Security researchers have uncovered a major new state-sponsored Iranian influence campaign using dozens of fake news sites and hundreds of spoofed social media accounts in an attempt to manipulate public opinion.
Most of the accounts in question were created between April 2018 and March 2019 and used to spread inauthentic content from sites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the US mid-terms, according to FireEye.
Some included profile pics lifted from social media users with the same name, and some described themselves as activists, correspondents, or “free journalist” in their profile.
Others even impersonated US political candidates, such as Republicans Marla Livengood and Jineea Butler. In the latter cases, those behind the scenes plagiarize some of their legitimate tweets and then add in pro-Iranian content.
The content promoted by these accounts was overwhelmingly pro-Iranian, pro-Palestinian and anti-Saudi, anti-Israeli. However, a small percentage of messages were anti-Iran, possibly to add legitimacy to them and/or to draw in those with opposing views who can then be targeted with messages in support of the Islamic Republic.
Interestingly, the campaign appears to have extended to legitimate print and online media sources via guest columns, letters and blog posts republished on these platforms. In some cases, the text for separate articles penned by 'different' individuals was almost identical, or had the same narrative. Most appeared in small local US news outlets.
FireEye said the content was in line with “Iranian political interests in a manner similar to accounts that we have previously assessed to be of Iranian origin.” However, definitive attribution is difficult, especially as most of the accounts have now been suspended.
“Apart from the narratives and messaging promoted, we observed several limited indicators that the network was operated by Iranian actors. For example, one account in the network, @AlexRyanNY, created in 2010, had only two visible tweets prior to 2017, one of which, from 2011, was in Persian and of a personal nature,” FireEye continued.
“Subsequently in 2017, @AlexRyanNY claimed in a tweet to be ‘an Iranian who supported Hillary’ in a tweet directed at a Democratic political strategist. This account, using the display name ‘Alex Ryan’ and claiming to be a Newsday correspondent, appropriated the photograph of a genuine individual also with the first name of Alex.”
In addition, while most accounts in this network had their language set to English, one was set to Persian, the vendor revealed.