Likes for Lorestan

On Oct. 11, Facebook said it had removed a network of 93 profiles, 15 groups, 14 pages and 194 Instagram accounts in September that originated in Iran and engaged in “coordinated inauthentic behaviour” to target domestic audiences in the country. 

The identified activity provides a fascinating insight into the breadth and depth of Iranian information operations, with the oldest assets created in 2011 and some still active as of September this year. The campaigns range from the targeting of domestic audiences with pro-regime propaganda, to criticism of geopolitical rivals such as Saudi Arabia and the United States, and sustained attempts to undermine and disrupt opposition groups. Additionally, two Instagram accounts posted in French about French political issues for a short period in 2019, but failed to attract an audience.  

The actors also employed a varied and evolving set of tactics, techniques and procedures, including the use of fake Facebook profiles with stolen pictures, establishing a network of sham media outlets, impersonating prominent opposition figures, and calling on their followers to harass specific individuals.  

Below is a summary of our key findings:

• We identified multiple open-source indicators that appear to corroborate Facebook’s attribution to individuals associated with the Islamic Revolutionary Guard Corps (IRGC). These included the promotion of a “cyberspace volunteer force” reportedly operated under the direction of the IRGC, and sourcing content from pro-Iranian blogs and websites that other researchers have tied to the Iranian Ministry of Intelligence.
   
• Assets in the set displayed clear signs of inauthentic behaviour and operating in a coordinated manner, ranging from the use of batch-created fake profiles with stolen pictures, to sham media outlets cross-posting pro-regime content, and accounts impersonating members of the MEK.
   
• The network invested heavily in building a presence on Instagram, likely because of its focus on domestic audiences in Iran where Facebook has been blocked since 2009. There was a notable spike in Instagram account creations in the first three months of this year.
   
• Overall, the activity appears to have had limited reach and impact. Many accounts in the set were abandoned at the point of creation, and others were set to private with only a handful of followers. The actors’ attempts at deception also failed - such as when a fake Facebook profile posing as a senior MEK member was repeatedly called out by seemingly authentic users as an Iranian government-operated asset. 
   
• The activity set covers a broad range of operations and targets, united by an apparent overarching goal of shoring up support for the Iranian government and its military forces while seeking to disparage and disrupt Tehran’s adversaries, whether by attacking the reputation of its geopolitical rivals or seeking to undermine political opposition groups.