Iran General NewsIran's Global Social Media Propaganda Campaign

Iran’s Global Social Media Propaganda Campaign


Fire Eye

Iran Focus

London, 28 August – After being alerted by the vigilant researchers at the cybersecurity firm FireEye, Facebook, Google, and Twitter have deleted hundreds of accounts.

The FireEye team followed what looked to the untrained eye like unrelated threads for the last few month. They examined the phone numbers used by these accounts to sign up for Twitter, the emails they used to register domains, and the changes to their account names over time. The Iranian operation began to unravel.

FireEye published a report on Thursday, explaining exactly how their investigation played out, saying that the campaign followed a playbook similar to the one used by Russian propagandists at the Internet Research Agency during the 2016 election. However, the big difference was that the Russians staked out both sides of almost any issue — pitting Americans against each other in an aim to divide the country. The Iranian accounts, instead, supported their own domestic interests.

Lee Foster, manager of information operations analysis at FireEye explained,” The Russian accounts seemed to be designed to sow divisions between groups for the purpose of undermining trust in the democratic process, and creating a distraction within US politics.” Foster continued, “On the Iranian side, I get the sense that it was one-sided. We didn’t see pro- and anti-Palestinian content. We saw anti-Israeli commentary and pro-Palestinian commentary.”

The Russians posed as both Trump and Bernie Sanders supporters, but the Iran-linked websites and pages pushed anti-Trump content. Much of the network FireEye discovered seems to have been created in early 2017, after Trump assumed office.

Trump campaigned on overturning the Iran Nuclear Deal, which lifted economic sanctions on the country in exchange for tightened restrictions on Iran’s nuclear program. Trump exited the Deal in May of this year, heightening the danger of escalating cyberattacks from an already active Iran. In fact, last March, the US indicted nine Iranians for cyberattacks on 144 US universities. This week, the cybersecurity firm Secure works published a new report indicating that those attacks continue.

The main node promoting these messages in the United States was called Liberty Front Press, and the email address used to register the site appears to be associated with a web designer in Iran. It was also used to register a separate website in the network called Instituto Manquehue, which targeted Latin Americans with positive messages about the Venezuelan and Bolivian president, who have friendly relationships with Iran.

FireEye’s investigation began with Liberty Front Press and spread from there. “We looked at who else is pushing content from this site online, and we were able to identify additional clusters of accounts and look at what they are pushing,” Foster says. “Repeating the cycle, we end up with this network of these different inauthentic news sites and social media accounts.”

In addition to Instituto Manquehue, FireEye’s analysts found two additional networks masquerading as US news groups — US Journal and Real Progressive Front, and two sites purporting to be based in the United Kingdom — The British Left and Critics Chronicle.

These sites repeatedly focused on news regarding the Middle East, covering topics like the Syrian civil war and Palestinian rights. Much of the content was stolen from sites like RawStory, CNN, and Politico. Using open source tools, the researchers found that the Twitter accounts affiliated with these sites also stole pictures from stock photos and news stories to populate fake personas who were registered with phone numbers using Iran’s +98 country code. They also appeared to be most active at times that corresponded with the Iranian work week.

According to Foster, there is still more work to do analyzing the content of these accounts and pages. Much of it must come from the tech companies themselves. FireEye has no access to information about the audiences these pages and accounts amassed, or whether they were made up of authentic or inauthentic users. The team at FireEye will also continue to keep watch across all of these platforms for signs of what the big tech companies may have missed. “We’ll be continuing as if it was any other day,” Foster says, “looking for new activity, not just from Iran, but from wherever it may emanate.”

Representatives from the tech industry are reportedly gathering in San Francisco this week to share information about what types of information operations they’ve uncovered, and how they plan to tackle the problem going forward.

Latest news

Iranian People’s Resistance Changed the Appeasement Policy

Soon after the new US government started its obligations in January 2021, hand in hand with the European governments...

Khamenei’s Disgraceful Campaign Against Piranshahr and Javanrud, Who Will Be the Loser?

On the 67th day of Iran’s revolution, the Iranian regime attempted to put a halt to the protests in...

Iran: Expensive Medicine, Cheap Human Life

A look at the equipment and weapons that the Iranian regime has been using against its people to suppress...

Who Is Abolqasem Salavati Iran Regime’s Killer Judge?

Last week, it was announced that the case of several people who were arrested during the Iranian People's uprising...

Iran Revolution Characteristics

More than two months have passed since the start of the latest round of protests in Iran against the...

Iran’s Regime Is Unable To Eradicate Protests

Totalitarian governments, whether be it a monarchy or a clerical regime, and their international supporters are pursuing the same...

Must read

New deadly chopper crash in Iran

AFP: Two people were killed Saturday when their helicopter...

Iran criticizes Turkey over missile defense shield

AP: Iran criticized Turkey on Tuesday for agreeing to...

You might also likeRELATED
Recommended to you