State sponsored threat actors can assert subtle, long-term socio-political influence rather than use brute-force hackings or ransomware attacks.

A network of English-language social media accounts that engaged in inauthentic behavior and misrepresentation supposedly in support of Iranian political interests has been unearthed by threat researchers.

In addition to utilizing fake American personas that espoused both progressive and conservative political stances, some accounts impersonated real American individuals, including a handful of Republican political candidates that ran for House of Representatives seats in 2018.

Personas in this dubious network have also had material published in US and Israeli media outlets, attempting to lobby journalists to cover specific topics and orchestrating audio and video interviews with US and UK-based individuals on political issues.

Researchers from threat-hunting firm FireEye have not at this time tied these accounts to the broader influence operation they identified in 2018, but the aforementioned entities promoted material in line with Iranian political interests in a manner similar to accounts that were previously assessed to be of Iranian origin.

Most of the accounts in the network appear to have been suspended on or around the evening of May 9, 2019.

The Network unveiled

The accounts, most of which were created between April 2018 and March 2019, used profile pictures appropriated from various online sources, including, but not limited to, photographs of individuals on social media with the same first names as the personas. As with some of the accounts that were identified to be of Iranian origin in August 2018, some of these new accounts had self-descriptions as ‘activists’, ‘correspondents’, or ‘free journalist[s]’. Some accounts posing as journalists claimed to belong to specific news organizations, although we have been unable to identify individuals belonging to those news organizations with those names.

Narratives promoted by these and other accounts in the network included anti-Saudi, anti-Israeli, and pro-Palestinian themes. The account holders expressed support for the Joint Comprehensive Plan of Action (JCPOA), commonly known as the Iran nuclear deal; opposition to the Trump administration’s designation of Iran’s Islamic Revolutionary Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy toward the Ministerial to Promote a Future of Peace and Security in the Middle East (a U.S.-led conference that focused on Iranian influence in the Middle East more commonly known as the February 2019 Warsaw Summit); and condemnation of U.S. President Trump’s veto of a resolution passed by Congress to end U.S. involvement in the Yemen conflict.

Impersonation of US political candidates

Some Twitter accounts in the network impersonated Republican political candidates that ran for House of Representatives seats in the 2018 US congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

For example, the account @livengood marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month:

The @livengood_marla account plagiarized a number of other tweets from Livengood’s official account, including some that referenced Livengood’s official account username:

The @livengood_marla account also tweeted various news snippets on both political and apolitical subjects, such as the confirmation of Brett Kavanaugh to the US Supreme Court and the wedding of the UK’s Princess Eugenie and Jack Brooksbank, prior to segueing into promoting material more closely aligned with Iranian interests. For example, the account, along with others in the network, commemorated the United Nations’ International Day of the Girl Child with a photograph of emaciated children in Yemen, as well as narratives pertaining to the killing of Saudi journalist Jamal Khashoggi and Saudi Shiite child Zakaria al-Jaber, intended to portray Saudi Arabia in a negative light.

Leveraging of US/Israeli media

In addition to directly posting material on social media, researchers observed some personas in the network had leveraged legitimate print and online media outlets in the US and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published. Some personas were likely to have been fabricated for the sole purpose of submitting such letters, but these do not appear to maintain accounts on social media.

The personas claimed to be based in varying locations depending on the news outlets they were targeting for submission; for example, a persona that listed its location as Seattle, WA in a letter submitted to the Seattle Times subsequently claimed to be located in Baytown, TX in a letter submitted to The Baytown Sun. Other accounts in the network then posted links to some of these letters on social media.

The letters and columns, many of which were published in 2018 and 2019, but which date as far back as 2015, were mostly published in small, local US news outlets; however, several larger outlets have also published material that we suspect was submitted by these personas. In at least two cases, the text of letters purportedly authored by different personas and published in different newspapers was identical or nearly identical, while in other instances, separate personas promoted the same narratives in letters published within several days of each other.

The published material was not limited to letters; one persona, “John Turner,” maintained a blog on The Times of Israel website from January 2017 to November 2018, and wrote articles for the US-based site Natural News Blogs from August 2015 to July 2018. The letters and articles primarily addressed themes or promoted stances in line with Iranian political interests, similar to the activity conducted on social media.

Engagement in varied media activity

Personas in the network also engaged in other media-related activitis, including criticism and solicitation of mainstream media coverage, and conducting remote video and audio interviews with real US and UK-based individuals while presenting themselves as journalists. One of those latter personas presented as working for a mainstream news outlet.

Accounts in the network directed tweets at mainstream media outlets, calling on them to provide coverage of topics aligned with Iranian interests or, alternatively, criticizing them for insufficient coverage of those topics. For example, researchers observed accounts criticizing media outlets over their lack of coverage of the killing of Shiite child Zakaria al-Jaber in Saudi Arabia, as well as Saudi Arabia’s conduct in the Yemen conflict. While such activity might have been intended to directly influence the media outlets’ reporting, the accounts may have also been aiming to reach a wider audience by tweeting at outlets with a large following that would see those replies.

Conclusion

FireEye are continuing to investigate this and potentially related activity that may be being conducted by actors in support of Iranian interests. At this time, they are unable to provide further attribution for these activities, and note the possibility that the activity could have been designed for alternative purposes or include some small percentage of authentic behavior.

However, if it is of Iranian origin or supported by Iranian state actors, it would demonstrate that Iranian influence tactics extend well beyond the use of inauthentic news sites and fake social media personas, to also include the impersonation of real individuals on social media and the leveraging of legitimate Western news outlets to disseminate favorable messaging.

If this activity is being conducted by the same or related actors as those responsible for the Liberty Front Press network of inauthentic news sites and affiliated social media accounts that were exposed in August 2018, it may also suggest that these actors remain undeterred by public exposure or by social media platforms’ shutdowns of their accounts, and that they continue to seek to influence audiences within the US toward positions in line with Iranian political interests.