Iran underground resistance is drawing new attention after a series of attacks on IRGC personnel inside the country, while several opposition networks claim or encourage clandestine activity against the Islamic Republic.
Some deadly attacks are documented, including operations claimed by Xori Hiva in western Iran. Elsewhere, movements such as Reza Pahlavi’s Immortal Guard and MEK-linked Resistance Units promote or claim separate forms of underground action.
That does not prove Iran now faces one coordinated resistance movement, nor that every recent killing of IRGC personnel belongs to the same campaign.
The more important question is whether fragmented clandestine resistance is beginning to create a broader security problem: can multiple underground networks make the regime’s own enforcers, intelligence structures and local control increasingly vulnerable from within?
What Do We Actually Know About the Recent Attacks on IRGC Members?
Confirmed attacks have killed and wounded IRGC personnel inside Iran, but the available evidence is considerably stronger for individual incidents than for claims of a coordinated nationwide assassination campaign.
On June 29, two members of the Islamic Revolutionary Guard Corps were killed and two others wounded in a shooting in Iran’s western Kermanshah province. According to Reuters, Iranian state media reported that the IRGC itself confirmed the casualties and said the attackers opened fire outside the guardsmen’s home. Xori Hiva, also known as Sun of Hope, later claimed responsibility for the attack.
Another attack followed in Piranshahr on July 25. Hengaw reported that 32-year-old IRGC member Hamed Daeizadeh was killed and another member seriously wounded when gunmen attacked their vehicle. Xori Hiva again claimed responsibility.
Other targeted attacks and resistance claims have since been reported, but their perpetrators, connections, and level of independent verification vary. The evidence therefore supports a series of attacks—not yet a proven nationwide assassination campaign.
Sources:
Reuters: Two Revolutionary Guards members killed by gunmen in western Iran
Hengaw: IRGC member killed, another seriously wounded in armed attack in Piranshahr
Who Is Xori Hiva and What Can Be Verified About It?
Xori Hiva, also reported as Khori Hiva and translated as “Sun of Hope,” appears to be a newly emerged Kurdish clandestine group, but little is publicly known about its organization, leadership, or membership.
Al-Monitor described the group as newly formed when it claimed responsibility for an attack on IRGC personnel in Paveh in late June. Its documented activity so far is associated primarily with Kurdish-majority areas of western Iran, while its actual size and operational reach remain unclear. There is no reliable evidence that it represents a nationwide organization or coordinates Iran’s other underground networks.
Xori Hiva, therefore, provides some of the clearest evidence of recent armed underground activity, but it cannot be used to conclude that current resistance across Iran is Kurdish—or centrally coordinated.
Sources:
Al-Monitor: 3 IRGC members killed in twin attacks as Iran intensifies Kurdish crackdown
Is Iran’s Underground Resistance One Movement?
No. The Iran underground resistance landscape consists of several separate currents with different leadership, methods, political goals and geographic reach.
Reuters has independently described Iran’s wider opposition as deeply fragmented. Reza Pahlavi has also claimed contact with a large number of groups and cell leaders inside Iran, although Reuters was unable to independently verify the scale of that network. That distinction matters: evidence of multiple resistance currents is stronger than evidence that they form one coordinated underground structure.
Xori Hiva represents one armed current operating primarily in western Iran, but other underground initiatives are organized around very different political movements. Reza Pahlavi’s Rise Iran campaign, for example, promotes the creation of small, decentralized groups through what it calls the Immortal Guard of Iran, with the stated aim of weakening the Islamic Republic’s repressive apparatus. That confirms the existence of the initiative, but it does not independently verify claims that specific recent killings of IRGC personnel were carried out by Immortal Guard cells.
Separately, the MEK-linked National Council of Resistance of Iran reports activity by its own Resistance Units across numerous cities, including Tehran, Shiraz, Isfahan and other areas far beyond Iran’s Kurdish regions. Those reports must be treated as opposition claims rather than independently established evidence because the NCRI is itself part of the movement making them.
Iran therefore does not appear to have one underground resistance. The potential challenge for Tehran is that resistance may be fragmented rather than absent.
Sources:
Reuters: Regime change? Inside Reza Pahlavi’s faltering bid to lead Iran
Rise Iran: Immortal Guard of Iran
National Council of Resistance of Iran: Resistance Units Weekly Report: Nationwide Operations Target Tehran’s Campaign of Terror
Why Can Fragmented Underground Resistance Still Matter to the IRGC?
The fragmented Iran underground resistance landscape can still matter to the IRGC because the security system depends not only on centralized military power, but also on effective provincial and local enforcement.
That structure became especially visible during the 2026 crackdown. In March, the Council of the European Union sanctioned commanders of local IRGC branches for their direct role in violently suppressing protests. It also targeted the Mohammad Rasulullah Corps, responsible for coordinating IRGC and Basij forces in Tehran, and the Imam Reza Corps in Khorasan Razavi Province. The same sanctions package included surveillance and cyber-policing actors involved in monitoring citizens and controlling information.
Broader research on authoritarian surveillance helps explain why this local layer matters. A 2026 Oxford analysis describes authoritarian surveillance as an architecture of control in which state agencies, social relationships, and other actors work together to sustain nondemocratic rule. The security system therefore depends on more than central command alone.
These layers allow national authority to become local enforcement: information is gathered, individuals are identified, and security forces can act against perceived threats within specific communities.
Underground resistance therefore does not have to defeat the IRGC militarily to create problems for it. It can increase the cost, complexity, and risk of maintaining local control.
Sources:
Council of the European Union: Iran: Council sanctions an additional 16 persons and three entities over serious human rights violations
Oxford Research Encyclopedias: Authoritarian Surveillance
What Happens When the People Enforcing Fear Begin to Feel Vulnerable?
The balance changes when cooperation with the security state no longer appears to guarantee personal safety.
Research on political repression shows that fear can alter political behavior. An American Political Science Review study by Lauren Young found that fear increased risk aversion and pessimism and affected decisions about dissent. The research examined opposition supporters in Zimbabwe—not Iranian security personnel, so it does not show that such a shift is occurring inside the IRGC or Basij.
It does, however, support the broader mechanism: when perceived personal risk changes, political choices can change with it. The question for Iran is whether people connected to the security system begin recalculating the risks attached to cooperation.
Sources:
American Political Science Review: Lauren E. Young, The Psychology of State Repression: Fear and Dissent Decisions in Zimbabwe
What Could These Developments Actually Change Inside Iran?
If Iran underground resistance continues to expand, its biggest consequences may come not from casualty numbers but from changes in repression, security resources, local cooperation, and the regime’s perception of its own vulnerability.
Comparative research suggests that a growing internal threat can begin changing state institutions before that threat becomes militarily decisive. Rachel A. Schwartz’s research on counterinsurgent states shows how actors responding to an insurgent threat can reshape rules and institutions from within. Iran is not equivalent to the Central American cases in that research, but the broader mechanism is relevant: how a state responds to an internal threat can change the state itself.
The question, therefore, is not simply whether underground resistance can inflict damage. It is what the regime must change in order to contain it—and what those changes may cost.
Sources:
Princeton University: Rachel A. Schwartz, Undermining the State from Within: The Institutional Legacies of Civil War in Central America
Could Underground Attacks Trigger Even Harsher Repression?
Yes. The most immediate consequence of a growing underground threat may be more surveillance, arrests, and counter-insurgency rather than greater freedom.
Comparative research shows that governments facing escalating violent threats can respond by intensifying repression. A cross-national study published in Political Studies found that state violence is more likely to escalate when governments face growing armed threats, particularly where media freedom is constrained. That makes harsher repression a plausible response to expanding underground violence, although it does not mean such escalation is inevitable in Iran.
When authorities believe clandestine cells are operating among the population, the search for those networks can widen far beyond the individuals directly involved. Increased surveillance, raids, tighter security controls, and broader suspicion of communities can become part of the response, while those accused of supporting resistance may face harsher punishment.
That danger is especially relevant in Iran, where external threats have already been used to justify stronger domestic control. As discussed in Wartime Repression in Iran: How Does War Become a Weapon Against the People?, greater pressure on the regime can also mean greater pressure on the people living under it.
Sources:
Political Studies: Sabine C. Carey, Belén González & Neil J. Mitchell, Media Freedom and the Escalation of State Violence
Could the IRGC Be Forced to Spend More Resources Protecting Itself?
Could Underground Resistance Weaken Local Cooperation With the Regime?
Iran Underground Resistance: When Does It Become a National Threat?
Iran underground resistance would become a more serious national threat if independently verified clandestine activity appeared across unrelated regions while the regime struggled to identify and isolate the networks behind it.
A national threat would require a broader pattern: independently verifiable incidents in geographically different parts of Iran, activity that cannot be explained by a single ethnic or regional organization, and signs that security authorities are being forced to adjust their response across the country. Evidence that several local networks remain active despite attempts to dismantle them would strengthen that assessment further.
Comparative research also cautions against assuming that armed opposition develops through one organizational model. Studies of armed-group formation distinguish between groups emerging from broader movements, independent insurgent organizations and splinters from existing state structures. Multiple forms can therefore exist at the same time without belonging to one command structure.
Activity in Tehran or Isfahan alone would still not prove that one nationwide organization exists. The more important development would be simultaneous pressure from multiple independent networks, especially if that pressure begins forcing the state to treat underground resistance as a nationwide security problem rather than a collection of isolated regional threats.
Sources:
White Rose Research Online / University of York: Anastasia Shesterinina & Michael Livesey, Armed Group Formation in Civil War: ‘Movement’, ‘Insurgent’, and ‘State Splinter’ Origins
Why Does Mohsen Rezaei’s Return to Iran’s Security Leadership Matter Now?
Iran is reinforcing its national security leadership with one of the most experienced figures in IRGC history at the same time that parts of the security apparatus are facing growing internal challenges.
On August 10, Mohsen Rezaei was appointed secretary of Iran’s Supreme National Security Council. Supreme Leader Mojtaba Khamenei also appointed him as his representative on the council. Rezaei previously commanded the IRGC for sixteen years and remains a prominent figure within Iran’s military and political establishment. Reuters reported that no official explanation was given for the leadership change.
The contrast is notable: at the local level, IRGC personnel are becoming targets; at the national level, Iran has brought one of the institution’s most experienced veterans back to the center of security decision-making.
The timing matters, but causation is not established. For the broader question of institutional loyalty and where Iran’s power structure could fracture, see How Does the Iran Power Structure Actually Break?
Sources:
Reuters: Mohsen Rezaei appointed as secretary of Iran’s top security body
What Does Nick Berg’s Shadow Rider Story Reveal About Underground Resistance?
Nick Berg’s connection to underground resistance is unusually direct: his experiences as a teenager resisting the emerging Islamic Republic became part of the true-life foundation for Ricardo’s fictional journey in Shadows of Tehran.
Nick Berg describes Ricardo as only fourteen when he moves from rebellion into Iran’s underground resistance, becomes a rebel leader, and earns the name Shadow Rider of Tehran. When his identity is exposed, an execution order follows and he is forced to flee. It is clear that Nick’s own life is mirrored through Ricardo rather than reproduced as literal memoir.
That history matters now because clandestine resistance presents a fundamentally different security problem from visible protest. The Shadow Rider provides a historical lens for understanding how anonymity changes the contest between a security state and those operating against it.
Why Did Identifying the Shadow Rider Matter So Much?
A clandestine opponent becomes far easier to destroy once the state can connect a hidden identity to a real person, network, and location.
The regime did not merely need to stop what the Shadow Rider was doing. It needed to discover who the Shadow Rider was. Nick Berg describes how Ricardo’s teenage resistance made him a target and how identification transformed that resistance into a direct personal threat from the Revolutionary Guard.
Research on political repression supports the importance of identifying organizational structures and networks. Christopher Sullivan’s study of Guatemalan police archives shows how repression can be directed against dissident organizations and how organizational characteristics affect their vulnerability to state coercion.
That same security problem matters when assessing underground movements today: can authorities identify their networks, isolate individual cells, and trace the people supporting them, or do small local groups remain difficult to map?
The comparison is about the security problem created by clandestine resistance—not an equivalence between the movements.
Sources:
World Politics: Christopher M. Sullivan, Political Repression and the Destruction of Dissident Organizations
Could Underground Resistance Weaken the Regime Without Making Iran Freer?
Yes. Weakening authoritarian control and creating a freer political system are not the same process.
One possibility is that declining security control creates more space for broader civil opposition and eventually contributes to political transition. But comparative research points to a very different possibility as well.
A global study published in the British Journal of Political Science found that regional rebellions can contribute to greater political militarization, while separate research on democratic transitions found stronger improvements in political rights and civil liberties following nonviolent transitions than violent ones.
That distinction matters for Iran. Shadows of Tehran is relevant precisely because resisting an oppressive power does not determine what comes after it. Weakening the Islamic Republic and securing a freer Iran are two different political challenges.
Sources:
British Journal of Political Science: War Makes the Regime: Regional Rebellions and Political Militarization Worldwide
Journal of Peace Research: The Democratic Dividend of Nonviolent Resistance
Is Iran’s Underground Resistance Entering a New Phase?
Yes—there are growing signs that Iran underground resistance is entering a new phase. Not because one national insurgency has suddenly emerged, but because different clandestine currents are beginning to place pressure on the security system from multiple directions.
That fragmentation may itself become significant. A regime built on surveillance, identification and local enforcement becomes more vulnerable when it must search for several hidden networks at once while protecting the people who sustain its control.
Nick Berg’s Shadows of Tehran gives that struggle a powerful historical echo. As the teenage Shadow Rider learned, underground resistance becomes dangerous when the state cannot easily find, isolate or intimidate those behind it.
Today, the emerging question is whether Iran’s security apparatus can still keep that advantage—or whether it is beginning to lose it.
