Fake Social Media Accounts Spread Pro-Iran, Anti-Trump Messages During 2018 Election, Cybersecurity Firm Finds

A network of fake social media accounts impersonated political candidates and journalists to spread messages in support of Iran and against US President Donald Trump around the 2018 congressional elections, cybersecurity firm FireEye said on Tuesday.

The findings show how unidentified, possibly government-backed, groups could manipulate social media platforms to promote stories and other content that can influence the opinions of American voters, the researchers said.

This particular operation was largely focused on promoting “anti-Saudi, anti-Israeli, and pro-Palestinian themes,” according to the report by FireEye.

The campaign was organized through a series of fake personas that created various social media accounts, including on Twitter and Facebook. Most of these accounts were created last year and have since been taken down, the report said.

Spokespersons for Twitter and Facebook confirmed FireEye’s finding that the fake accounts were created on their platforms.

Lee Foster, a researcher with FireEye, said he found some of the fake personas — often masquerading as American journalists — had successfully convinced several US news outlets to publish letters to the editor, guest columns and blog posts.

These writings displayed both progressive and conservative views, the report said, covering topics including the Trump administration’s designation of Iran‘s Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization.

“We’re assessing with low confidence that this network was organized to support Iranian political interests,” said Foster. “However, we’re not at the point where we can say who was doing it or where it’s coming from. The investigation is ongoing.”

Twitter said in a statement that it had “removed this network of 2,800 inauthentic accounts originating in Iran at the beginning of May,” adding that its investigation was ongoing.

Before the 2018 midterms election, the nameless group created Twitter accounts that impersonated both Republican and Democratic congressional candidates. It is unclear if the fake accounts had any effect on their campaigns.

The imposter Twitter accounts often plagiarized messages from the politicians’ legitimate accounts, but also mixed in posts voicing support for policies believe to be favorable to Tehran. Affected politicians included Jineea Butler, a Republican candidate for New York’s 13th District, and Marla Livengood, a Republican candidate for California’s 9th District. Both Livengood and Butler lost in the general election.

Livengood and Butler could not be immediately reached for comment.

Facebook said it had removed 51 Facebook accounts, 36 Pages, seven Groups and three Instagram accounts, connected to the influence operation. Instagram is owned by Facebook.

The activity on Facebook was less expansive and it appeared to be more narrowly focused, said Facebook head of cybersecurity policy Nathaniel Gleicher. The inauthentic Facebook accounts instead often privately messaged high profile figures, including journalists, policy makers and Iranian dissidents, to promote certain issues.

Facebook similarly concluded the activity had originated in Iran, although it’s not clear whether the operation was backed by the Iranian government.

Foster said the research demonstrates how groups will use a variety of different techniques and methods to push an agenda online.