Here’s how Iranian trolls used Russian tactics to woo liberals on Facebook

While Russia created bogus social media accounts to sow distrust in the American political system, at times promoting conflicting protests at the same time and place, newly revealed accounts linked to Iran appear to have focused on promoting that country’s interests abroad, especially to Western liberals.

Facebook reported on Tuesday that it’s taken down 652 Facebook pages, groups and accounts linked to the effort and Twitter says it suspended 284 from its service. The campaign, linked to a Iran-linked news site called Liberty Front Press, was first uncovered by the security firm FireEye.

“Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran, such as the U.S.-Iran nuclear deal (JCPOA),” according to a FireEye blog post. “In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity. However, it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics.”

Images from the accounts shared by Facebook included memes mocking President Trump, UK Conservatives and Brexit, as well as promoting Palestine and Quds Day, an Iranian-originated holiday celebrating Palestine and condemning Israel on the last day of Ramadan. According to FireEye and Facebook reports, Facebook and Twitter accounts used names like Berniecrats, The British Left, RiseAgainstTheRight and Progressive Front. In July, a Twitter page explicitly identified as belonging to Liberty Front Press rebranded itself to “Berniecrats” and began promoting Senator Bernie Sanders and other liberal U.S. politicians. Facebook reported accounts affiliated with the group promoted at least three Facebook events, but the company didn’t respond to a request for more detail about the events or what they promoted.

Websites for Liberty Front Press and other linked groups used emails addresses associated with Iranian sites and Web designers, and some of the sites’ Twitter accounts were registered with Iranian phone numbers, according to FireEye. Other Twitter accounts claiming to be American professionals but using what appear to be stolen photos promoted content from the main accounts, according to the firm. Facebook says other accounts apparently linked to the group “engaged in traditional cybersecurity attacks, including attempts to hack people’s accounts and spread malware, which we had seen before and disrupted.”

Separately, Facebook announced it had taken down additional pages, groups and accounts linked to Russian intelligence and focused on politics in Syria and Ukraine.

“We’re working closely with US law enforcement on this investigation, and we appreciate their help,” the company said. “These investigations are ongoing – and given the sensitivity we aren’t sharing more information about what we removed.”