Iranian social network scammers impersonated US political candidates

A new campaign geared towards promoting Iranian interests and spreading fake information by impersonating US political figures has been discovered by researchers.

Cybersecurity firm FireEye said on Tuesday that the campaign, believed to be an "Iranian influence operation," connected a vast web of fake social media accounts and news websites to spread a Pro-Iran, anti-Trump message.

"Dozens" of websites and "hundreds" of social media accounts are involved.

According to FireEye's Alice Revelli and Lee Foster, accounts within the network were created between April 2018 and March 2019. These fake accounts pilfered profile images from online sources and pretended to be political figures, activists, journalists, and correspondents.

The latest campaign is believed to be connected to an Iranian scheme uncovered by FireEye in August 2018, in which audiences in the US, UK, Latin America, and the Middle East were targeted. Fake news from sources such as Liberty Front Press (LFP), US Journal, and Real Progressive Front was promoted throughout.

However, some accounts once affiliate themselves with LFP have distanced themselves in favor of promoting political shifts and movements in the United States.

"In addition to utilizing fake American personas that espoused both progressive and conservative political stances, some accounts impersonated real American individuals, including a handful of Republican political candidates that ran for House of Representatives seats in 2018," the researchers say.

See also: Facebook takes down thousands of pages, groups, and accounts in fake news war

Political candidate photos were stolen and, in some cases, tweets were copied from their legitimate Twitter profiles and published on the fake accounts, likely to try and improve their appearance of authenticity.

In one case, Marla Livengood, a candidate for California's 9th Congressional District, was impersonated. The fake account plagiarized tweets from Livengood's true account and also published news relating to "safe" subjects, such as the UK Princess Eugenie's marriage, before pivoting to pro-Iran content.

Some of the accounts have been convincing enough that journalists in the US and Israel have published material created and promoted by them. FireEye says that the topics covered generally align with Iranian political interests -- and should mainstream media ignore particular pro-Iran topics, the accounts were then used to criticize journalists and media outlets.

CNET: Huawei ban: Full timeline on how and why its phones are under fire

Material deemed anti-Saudi, anti-Israel, and pro-Palestinian is also abundant. Many of the accounts tracked by FireEye have published material in support of the Iran nuclear deal, opposition to the Trump Administration in relation to Iran's Islamic Revolutionary Guard Corps (IRGC) being labeled as a terrorist organization, and criticism of US President Trump's decision to veto a Congress decision to withdraw from the current Yemen military conflict.

"We are continuing to investigate this and potentially related activity that may be being conducted by actors in support of Iranian interests," FireEye says. "However, if it is of Iranian origin or supported by Iranian state actors, it would demonstrate that Iranian influence tactics extend well beyond the use of inauthentic news sites and fake social media personas, to also include the impersonation of real individuals on social media and the leveraging of legitimate Western news outlets to disseminate favorable messaging."

Following FireEye's investigation, Facebook said on Tuesday that the social network has now removed 51 Facebook accounts, 36 pages, seven groups, and three Instagram accounts.

TechRepublic: Nessus expands vulnerability scanner offerings to 16 IPs in commercial environments

According to Nathaniel Gleicher, Head of Cybersecurity Policy at Facebook, roughly 21,000 accounts followed one or more of the fake pages; about 1,900 accounts joined the groups, and approximately 2,600 individuals followed one or more of the Instagram accounts in question.

The steady flow of fake news, impersonating on social media, and propaganda has become a constant challenge for social networks. Facebook and Twitter often report their progress when it comes to fake account closures and the bulk deletion of accounts, messages, and groups is a constant theme.

Back in March, Facebook removed over 2,500 fake pages, groups, and accounts which were specifically designed to manipulate legitimate users and to stir up political tension & debate. The schemers were traced back to Iran, Russia, Macedonia, and Kosovo.

Facebook's worst privacy scandals and data disasters

Previous and related coverage

• Facebook kills 650 Russian, Iranian accounts for 'inauthentic behavior'
  
• Research shows sixty-one percent will not engage with Influencer posts that do not feel genuine
  
• Facebook removes disinformation accounts from the UK and Romania
  

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0