Elon Musk appeared to show support for the recent anti-government protests in Iran, taunting Supreme Leader Ayatollah Ali Khamenei on X, changing the Iranian flag emoji on X to the pre-revolutionary version, and letting Iranians access his Starlink satellite service for free amid an internet blackout in the country.

But even as Musk positions himself as an opponent of Iran’s Islamic regime, his platform X has been providing premium service to an array of Iranian officials, government agencies, and state-controlled media organizations targeted by U.S. sanctions, the Tech Transparency Project (TTP) found. Many of these accounts have been using X to spread Iranian government messages and propaganda about the protests, with one official posting, “This time, we will show no mercy to the rioters.”

Because X requires a paid subscription to get premium service, it has likely received revenue from these Iranian individuals and groups—a potential violation of U.S. economic sanctions. X Premium accounts get access to a number of perks, including blue checkmarks and the ability to write longer posts, upload longer videos, and share in advertising revenue.

TTP’s findings show how X has provided special service to sanctioned members of Iran’s regime even as Musk shows support for Iranians who took part in weeks of protests. The Trump administration has made sanctions a centerpiece of its “maximum pressure” campaign to force Iran to give up its nuclear weapon ambitions and drop its support for terrorists. U.S. Treasury Secretary Scott Bessent reiterated that strategy at the World Economic Forum in Davos, Switzerland on Jan. 20.

X, its parent company xAI, and Musk's SpaceX, which recently acquired xAI, did not respond to a request for comment on TTP's findings. But after Wired, which covered this report, shared five of the individual accounts with X, the platform removed the checkmarks from four of them.

The Treasury Department did not respond to TTP's request for comment, but a spokesperson told Wired that while the agency does not comment on specific reports, "we take allegations of sanctionable conduct extremely seriously."

Mass protests erupted in Tehran in late December in response to rising inflation and the falling value of the Iranian currency, and quickly spread across the country. The Iranian government responded with a violent crackdown that left thousands of people dead, according to activists. Amid the turmoil, Iranian authorities shut down the country’s internet.

In January, President Trump warned Iran that the U.S. is “locked and loaded” if Iran kills peaceful protestors, and promised the protesters that “help is on the way,” leading to speculation about a military strike. Trump also said he would speak to Musk about restoring internet to Iran. The Treasury Department announced a new round of Iran sanctions, and Trump said Iran should “make a deal” on its nuclear program or risk being hit by a U.S. “armada.”

The Treasury Department’s Office of Foreign Assets Control (OFAC), along with the U.S. Commerce Department’s Bureau of Industry and Security, have enforced sanctions on the government of Iran for decades. OFAC also enforces sanctions targeted at individual Iranian officials and organizations known as Specially Designated Nationals. OFAC prohibits U.S. companies from engaging in transactions with sanctioned entities unless they fall under exemptions known as general licenses or obtain authorization from the government.

As the Iran protests unfolded, TTP identified more than two dozen X Premium accounts for Iranian government officials and state-controlled media outlets that are either directly sanctioned by the U.S. or are part of the Iranian government. All of the accounts had blue checkmarks, which X reserves for paid premium subscribers. X’s own policies explicitly prohibit users subject to OFAC sanctions from using its paid services, including premium.

This apparent disregard for U.S. sanctions is part of a pattern for X. Previous TTP reports have highlighted how the platform has provided premium service to sanctioned officials in Iran and sanctioned leaders of Iranian proxy groups like Hamas, Hezbollah, and the Houthi rebels.

TTP identified more than two dozen X accounts for Iranian government officials and organizations that displayed a blue checkmark, indicating they paid for premium service. (These are distinct from gray checkmarks, which X distributes to heads of state like Ayatollah Ali Khamenei.) Many of the accounts showed they were verified in August 2025 or later, indicating they started subscribing to X premium within the past six months.

Several of the accounts were for Iranian officials and groups that are listed as Specially Designated Nationals by OFAC. For example, Gholamhossein Mohseni-Ejei, the head of Iran’s judiciary, appeared to have a blue checkmark account with the handle @ejei_org. The account, which states in Farsi that it belongs to Ejei, has more than 8,000 followers. It was created in June 2021 and verified with a checkmark in November 2025. Ejei previously served as Iran’s prosecutor general and minister of intelligence. The Treasury Department announced sanctions against him in September 2010, saying as intelligence chief he oversaw arrests of protesters and political figures in 2009 that resulted in beatings and torture.

During the most recent round protests in Iran, Ejei signaled there would be fast trials and executions for people taking part in the unrest. A pinned post on his X account from Jan. 5, days after the protests began, warns in Farsi, “This time, we will show no mercy to the rioters...” Ejei has regularly posted lengthy videos, a benefit of X Premium status. (Regular X accounts have a video limit of 140 seconds.) Top Iranian officials like Ejei continue to post freely on X despite the government’s imposition of a nationwide internet blackout on Jan. 8.

Another Specially Designated National is Ali Larijani, a senior aide to Iran’s supreme leader, who appeared to have a blue checkmark account with the handle @alilarijani_ir. The account, which has more than 127,000 followers, was created in May 2021 and verified in September 2024. The Treasury Department announced sanctions against Larijani in January 2026, calling him one of the “architects of Iran’s brutal crackdown on peaceful protests.” According to the Treasury announcement, Larijani, who serves as head of Iran’s Supreme Council for National Security, coordinated the government’s response to the protests and called for Iranian security forces to repress demonstrators. TTP first identified Larijani’s account in a May 2025 report. On Jan. 13, in response to a Trump Truth Social post urging Iranians to “KEEP PROTESTING,” Larijani wrote on X that Trump is one of the “main killers of the people of Iran.”

Ali Akbar Velayati, a member of the Supreme Leader’s inner circle and Iran’s former foreign minister, also appeared to have a blue checkmark account, with the handle @Drvelayati_ir. The account, which gives Velayati’s name and titles in Farsi, was created in December 2024 and verified with a blue checkmark in September 2025. The Treasury Department announced sanctions against Velayati in November 2019, saying he gave the regime of former Syrian dictator Bashar Assad a “lifeline” through oil and investment deals. (Assad was ousted in December 2024.) Treasury also cited the fact that Velayati was charged with homicide in connection with the 1994 bombing of a Jewish community center in Buenos Aires, Argentina that left 85 people dead. Argentine prosecutors have called Velayati one of the “ideological masterminds” behind the attack.

Babak Zanjani, a sanctioned businessman accused of laundering money for the Iranian regime, had a blue checkmark account with the handle @babakzanjani3. The account, which is linked on Zanjani’s website, was created in December 2019 and verified in March 2023. It also had an “ID verified” badge, a service available to premium subscribers who submit a government-issued ID and selfie to X to confirm their identity. In announcing sanctions on Zanjani in January 2026, the Treasury Department called him a “criminal Iranian investor,” noting that he was once jailed in Iran for embezzling oil revenue. Later freed from imprisonment to launder money for the Iranian regime, Zanjani has provided financial backing for Iran's Islamic Revolutionary Guard Groups (IRGC), according to Treasury. The IRGC, a U.S.-designated foreign terrorist organization, is also a Specially Designated National subject to multiple sanctions. Zanjani was previously sanctioned by the U.S. in 2013 but was later removed from the sanctions list in 2016.

Another example is Tasnim News Agency, a U.S.-sanctioned Iranian news outlet that appeared to have two blue checkmark accounts. One account for breaking news, @Tasnimbrk, has over 22,100 followers. It was created in June 2024 and verified a year later. Another account that promotes Tasnim News coverage of the Israeli-Palestinian conflict, @tasnim_pal, was created and verified in September 2025. The U.S. announced sanctions against Tasnim News Agency in September 2023, saying it was founded by two commanders of the IRGC. According to the Treasury Department, Tasnim has helped Iranian security services crush dissent by crowdsourcing the identities of protesters. In February 2024, TTP identified a different Tasnim premium X account which later lost its blue checkmark.

Press TV, the English-language satellite channel of Iran’s state broadcaster, appeared to be affiliated with two blue checkmark accounts, @Stream_liv and @video_streamz. The accounts, which livestream Press TV coverage, were created and verified in September 2024. They do not identify themselves as Press TV-operated, but the official Press TV X account follows both accounts and at one point had a @Stream_liv post pinned to the top of its feed. X said in June 2024 that only premium subscribers would be able to livestream content, though TTP could not find mention of this in X’s official policies. The Treasury Department announced sanctions against Press TV in September 2023, saying it has “broadcasted scores of forced confessions and derogatory programs about Iranian activists.”

Press TV’s parent organization, Islamic Republic of Iran Broadcasting (IRIB), is also a Specially Designated National subject to U.S. sanctions. IRIB has faced intense backlash in Iran over a state TV program that made a joke about the dead bodies of people killed in the recent protests.

Another batch of premium X accounts identified by TTP are not Specially Designated Nationals but are part of the government of Iran, which is subject to sanctions enforced by OFAC. U.S. regulations consider the government of Iran to include “any entity owned or controlled directly or indirectly” by the government.

One of the existing “general licenses” carving out exemptions in the Iran sanctions pertains to social media and internet services. Issued in September 2022, it allows U.S. tech companies to offer platforms and services to the Iranian people to help them evade digital surveillance and censorship amid widespread anti-government protests. It also allows the government of Iran to access such services provided they are “publicly available” and “at no cost.” That appears to rule out X selling premium service to Iranian government entities.

Among the representatives of Iran’s government with X Premium accounts was Mohammad Mahdi Mirbagheri, a fundamentalist ayatollah and member of Iran’s Assembly of Experts, the body that selects and oversees the country’s supreme leader. TTP identified a blue checkmark account for Mirbagheri with the handle @mirbaqeri_ir. The account, which shows banner and profile images of the cleric and gives his name in Farsi, has more than 87,000 followers. It was created in March 2017 and verified in July 2025. Mirbagheri is part of a group of hardliners that backed 10-year prison terms for hijab violations in Iran. He has been mentioned as a possible successor to Khamenei.

In addition, Mohammad Bagher Qalibaf, Iran’s parliament speaker, appeared to have a blue checkmark account with the handle @mb_ghalibaf. The account, which gives his name and title in Farsi and has more than 325,000 followers, was created in November 2018 and verified with a blue checkmark in August 2025. Qalibaf, a former Revolutionary Guard general, is known for supporting a crackdown on Iranian university students in 1999. While serving as Iran’s police chief, he also reportedly ordered live gunfire on student protestors in 2003. During the recent round of Iran protests, Qalibaf used his X account to claim that foreign intelligence services were stoking the unrest and warn that U.S. military forces in the region would be a “legitimate target” in the event of an American attack. The post exceeded 280 characters, a benefit of X Premium status.

Ahmed Naderi, another Iranian parliament member, appeared to have a blue checkmark account with the handle @Ahmadnaderi_ir. The account was created in February 2020 and verified with in September 2025. In addition to being part of the Iranian government, which is under U.S. sanctions, Naderi has been individually sanctioned by the European Union since February 2023.

Abbas Araghchi, Iran’s foreign minister, also appeared to have a blue checkmark account with the handle @araghchi. The account’s profile clearly states his name and government position in English. His account, which has over 282,000 followers, was created in October 2013 and verified in December 2018. The verification date indicates that Araghchi received a blue checkmark prior to Musk’s acquisition of X, when checkmarks were distributed to prominent individuals for free. But under Musk, X has required such “legacy” accounts to subscribe to premium service to retain the blue check.

TTP identified additional X Premium accounts for Majid Takht-e Ravanchi and Kazem Gharibabadi, two of Iran’s deputy foreign ministers; Esmaeil Baqaei, a foreign ministry spokesman; and Mohammad Hossein Ranjbaran, a foreign ministry advisor. Abbas Mousavi, a veteran Iranian diplomat who is now chief of protocol for the office of Iran’s president, Masoud Pezeshkian, also appeared to have an X Premium account.

TTP also identified an array of blue checkmark accounts for Iranian government media and communications officials. These include Fatemeh Mohajerani, the government’s spokeswoman; Sattar Hashemi, Iran’s communications minister; Behzad Akbari, the deputy communications minister; Ali Ahmadnia, chief of communications for President Pezeshkian; Elias Hazrati, a state media official who is close to Pezeshkian; Mohammad Golzari, secretary of the government’s information council; and Hossein Kermanpour, a spokesman for Iran’s health ministry.

The account for Ahmadnia, the communications chief for Iran’s president, had a button for accepting tips in bitcoin. The tips feature—which is available to all X accounts, not just premium subscribers—lets users contribute cash or cryptocurrency to an account. X’s tipping policy says users must comply with sanctions to use the feature. (Terrorist groups have been making increasing use of crypto to circumvent detection in the traditional banking sector.)

Several other Iranian news organizations that are clearly part of the government apparatus have been enjoying X Premium service.

For example, Al-Alam, an Iranian state-run television network, had a blue checkmark account with the handle @alalam_ar. It was created October 2024 and verified in June 2025. TTP first identified @alalam_ar in a May 2025 report. (The account appears to have lost its checkmark at some point after TTP’s May report but later got it back.) Al Alam’s official Telegram channel links to this X account. In June 2021, the U.S. Justice Department seized the web domains of Al-Alam and dozens of other Iran-linked sites for sanctions violations. Al-Alam is part of the U.S.-sanctioned state broadcaster, Islamic Republic of Iran Broadcasting.

The state-run Islamic Republic News Agency (IRNA) had a blue checkmark account with the handle @IrnaEnglish. The account, which has 155,000 followers, was created in December 2016 and verified in September 2017. It was also “ID verified.” TTP first identified this account in February 2024. The English version of IRNA’s website links directly to this account.

Iran in Arabic, an Iranian government news agency, had a blue checkmark account with the handle @iraninarabic_ir. The account, which has 1.4 million followers, was created in February 2020 and verified in June 2025. TTP first identified the account in its May 2025 report, after which the account appears to have briefly lost its blue checkmark. The account, which is linked on the website for Iran in Arabic, says the organization is the “Voice of the Islamic Republic of Iran in the Arab World” and is approved by Iran’s Ministry of Culture and Islamic Guidance.

Tehran Times, a state-run English-language daily, had two blue checkmark accounts. One account with the handle @TehranTimes79 is linked directly through the outlet’s official website. That account, which has more than 195,000 followers, was created in September 2016 and verified in June 2021. A second account with the handle @TTimes_Opinion was created and verified in November 2024. It has been promoted by the first Tehran Times account.