporting would read as a poison machine ahead of the General Assembly.