IN DEPTH: Iranian Propaganda Network Goes Down

Facebook pages laundered Iranian propaganda in India, Indonesia, and Africa

Facebook took down over 500 pages, groups and accounts on March 26, identifying them as part of a pro-Iranian propaganda network that attacked Israel, the United States, Saudi Arabia, and the Gulf States.

The network operated in multiple languages and targeted multiple regions, including South Asia, East Africa, and West Africa, as well as countries such as Indonesia. In some cases, the network directly reproduced Iranian state messaging, steering social media users towards websites that repurposed content from state outlets and passed it on as their own.

In a blog post, Facebook explained:

“The administrators and account owners represented themselves as locals and made-up media entities, often using fake accounts — and they impersonated real political groups and media organizations. They posted news stories on current events and frequently repurposed and amplified content from Iranian state media about topics including sanctions against Iran; tensions between India and Pakistan; conflicts in Syria and Yemen; terrorism; tensions between Israel and Palestine; Islamic religious issues; Indian politics; and the recent crisis in Venezuela.”

The top takeaways are set out in the DFRLab’s accompanying post. In the interest of transparency and of preserving the activity of this network for future study, this article sets out more evidence to underpin the findings.

An Iranian Laundromat

The network strongly resembled earlier operations linked to a group called IUVM, the International Union for Virtual Media, which has been the subject of investigations and takedowns for inauthentic behavior since August 2018. IUVM launders content from Iranian state outlets such as PressTV, reprinting it without attribution to pass it on to unsuspecting readers. Its exact relation to the Iranian state is unclear.

The revelations began in August 2018, when investigative company FireEye traced a number of apparently independent websites focusing on Western audiences to Iranian email addresses and web providers. The DFRLab exposed IUVM as a key player in the network later the same month. In October, Twitter published over a million tweets from accounts in the network that it had suspended. More on the DFRLab’s analysis of this data can be found here.

Some of the more than 1 million tweets published by the Iranian operation taken down in 2018. (Source: DFRLab, from Twitter data)

Journalists at Reuters exposed still more of the network in November, discovering over 70 websites targeting 15 countries in 16 languages. In January, Facebook took down 783 accounts and pages, which it assessed as “directed from Iran, in some cases repurposing Iranian state media content.”

The network was remarkable for its scale and geographic diversity. The repetition of Iranian state narratives, the location of managers in Iran, and the sheer number of accounts, websites, countries, and languages involved, suggest that this was a state-backed operation, as few private groups would have the resources necessary to run such a large undertaking from Iran.

Worldwide Targets

The pages targeted at least 15 countries. Several dozen pages had already been taken down before the DFRLab began its analysis, so this list should not be considered exhaustive.

Breakdown of pages by country or issue targeted. (Source: @KaranKanishk / DFRLab)

Indonesia appears to have been the most targeted, with 19 different pages focusing on the country or posting in Indonesian. Many were linked by the name “Berita Dunia,” meaning “World News,” and posted links to website beritadunia.net, whose articles featured prominently in the Twitter exposé last October.

Screenshot of the “About” section of the page “Berita Dunia Online,” with Google translation of the mission (inset) advertising the website. (Source: Berita Dunia Online / Google / archive)

Despite the focus, the “Info and Ads” section of the page confirmed that most of its managers were in Iran, rather than Indonesia.

The “Info and Ads” section of the Indonesia-focused page “Berita Dunia Online,” showing the location of managers. (Source: Berita Dunia Onlinearchive)

India was the second most targeted country, with 14 pages refurbishing Iran’s stance on international issues for a local Indian audience. The Indian-focused Facebook page with most followers was “The Leaders News” (@leadernewx), which counted over 180,000 followers.

The homepage of India-focused “The Leaders News,” showing the number of likes and follows on the right. (Source: The Leaders Newsarchive)

The page’s “About” section linked to a website called theleadersnews[.]com, but gave no other affiliation. Its self-description attacked a world run by “one hegemonic superpower and its allies,” and accused “‘liberal’ state power” of “medieval barbarism.”

The Leaders News “About” section. (Source: The Leaders Newsarchive)

All the page’s most recent posts shared articles from the website of the same name, which were routinely anti-U.S., pro-Iranian, anti-Israel, and pro-Hezbollah. This very much reflects Iran’s foreign-policy positions.

Shares by The Leaders News of the website of the same name. (Source: The Leaders Newsarchive)

Its posts were primarily copies, with attribution, of articles from known Iranian laundering sites exposed in the earlier takedowns, including IUVM. Archive versions of the theleadersnews articles lifted directly from IUVM can be seen here, here, and here. Archived versions copied from another suspected Iranian laundromat site, AHTribune, can be seen here, here, and here.

This modus operandi is identical with that of websites in the IUVM network, detailed above.

Despite its following of 180,000, the overall engagement on the page’s posts was low, apart from a spike on September 1, 2017.

Breakdown of leadernewx’s engagement over time. (Source: @KaranKanishk / DFRLab)

A close look at The Leaders News’s page suggests the page was either repurposed, acquired, or hacked, as the page was dedicated to Indian international cricket player Hardik Pandya until September 24, 2017.

History of “The Leaders News,” showing that it was dedicated to Hardik Pandya until September 2017. (Source: The Leaders Newsarchive)

The spike was caused by a single post about Pandya and two new “girl fans.” This post received 132,000 responses.

The best-performing post by The Leaders News. (Source: The Leaders Newsarchive)

A few weeks later, the page started posting domains from the website which shared its name. The graphic below puts domains posted by the page according to timeline:

Breakdown of leadernewx’s domains overtime. (Source: @KaranKanishk / DFRLab)

This suggests that the page was created to build an Indian audience by posting about an Indian cricket star, and then repurposed to pass that audience Iranian messaging. Alternatively, the page may have been hacked or otherwise taken over.

Many pages focused on the conflict in Yemen and the Palestinian situation, both core issues in Iran’s foreign policy. They covered them mainly from the Iranian perspective, demonizing Israel, Saudi Arabia, and the United States.

Examples of content about the situation in Yemen. (Source: Berita Dunia Terdepan/archive, left; Human Rights Agency — ADH/archive, right)
Pro-Palestinian, anti-Israeli content examples. (Source: Everything for you/archive, left; نعم لاغلاق السفارة الاسرائیلیة في مصر/archive, right)

Eight pages focused on Nigeria. For instance, a page called Just for Informing Nigeria was allegedly run by Nigerians, while in fact the location of the page managers was Iran or Sudan.

The “About” and “Info and Ads” section of “Just for Informing Nigeria” page. (Source: Just for Informing Nigeria/archive, left; : Just for Informing Nigeria/archive, right)

Other pages covered the detention of Nigerian Shia leader Ibrahim Zakzaky, but also included political events in Yemen, and the situation of its Shia minority. For instance, the page Free Zakzaky Now shared a post from Facebook user “Ibrahim Ishaq Shia” with images from a demonstration in Nigeria in support of Yemenis who were killed by Saudi Arabia — a core Iranian foreign-policy message.

Screenshot of a post about Nigeria’s Muslims demonstrating support to Yemenis killed by Saudi. (Source: Free Zakzaky Now/archive)

One Facebook page, called “Sunnis Demanding Zakzaky’s Freedom,” specifically emphasized how both, Sunni and Shia, want to free the Shia, Nigerian cleric. The page also claimed in its “About” section: “it is not the matter of Sunnis or Shias! It is the matter of our holy religion, Islam. It is and should be all about Humanity! It is all about Unity.”

The page mostly published content calling for an end to the Shia-Sunni conflict and for the reunion of the main branches of Islam.

Screenshot of the “About” section of “Sunnis Demanding Zakzaky’s Freedom”. (Source: Sunnis Demanding Zakzaky’s Freedom/archive)
Screenshot of one post of “Sunnis Demanding Zakzaky’s Freedom” depicting a family of Sunni and Shia. (Source: Sunnis Demanding Zakzaky’s Freedom/archive)

There was also the page Palasdinu za ta zama “yantacciya, which covered the February 2019 Nigerian presidential election.

A page about Palestine in Hausa posted about Nigeria’s presidential election. (Source: Palasdinu za ta zama “yantacciya/archive)

Iranian Messaging

Systematically, the pages promoted messages that were in line with the Iranian government’s strategic narratives. For example, they routinely attacked Israel, particularly in the context of the Israeli-Palestinian conflict in Gaza.

Examples of anti-Israel messaging. (Source: Mubassir Islamabad/archive, left; Qods International News Agency — Qodsna,com/ archive, right)

They also attacked the United States, both over its foreign policy in general and its decision to relocate its embassy in Israel to Jerusalem in particular.

Examples of anti-U.S. content. (Source: News786 Express/archive, left; Dandalin Muneerat Usman/archive, right)

They also promoted Iran’s role as a regional power and power-broker.

Examples of pro-Iranian content. (Source: Welayat.org/archive, left; The Leader Times/archive, right)

Reproducing State Content

Some of the pages, like the “Berita Dunia” group, pointed to websites that reproduced Iranian state content verbatim.

For example, the page “Qods International News Agency” (named after the Arabic name for Jerusalem, al-Quds or al-Qods, and a term used in earlier Iranian operations, including a Twitter account called @VoiceOfQuds) posted an article on the crash of a U.S. F-35 fighter, linking to an article on the website qodsna.com which was published on September 29, 2018.

Post by “Qods International News Agency” on the F-35 crash. (Source: Qods International News Agencyarchive)

The article was a word-for-word copy of an article which appeared on Iranian regime channel PressTV the day before. The only difference was that the Qods page claimed itself as the author of the piece, by inserting “Qods New Agency (Qodsna)” in the dateline.

Left, story on the crash of an F-35 fighter by the self-styled “Qods News Agency,” whose Facebook page was part of the latest takedown. Right, the PressTV version. Highlighting indicates identical content, with the lede in red and the body of the article in yellow. Literally every word except for the dateline is identical. (Source left: qodsna. Source right: PressTV )

The Leader Times posted a word-for-word copy of an article about a phone call between Russia’s and Iran’s foreign ministers regarding Venezuela from Iran Daily, the official daily newspaper of the government of Iran.

Matching articles from The Leader Times and Iran Daily. (Source: The Leader Times/archive, left; Iran Daily/archive, right)

Iran Daily mentioned that the original source of the publication was IRNA, the official news agency of Iran (see the blue underline above). The Leader Times omitted the attribution, making it look like an original publication.

Two Facebook pages, Sen-Aftruth and Afric-Truth, linked to the news domain Aftruth.com in their about section and shared the same logo as the domain in their profile picture. Sen-Aftruth appeared to mostly share links of French articles from the news outlet Aftruth.com. The posts linking to Aftruth.com as well as the posts on Afric-Truth barely gained any engagement.

The large number of shared articles on Sen-Aftruth linking to the Aftruth.com domain and the clear affiliation of both Facebook pages to the same domain suggest that both pages were used to amplify content on Aftruth.com.

Screenshot of the “About” section of Sen-Truth (left) and Afric-Truth (right), highlighting the logo and referenced link. (Source left: Sen-Truth/archive; right: Afric-Truth/archive)

Aftruth.com verbatim posted articles from iuvmpress.com, without attributing the source. Two examples of these articles focused on Israel and its alleged benefit from the Indian-Pakistani conflict as well as human rights violations in Saudi Arabia. The articles first appeared on iuvmpress.com and then on Aftruth.com.

Screenshot of the iuvmpress.com article on March 7, 2019 (left) and the same Aftruth.com article on March 8, 2019 (right). (Source left: iuvmpress.com/archive; right: Aftruth.com/archive)
Screenshot of the ivumpress.com article on March 15, 2019 (left) and the same Aftruth.com article on March 16, 2019 (right). (Source left: iuvmpress.com/archive; right: Aftruth.com/archive)

Another article focused on the “anti-Iranian summit” held in Poland, further pushing anti-US and anti-Poland messaging due to both countries’ prominent roles at the Middle East conference in Warsaw. One month later, iuvmpress.com changed the title slightly and used a different picture to publish the same article again.

Screenshot of the iuvmpress.com article on January 16, 2019 (left) and the same Aftruth.com article on January 20, 2019 (right). (Source left: iuvmpress.com/archive; Aftruth.com/archive)

This was precisely the behavior of the IUVM-linked websites and social media assets that featured in earlier exposures and takedowns. This behavior reinforces the conclusion that the network in the latest takedown also served to amplify Iranian regime messaging and used social media to drive users toward laundromat websites.

Impact

The impact of the pages varied widely. Some pages had little or no engagement, and no followers at all. At least one page had not even posted prior to the takedown.

Home section for “Help News Line,” created on January 31, 2019. It had not posted at all when it was shut down. (Source: Help News Linearchive)

Others, meanwhile, had tens of thousands of followers. The Facebook page مش عايزنهم (translated from Arabic: “I Do Not Want Them”) garnered up to 97,986 likes and 98,207 followers since it was first created on May 21, 2015.

Screenshot of the “Community” section of “I Do Not Want Them.” (Source: I Do Not Want Them/archive)

An analysis of the “Info and Ads” section of the page revealed that the primary locations of people who managed the page included Iran (six people), Egypt (three people), Sudan (one person), and Syria (one person).

Screenshot of the “People Who Manage This Page” section revealing the primary country locations of the page managers. (Source: I Do Not Want Them/archive)( Source: I Do Not Want Them/archive)

The content on the page was mostly centered around anti-American, anti-Israel, and anti-Saudi messaging. One video published on the page derided a U.S. soldier and showed the logo of “In the Now,” a social media outlet owned by Kremlin-controlled media outlet RT. Open-source investigation could not confirm the origin of the video. Other videos focused on an incident in which an Israeli policeman allegedly disrespect a mosque, and another in which the U.S. Secretary of State allegedly acknowledged a purported partnership between Saudi Arabia and Israel.

Screenshot of one post of “I Do Not Want Them” denouncing the Israel-U.S.-Saudi Arabia relationship. (Source: I Do Not Want Them/archive)

The posts of the page gained very little engagement, as illustrated by the likes, shares, and video views of the examples below.

Screenshot of one post of “I Do Not Want Them.” (Source: I Do Not Want Them/archive)
Screenshot of one post of “I Do Not Want Them”. (Source: I Do Not Want Them/archive)

Overall, the operation does not appear to have had a systematically high impact.

Conclusions

The operation strongly resembled the earlier IUVM operation. Facebook did not attribute it to IUVM directly, but the latest network used the same techniques and pointed to some of the same websites, making attribution to the same network likely, although not confirmed.

In particular, pages across the network reproduced IUVM content, as well as content from other websites which have featured in earlier exposés and takedowns.

The network functioned by steering users towards ostensibly independent news websites, which amplified Iranian regime propaganda, often copied verbatim from regime assets. The social media content therefore served as a secondary amplifier, rather than a direct audience-engagement tool.

Despite the heterogeneous nature of the assets — they were spread across many countries, languages, and cultures — their messaging was largely homogeneous. It dealt with issues of importance to the Iranian government, supporting Palestinians and Shia Muslims on one hand, and attacking Israel, the United States, Saudi Arabia, and the conduct of the military campaign in Yemen on the other.

The focus on South Asia was noteworthy. Indonesia and India had the most pages targeted at them; African countries also featured prominently. This expands the known area of Iranian influence operations, which have thus far been primarily exposed in the Middle East and in the West.

The apparent impact of the operation was mixed at best, and often modest. Some pages had high follower counts but scored little engagement; others had few or no followers. While follower count cannot directly be used to measure the effect of the campaign overall, it does suggest that, on Facebook itself, the impact was limited.

Given the scale of the operation and the number of websites behind it, this is likely to be an ongoing story. The DFRLab will continue to track Iranian efforts.


Ben Nimmo is Senior Fellow for information Defense at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).

Nika Aleksejeva is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (DFRLab)

Kanishk Karan is a Digital Forensic Research Assistant at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).

Daniel Weimert is a Mercator Fellow currently assigned to the Atlantic Council’s Digital Forensic Research Lab (DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.