Taking an apparent cue from Russia, Iran has developed a fake news influence operation to push its agenda around the world, researchers said Tuesday.
The operation, discovered by US cybersecurity firm FireEye, consists of Iranian-run fake American personas, which exist across multiple social media profiles. Those accounts link to misleading news sites and espouse political views in line with the government of Iran.
The tactics are nearly identical to those used for years by Russia’s infamous “troll factory,” the Internet Research Agency, 13 members and affiliates of which were indicted in April as part of special counsel Robert Mueller's investigation into Russian election interference.
FireEye’s research, which it shared with BuzzFeed News, led Facebook and Twitter to suspend hundreds of accounts Tuesday for "coordinated, inauthentic behavior" associated with the Iranian influence operations, and a separate group of accounts originating in Russia.
“It really demonstrates it’s not just Russia that engages in this activity,” said Lee Foster, who manages FireEye’s Information Operations Intelligence division. “It indicates that other actors may perceive this activity as a fruitful way to pursue political or ideological goals.”
Unlike the Russian actors, whose US influence campaigns were most successful when imitating conservatives, the Iranians have primarily masqueraded as liberals. Using accounts that indicate progressive preferences, like an affinity for US Sen. Bernie Sanders, they pushed messages that were critical of Israel, President Donald Trump, and Saudi Arabia, Iran’s chief regional rival, FireEye found.
The research doesn’t make any claims about whether the Iranian government actually directed these operations, Lee said, though it would be a significant operation to undertake without official funding and direction.
Many of the Iranian attempts that researchers found were sloppy, and it’s not clear the extent to which any of them were successful in catching Americans’ attention. A search through the histories of many of the Iranian-affiliated accounts showed that they were originally registered with Iranian phone numbers and had previously pushed pro-Iranian government hashtags and celebrated Iranian national holidays, before they changed names and began claiming to be American. In many cases, suspected accounts would claim to originate in the US but would use strikingly bad English.
A number of the accounts pushed a family of fake news sites, Real Progressive Front, which claims to be “a progressive NGO that aims to support people’s movements for freedom, peace and justice, reaffirm civil rights and reduce the influence of money in politics” and makes no mention of Iran, but which FireEye’s research showed was likely created in and maintained from Iran. Other variants are region-specific, like the American Progressive Front and UK Progressive Front, as well as other accounts aimed at countries in the Middle East and Latin America.
In a statement, Virginia Sen. Mark Warner, the vice chair of the Senate Intelligence Committee, said that there was “no way the problem of social media manipulation is limited to a single troll farm in St. Petersburg, and that fact is now beyond a doubt."
“We also learned today that the Iranians are now following the Kremlin’s playbook from 2016,” Warner said.