Facebook takes down Iranian assets, some targeting Latin American audiences

Iran-based assets targeted audiences in Latin America and the United States with pro-Iranian messaging

@DFRLab
@DFRLab
Oct 24 · 7 min read
(Source: @estebanpdl/DFRLab)

As a part of a larger takedown, Facebook took down 131 accounts, 23 pages, four groups, and 14 Instagram accounts on October 21, 2019, identifying them as part of an operation that originated in Iran and focused on audiences throughout Latin America and the United States.

These online assets engaged in “coordinated inauthentic behavior,” Facebook’s term for when groups, pages, and accounts work together to mislead people about who they are and what they are doing on the platform. The DFRLab had access to seven pages prior to their removal, five of which had content beyond selfies and other apolitical posts.

In its blog post, Facebook explained about the subset of the assets targeting Latin America:

The Page administrators and account owners typically represented themselves as locals, used fake accounts to post in Groups and manage Pages posing as news organizations, as well as directed traffic to off-platform domains. They frequently repurposed Iranian state media stories on topics like Hezbollah, conflict between Iran and Saudi Arabia, tensions between Israel and Palestine and Iran and the US, war in Yemen, as well as posted content tailored for a particular country including domestic news, geopolitics and public figures.

In particular, these assets targeted audiences in Venezuela, Brazil, Argentina, Bolivia, Peru, Ecuador, and Mexico with messaging critical of the United States, Saudi Arabia, and Israel, as well as with a smaller number of posts on domestic politics in Latin America. The range of topics discussed included Saudi Arabia’s attacks against Yemen, U.S. sanctions on Venezuela and Iran, Israeli policies toward Palestine, spy drones, and information compiled during the October 2019 protests in Ecuador.

Also included in the pages the DFRLab had access to was one seemingly promoting the Black Lives Matter movement (“BLMNews”) in the United States.

In total, the five analyzed pages had 14,605 followers and 13,943 likes. A page called Elintelecto (“The intellect”), allegedly based in Lima, Peru, accounted for 82 percent of those followers.

Distribution of followers per page. Elintelecto reached 11,922 followers and 11,311 likes. (Source: @estebanpdl/DFRLab)

Iran-based assets

The Page Transparency sections of the four pages with manager locations listed. (Source: Facebook)

All four of these pages each had at least one page manager in Iran. Elintelecto had an additional five managers in Peru, and the page Israel Deceits and Lies included a “Not available” description for one of the managers’ locations.

U.S. sanctions on Venezuela and Iran

4Febrero, a pro-Venezuelan government page with a profile picture featuring late President Hugo Chávez, focused on the sanctions against Venezuela, suggesting that the country had lost millions of dollars after U.S. President Donald Trump’s economic embargo. Some of the content on the page also suggested that the sanctions have resulted in a medicine shortage amid the humanitarian crisis in Venezuela.

4Febrero also shared posts that included hashtags such as #NoMoreTrump and #VenezuelaHeroica (Heroic Venezuela), as well as a narrative written, originally in Spanish, about Russian solidarity with the Venezuelan people after the sanctions were instituted: “The Russian Federation has shown its reliable, visible, and notorious solidarity with the Venezuelan case, which is perversely attacked by the North American empire, trying to impose blocks, purported sanctions.”

Altogether, 4Febrero’s posts on U.S. sanctions, published from August 13 to September 2, 2019, reached a paltry 37 reactions and 135 shares in total.

Posts by the 4Febrero page on U.S. sanctions on Venezuela. The posts were created between August 13 and September 2, 2019. (Source: Facebook)

The page Elintelecto also posted on the sanctions. One of the posts included an article about U.S. sanctions on 10 shipping companies carrying food to Venezuela.

The Elintelecto page shared an article with the following headline: “U.S. sanctioned 10 out of 12 shipping companies carrying food to Venezuela.” (Source: Facebook)

The same narrative about sanctions appeared on the page BLMNews, which shared an online article published on its external website, BLMNews.com, titled “U.S. Imposed New Sanctions on Iran’s Shipping Network.”

Link to article on BLMNews.com titled, “U.S. Imposed Sanctions on Iran’s Shipping Network.” (Source: Facebook)

The BLMNews page was particularly noteworthy, as it targeted an audience interested in a specific social movement largely unique to the United States: Black Lives Matter. In doing so, it employed a tactic reminiscent of the Russian Internet Research Agency’s during the 2016 election.

BLMNews routinely shared content from an eponymous website, which claimed to be a “Source of African-American News all around the world.” The page, however, shared content from the website on a range of political topics with a particular focus on the Middle East, including Hezbollah and the Israel-Palestine conflict; the BDS (Boycott, Divestment, Sanctions) movement, whose self-described mission is “seeking to end international support for Israel’s oppression of Palestinians;” and the Saudi-led intervention in Yemen.

BLMNews topics posted on Facebook. (Source: Facebook)

According to DNS historical data, BLMNews.com dates back to 2008, when the Iranian company Mizban Web Paytakht Co, Ltd., hosted BLMNews.com on two separate occasions.

Screenshot show historical DNS A (address) records for BLMNews.com website. This type of record shows the IP address of a domain. (Source: @estebanpdl/DFRLab via SecurityTrails)

Mizban Web Paytakht company appeared also in 2016 under NS (name server) records. This type of DNS stores the name of a domain’s server.

Historical DNS NS (name server) records for BLMNews.com. (Source: @estebanpdl/DFRLab via SecurityTrails)

Using IP address location, the DFRLab found that Mizban Web Paytakht, a host provider company, is based in Tehran, Iran.

The IP location of Mizban Web Paytakht, an Iranian host provider based in Tehran. (Source: @estebanpdl/DFRLab via SecurityTrails, left; ip2location, right)

Narratives against Israel and Saudi Arabia

Israel Deceits and Lies posts targeted Israel, the United States, and Saudi Arabia. (Source: Facebook)

The page Campaña contra bloqueo a Hispantv (“HispanTV Anti-Block Campaign”), a likely reference to an earlier Facebook take down in August 2018, also included narratives against Israel, focusing on the country’s largest demolition project yet of Palestinian houses. Another post criticized Netanyahu’s comments thanking Trump for designating Iran’s Islamic Revolutionary Guard Corps (IRGC) as a foreign terrorist organization and for placing wide-ranging economic and travel sanctions on the IRGC, organizations, and companies linked to it as a consequence of the designation.

Campaña contra bloqueo a Hispantv posted content targeting Israel and the United States’s support for Israel. (Source: Facebook)

HispanTV is Iran’s state-run Spanish-language television channel and features content on Latin America on its eponymous website, but the posts on Facebook mainly concerned Iran, Palestine and Israel, and U.S. involvement in the region. Some of the posts highlighted Iran’s strategies to increase uranium if the P5+1 (the UN Security Council members plus Germany) violates the nuclear agreement.

This post reads: “Iran will enrich uranium to the required level: Congratulations GREAT IRAN.” (Source: Facebook)

Ecuadorian protests

Posts related to the protests in Ecuador. (Source: Facebook)

Conclusion

The localized content from these Facebook pages discussed Latin American political topics, such as the protests in Ecuador, the Venezuelan government’s approach to the immigration crisis along the Colombian border, President Maduro’s approach to the 2020 legislative elections in Venezuela, and the primary elections in Argentina that took place on August 11, 2019.


Esteban Ponce de León is Research Assistant, Latin America, with the Digital Forensic Research Lab and is based in Colombia.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade