WASHINGTON – A network of fake social media accounts impersonated political candidates and journalists to spread messages in support of Iran and against U.S. President Donald Trump around the 2018 congressional elections, cybersecurity firm FireEye Inc. said on Tuesday.
The findings show how unidentified, possibly government-backed, groups could manipulate social media platforms to promote stories and other content that can influence the opinions of American voters, the researchers said.
This particular operation was largely focused on promoting “anti-Saudi, anti-Israeli, and pro-Palestinian themes,” according to the report by FireEye.
The campaign was organized through a series of fake personas that created various social media accounts, including on Twitter and Facebook. Most of these accounts were created last year and have since been taken down, the report said.
Spokespeople for Twitter Inc. and Facebook Inc. confirmed FireEye’s finding that the fake accounts were created on their platforms.
Twitter said in a statement that it had “removed this network of 2,800 inauthentic accounts originating in Iran at the beginning of May,” adding that its investigation was ongoing.
Facebook said it had removed 51 Facebook accounts, 36 pages, seven groups and three Instagram accounts connected to the influence operation. Instagram is owned by Facebook.
The activity on Facebook was less expansive than that on Twitter and it appeared to be more narrowly focused, said Facebook head of cybersecurity policy Nathaniel Gleicher. The inauthentic Facebook accounts instead often privately messaged high profile figures, including journalists, policymakers and Iranian dissidents, to promote certain issues.
Facebook also concluded the activity had originated in Iran.
Facebook content was posted in English or Arabic. Topics of discussion included public figures, U.S. secessionist movements, Islam, Saudi Arabian influence in the Middle East and politics in the United States and Britain.
About 21,000 accounts followed one or more of the Facebook pages, while about 1,900 accounts joined one or more of the groups and around 2,600 people followed one or more of the Instagram accounts, according to Gleicher.
FireEye said that some accounts in the social media campaign claimed to be activists, correspondents or “free journalists” in descriptions of the users.
Accounts expressed support for the Joint Comprehensive Plan of Action — the deal aimed at curbing Iran’s nuclear program in exchange for sanctions relief.
They also opposed the Trump administration’s designation of Iran’s Revolutionary Guard Corps as a Foreign Terrorist Organization, according to the cybersecurity firm.
The network’s Twitter accounts posed as Republican political candidates running in the 2018 U.S. congressional midterms, appropriating photos and plagiarizing tweets from legitimate accounts, FireEye said.
Early this year, Facebook said it took down hundreds of “inauthentic” accounts from Iran that were part of a vast manipulation campaign operating in more than 20 countries.
The pages were part of a campaign to promote Iranian interests in various countries by creating fake identities as residents of those nations, Gleicher said at the time.
The operators “typically represented themselves as locals, often using fake accounts, and posted news stories on current events,” including “commentary that repurposed Iranian state media’s reporting on topics like Israel-Palestine relations and the conflicts in Syria and Yemen,” according to Facebook.
Facebook has invested heavily in artificial intelligence and staff in an effort to stamp out efforts by state actors and others to manipulate the social network using fraudulent accounts.
Late last year, Facebook took down accounts linked to an Iranian effort to influence U.S. and British politics with messages about charged topics such as immigration and race relations.
The social network began looking into these kinds of activities after revelations of Russian influence campaigns during the 2016 U.S. election aimed at sowing discord.
Lee Foster, a researcher with FireEye, said he found some of the fake personas — often masquerading as American journalists — had successfully convinced several U.S. news outlets to publish letters to the editor, guest columns and blog posts.
These writings displayed both progressive and conservative views, the report said, covering topics including the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization.
“We’re assessing with low confidence that this network was organized to support Iranian political interests,” said Foster. “However, we’re not at the point where we can say who was doing it or where it’s coming from. The investigation is ongoing.”
Before the 2018 midterm elections, the nameless group created Twitter accounts that also impersonated both Republican and Democratic congressional candidates. It is unclear if the fake accounts had any effect on their campaigns.
The imposter Twitter accounts often plagiarized messages from the politicians’ legitimate accounts, but also mixed in posts voicing support for policies believed to be favorable to Tehran. Affected politicians included Jineea Butler, a Republican candidate for New York’s 13th District, and Marla Livengood, a Republican candidate for California’s 9th District. Both Livengood and Butler lost in the election.
Livengood’s campaign called the situation “clearly an attempt by bad actors” to hurt her campaign and noted that Livengood was “a strident opponent of nuclear weapons in Iran.”
Butler could not be immediately reached for comment.