By Mahmoud Hakamian
A network of fake social media accounts impersonated political candidates and journalists to spread messages in support of Iran and against U.S. President Donald Trump around the 2018 congressional elections, cybersecurity firm FireEye said on Tuesday.
The findings show how unidentified, possibly government-backed, groups could manipulate social media platforms to promote stories and other content that can influence the opinions of American voters, the researchers said.
This particular operation was largely focussed on promoting “anti-Saudi, anti-Israeli, and pro-Palestinian themes,” according to the report by FireEye.
The campaign was organised through a series of fake personas that created various social media accounts, including on Twitter and Facebook. Most of these accounts were created last year and have since been taken down, the report said.
Spokespersons for Twitter and Facebook confirmed FireEye’s finding that the fake accounts were created on their platforms, the Reuters news agency reported on Tuesday.
Lee Foster, a researcher with FireEye, said he found some of the fake personas – often masquerading as American journalists – had successfully convinced several U.S. news outlets to publish letters to the editor, guest columns and blog posts.
These writings displayed both progressive and conservative views, the report said, covering topics including the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization.
“We’re assessing with low confidence that this network was organised to support Iranian political interests,” said Foster. “However, we’re not at the point where we can say who was doing it or where it’s coming from. The investigation is ongoing.”
Twitter said in a statement that it had “removed this network of 2,800 inauthentic accounts originating in Iran at the beginning of May,” adding that its investigation was ongoing.
Before the 2018 midterms election, the nameless group created Twitter accounts that impersonated both Republican and Democratic congressional candidates. It is unclear if the fake accounts had any effect on their campaigns.
The imposter Twitter accounts often plagiarized messages from the politicians’ legitimate accounts, but also mixed in posts voicing support for policies believe to be favourable to Tehran. Affected politicians included Jineea Butler, a republican candidate for New York’s 13th District, and Marla Livengood, a republican candidate for California’s 9th District. Both Livengood and Butler lost in the general election.
Livengood and Butler could not be immediately reached for comment.
Facebook said it had removed 51 Facebook accounts, 36 Pages, seven Groups and three Instagram accounts, connected to the influence operation. Instagram is owned by Facebook.
The activity on Facebook was less expansive and it appeared to be more narrowly focussed, said Facebook head of cybersecurity policy Nathaniel Gleicher. The inauthentic Facebook accounts instead often privately messaged high profile figures, including journalists, policy makers and Iranian dissidents, to promote certain issues.
Facebook similarly concluded the activity had originated in Iran, although it’s not clear whether the operation was backed by the Iranian government.
Foster said the research demonstrates how groups will use a variety of different techniques and methods to push an agenda online.
Earlier this month, the Iranian regime was caught once again spreading misinformation and ‘fake news’ online.
‘Endless Mayfly’ is an Iran-aligned network of inauthentic websites and online personas used to spread false and divisive information primarily targeting Saudi Arabia, the United States, and Israel, according to a report published by Citizen Lab, a research group at the University of Toronto, on May 14, 2019.
Endless Mayfly publishes divisive content on websites that impersonate legitimate media outlets. Inauthentic personas are then used to amplify the content into social media conversations. In some cases, these personas also privately and publicly engage journalists, political dissidents, and activists, Citizen Lab said.
In addition to the personas, a network of pro-Iran websites aided in the dissemination of the inauthentic articles. In total, Citizen Lab documented 353 pages across 132 domains that referenced or linked back to the inauthentic articles.
The top ten domains that most frequently referenced the inauthentic articles are IUVM Press, AWD News, Whatsupic, Yemen Press, Middle East Press, Podaci Dana, Instituto Manquehue, Liberty Fighters, Real Nienovosti and Rasid. Of the top 10, eight (IUVM Press, Whatsupic, AWDNews, Yemen Press, Instituto Manquehue, and RealNienovosti.com) all share the same IP address or registration details, indicating they may be controlled by the same actor. There is no overlap in registration information or IP addresses between Endless Mayfly and the republishing network, however.
The Iranian regime has published a host of misinformation and ‘fake news’ reports against the leading Iranian opposition group People’s Mojahedin Organization of Iran (PMOI or Mujahedin-e Khalq, MEK) and Iranian opposition leader Maryam Rajavi on IUVM Press, AWD News, Whatsupic, Yemen Press, and Liberty Fighters.