The scale of the violence—put at 12,000 by Iran International and as high as 20,000 by CBS—has shocked many Iranians.
As images and accounts continue to emerge despite a near-total internet shutdown, attention has focused on who was responsible for the bloodshed.
Tehran maintains that the violence was the result of armed infiltrators backed by Israel and the United States who attacked civilians and police and damaged state property, which it says triggered their forceful response.
Iran’s Ministry of Intelligence said on Friday that it had arrested 3,000 people it described as members of “terrorist groups.”
There remains no evidence that any force beyond the Iranian police and Revolutionary Guards were behind the violence, though some Iranians aghast at the scale of the killing mooted the possibility Iraqi, foreign militias or even freed criminals lent a hand.
The Guards
Witness reports suggest that the primary force deployed on the streets was the Islamic Revolutionary Guard Corps (IRGC).
One video that circulated despite the internet shutdown appears to show a pickup truck mounted with a DShK heavy machine gun in western Tehran that resembles those used by the IRGC’s Imam Ali Security Unit, which is tasked with security operations in the capital.
Such footage, along with witness accounts collected by journalists and rights groups outside Iran, has fueled suspicion that the IRGC may have directly commanded the crackdown.
Some analysts have pointed to the IRGC’s overseas arm, the Quds Force, citing its track record abroad rather than confirmed reports.
The Quds Force has extensive experience in urban warfare from the Syrian conflict, where it supported Bashar al-Assad’s government against both protesters and armed opposition groups.
Reports of foreign fighter deployment
Shortly after demonstrations began, social media users reported the presence of Iraqi pro-Iran militias in Iran’s Khuzestan province.
Their potential involvement drew closer scrutiny after a series of reports and images circulated in Iraqi and international media. The reports remain unconfirmed.
On January 11, videos showed large groups of fighters from Iraq’s Popular Mobilization Forces (PMF) holding rallies in the southern Iraqi port city of Basra publicly declaring support for the Islamic Republic.
Iran’s Press TV later aired footage of a pro-government gathering near the Iranian embassy in Iraq, where participants carried flags associated with Iraqi militias such as Hashd al-Shaabi and Kataib Hezbollah, as well as Lebanon’s Hezbollah.
Other reports alleged more direct involvement. Iraqi television channel Al-Sumaria reported on Thursday that around 3,000 Iraqi fighters had crossed into Iran in a convoy of buses through the Shalamcheh border, disguised as religious pilgrims, to join IRGC bases in cities including Ahvaz.
CNN reported the same day that a military source said thousands of Iraqi militiamen had entered Iran through two border points, while an Iraqi security source cited the entry of hundreds more under the guise of pilgrims.
An image circulating online appears to show a dark armored vehicle believed by analysts to be used by Iraqi militias alongside Iranian police and IRGC units in Tehran. One man standing atop the vehicle is wearing a green headband commonly associated with Hashd al-Shaabi. The image has not been independently verified.
Some social media users have also alleged the involvement of other Quds Force-linked groups, such as the Fatemiyoun and Zeynabiyoun brigades, composed of Afghan and Pakistani Shiites previously deployed in Syria. Those claims also remain unconfirmed.
Use of criminal networks
There is no confirmed evidence that professional criminal networks were used in the latest crackdown. However, precedent exists.
During the 2009 protests, the IRGC released or recruited criminals from prison to suppress demonstrations. IRGC commander Hossein Hamedani—who was later killed in Syria—confirmed that 5,000 such individuals had been organized into three battalions.
“These three battalions showed that if we want to train fighters, we must bring in those who are used to knives and blades,” Hamedani told state-media reporters.
In subsequent years, images have surfaced showing some notorious Iranian convicts alongside IRGC forces in Syria, reinforcing long-standing claims that irregular actors have at times been incorporated into security operations.
Claims of drug use
Officials and critics have also offered competing explanations for some of the deaths, neither supported by verifiable evidence.
Iran’s Defense Minister Aziz Nasirzadeh asserted on Thursday that some protesters had died from overdoses of industrial drugs rather than violence, saying they showed “no other injuries.”
Dissident activists, by contrast, have raised the possibility that Captagon—an amphetamine-type stimulant—was used to increase aggressiveness among forces deployed to suppress protests.
The UN Office on Drugs and Crime has identified Syria as a major producer of Captagon, with large seizures of Syrian-origin pills documented in Iraq.
Foreign Minister Abbas Araghchi told Fox News on Wednesday that Tehran had “no plan to execute protesters.” President Donald Trump told reporters he had it “on good authority” that the killing of protesters had stopped.
White House Press Secretary Karoline Leavitt told reporters on Thursday that Tehran had halted 800 executions slated for the previous day following warnings by Trump.
Taken at face value, such statements by Iranian officialdom appear to mark official restraint. A closer look at the Islamic Republic’s record suggests otherwise.
Tehran has rarely—perhaps never—executed individuals under the formal charge of participating in an illegal gathering. Under Iran’s Islamic Penal Code, that offense does not carry the death penalty and is typically punishable by imprisonment.
In that narrow, technical sense, officials can plausibly claim that the state does not execute people for protesting. The distinction, however, lies in how protesters are subsequently defined.
Renaming protesters
Across successive protest movements, Iranian authorities have routinely reframed demonstrations by dividing participants into shifting categories: first “peaceful protesters” and “rioters,” and more recently “vandals,” “saboteurs” and “terrorists.”
These labels are not merely rhetorical. Each carries specific legal consequences.
“Security forces and the judiciary will show no tolerance whatsoever toward saboteurs," Iran's Supreme National Security Council said in a statement on Jan. 9.
The stark warning came a day after Supreme Leader Ali Khamenei said Tehran would accept legitimate economic protests but stop "rioters."
Once a detainee is removed from the category of protester, prosecutors gain access to a separate set of charges—including moharebeh (warring against God), efsad-fel-arz (corruption on earth), terrorism, armed action or collaboration with hostile states—all of which can carry the death penalty.
The underlying conduct may remain the same, but its legal classification changes.
In this way, the state’s claim that it does not execute protesters is technically consistent with its practice. Executions occur only after protest-related activity has been reclassified as a more serious offense.
The real danger
This approach is also reflected in the government’s longstanding assertion that it “recognizes the right to protest” while opposing only “chaos” or “violence.” In practice, independent demonstrations have not been permitted for decades.
Pro-government rallies, often organized by state institutions, proceed without restriction, while applications for lawful protests by independent political groups, civil organizations and even officially registered parties are routinely denied, regardless of legal compliance.
The result is a system in which the boundary between lawful protest and criminal conduct is not defined in advance, but determined after the fact. Legal terminology becomes flexible, allowing prosecutors to retrofit charges once arrests have been made.
This history helps explain why assurances based on terminology alone offer little protection.
In the absence of an independent judiciary, transparent trials or due process safeguards, commitments not to execute “protesters” leave ample room for coercive confessions, security-driven indictments and capital charges under different names.
The danger, then, is not that the Islamic Republic will execute people for protesting. It is that those who protest may still face execution once they have been renamed.
