A network of fake social media accounts impersonated political candidates and journalists to spread messages in support of Iran and against U.S. President Donald Trump around the 2018 congressional elections, cybersecurity firm FireEye said on Tuesday.
The findings show how unidentified, possibly government-backed, groups could manipulate social media platforms to promote stories and other content that can influence the opinions of American voters, the researchers said.
This particular operation was largely focused on promoting “anti-Saudi, anti-Israeli, and pro-Palestinian themes,” according to the report by FireEye.
The campaign was organized through a series of fake personas that created various social media accounts, including on Twitter and Facebook. Most of these accounts were created last year and have since been taken down, the report said.
Spokespersons for Twitter and Facebook confirmed FireEye’s finding that the fake accounts were created on their platforms.
Lee Foster, a researcher with FireEye, said he found some of the fake personas—often masquerading as American journalists—had successfully convinced several U.S. news outlets to publish letters to the editor, guest columns, and blog posts.
These writings displayed both progressive and conservative views, the report said, covering topics including the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization.
“We’re assessing with low confidence that this network was organized to support Iranian political interests,” said Foster. “However, we’re not at the point where we can say who was doing it or where it’s coming from. The investigation is ongoing.”
Before the 2018 midterm elections, the nameless group created Twitter accounts that also impersonated both Republican and Democratic congressional candidates. It is unclear if the fake accounts had any effect on their campaigns.
The imposter Twitter accounts often plagiarized messages from the politicians’ legitimate accounts, but also mixed in posts voicing support for policies believed to be favorable to Tehran. Affected politicians included Jineea Butler, a Republican candidate for New York’s 13th District, and Marla Livengood, a Republican candidate for California’s 9th District. Both Livengood and Butler lost their bids in the election.
Livengood’s campaign called the situation “clearly an attempt by bad actors” to hurt her campaign, and noted that Livengood was “a strident opponent of nuclear weapons in Iran.”
Butler could not be immediately reached for comment.
Twitter said in a statement that it had “removed this network of 2,800 inauthentic accounts originating in Iran at the beginning of May,” adding that its investigation was ongoing.
Facebook said it had removed 51 Facebook accounts, 36 Pages, seven Groups and three Instagram accounts connected to the influence operation. Instagram is owned by Facebook.
The activity on Facebook was less expansive than that on Twitter and it appeared to be more narrowly focused, said Facebook head of cybersecurity policy Nathaniel Gleicher. The inauthentic Facebook accounts instead often privately messaged high profile figures, including journalists, policy-makers, and Iranian dissidents, to promote certain issues.
Facebook also concluded the activity had originated in Iran.
