#TrollTracker: Iran’s Suspected Information Operation

Assessing the main pages and accounts traced to Tehran by FireEye

@DFRLab
@DFRLab
Aug 27, 2018 · 14 min read
Flowchart of the suspected Iranian online assets identified by FireEye. (Source: FireEye)

A network of websites and social media pages which have been traced to Iran posted pro-Tehran articles mixed in with content taken from bona fide websites, and shared content attacking Saudi Arabia and U.S. President Donald Trump, according to the traces the operation left online.

The revelations by data analysis team FireEye, and by Facebook, expose what appears to have been a foreign-operated influence campaign which masqueraded as genuine websites and users. They underline the growing danger of such influence operations, which are clearly not limited to one country or one target.

This post analyzes the two websites with the most direct links to Iran.

What Was Exposed

Based on FireEye’s findings, Facebook took down over 600 accounts and pages associated with the operation. Twitter also suspended a number of accounts.

Diagram of the suspected influence network, naming the main accounts. (Source: FireEye)

The Websites

FireEye attributed the sites to Iran based on a triangulation of factors. None would be conclusive in itself, but the three points reinforce the conclusion.

  • Website registrant emails associated with Iranian locations and services;
  • Twitter accounts associated with the websites, but registered using Iranian telephone numbers;
  • Apparently pro-Iranian content.
Homepage of LibertyFrontPress.com. (Source: libertyfrontpress.com)

The Twitter accounts have been suspended. Recent WhoIs searches of the sites only revealed a U.S. registrar. The content of the websites therefore presents the most enduring evidence set.

The first core website identified by FireEye was institutomanquehue.org, self-described as a “civic organization which pursues the development of strategic visions on the main themes related to Latin America directed at the region’s inhabitants, as well as reflecting an accurate vision of the region to the world.”

The site’s English-language page was last updated in May 2017; the Spanish-language version was still operational in August 2018. All references in this analysis are to the Spanish version, unless otherwise stated.

Homepage of institutomanquehue.org as of August 22, 2018. (Source: institutomanquehue.org)

Its geopolitical view was polemic:

“The voices of the people of Latin America have often been hijacked by foreign influences from the West and East, taking away their space in the administration of their own countries, as well as their participation in international decisions.”

It produced a considerable volume of content, sometimes posting half a dozen new stories a day. The great majority of this content was not original, but taken, without attribution, from Iran’s state-run Spanish-language television station, HispanTV.

For example, an article published by institutomanquehue.org on August 16, reporting an attack by Bolivian President Evo Morales on the visit of U.S. Defense Secretary James Mattis to the region was taken verbatim from a HispanTV article of August 14, without attribution.

Left: The HispanTV original. Right: The institutomanquehue.org pickup. (Source: hispantv.com / institutomanquehue.org)

The institutomanquehue.org article attributed it to an author called “mas pourk,” whose tag on the website provided no information. This appears to have been an attempt to launder an article from a declared Iranian state TV channel through an undeclared Iran-linked site.

The author page for “mas pourk.” (Source: institutomanquehue.org)

Another article published under the “mas pourk” byline also matched a HispanTV article verbatim; this time, the two versions were published on the same day, August 16. The article concerned a reported threat from a “terrorist” leader in Idlib province against Russia in Syria.

Left, the HispanTV article. Right, the institutomanquehue.org version. (Source: hispantv.com / institutomanquehue.org)

Yet a third article also matched word for word a HispanTV article published the same day. This time, the content concerned a speech by Ayatollah Khamenei, Iran’s supreme leader, attacking the U.S.

Left: The HispanTV article. Right: The institutomanquehue.org version. (Source: hispantv.com / institutomanquehue.org)

Not all articles plagiarized HispanTV. One post on the “Zionist reconquest of Patagonia,” published in June 2018, was copied from an article on conspiracy site Voltairenet dated December 12, 2017, but with a much more polemic headline than the original, which asked what Israel was planning in Argentina.

Left: The Voltairenet text. Right: The institutomanquehue.org version. Colored boxes show identical text. (Source: voltairenet.org / institutomanquehue.org)

Some content appeared to have been authored specifically for the website; as with libertyfrontpress.org, which focused on Iranian official positions, such as attacks on Saudi Arabia.

The top story on the site as of August 23, for example, headlined Saudi Arabia “extending the ideology of terror with the support of the United Kingdom.” It quoted an interview conducted by Iranian state outlet PressTV, without mentioning its affiliation.

Headline and opening paragraphs of the article; note the reference to “an interview conducted last month by news channel PressTV” at the bottom of the image. (Source: institutomanquehue.org)

Google searches for the exact phrasing used in the top two paragraphs only returned hits from institutomanquehue.org, indicating that this was original language.

Results of Google searches for top lines in the article. (Source: Google)

However, even here, wording from further down the article was identical with what appeared to be stock HispanTV language describing Saudi relations with Israel.

Top to bottom: Wording on Saudi-Israel relations from HispanTV in January 2018, HispanTV in July 2018, and institutomanquehue.org in August 2018. The only difference between the two HispanTV versions is the substitution of the word “relaciones” (relations) for “nexos” (ties). The second HispanTV version and the institutomanquehue.org version are identica. (Source: hispantv.com / hispantv.com / institutomanquehue.org)

Overall, institutomanquehue.org’s Spanish output appears to have been a thinly-veiled attempt to amplify Iranian government messaging in Latin America, primarily by copying HispanTV content without attribution.

The English-language output, by contrast, appeared to be largely original. It was often written in non-native English, and focused on issues from the Iranian state point of view.

As of August 23, 2018, three of its four top posts concerned a profile of a Bahraini ayatollah; a hostile view of Saudi influence in Bahrain (“Abduction, torture, and murdering more than 40 citizens during the military intervention was the heir of Saudis for Bahrain”); and an interview which claimed that “Iran’s democratic system is far more fair-minded to their voters than the American system.”

Headline of the exclusive interview. (Source: en.institutomanquehue.org)

Instituto Manquehue claimed the latter interview as an exclusive, although it did not name the interviewer. A Google search for key sentences did not return earlier uses of the language, supporting the claim.

The interviewee was identified as Robert Carter, a “London-based commentator.” Appended to the interview was a fact box stating that he worked for Shia TV outlet Ahlulbayt TV, but also contributed to Iranian state broadcaster Press TV and pro-Kremlin conspiracy site Veterans Today.

Fact box from the interview. (Source: en.institutomanquehue.org)

The questions ranged from anodyne to pro-Iranian:

Mr. Carter, what’s your take on the recent presidential election in Iran and its effect on the region?

When campaigning, all of the candidates — especially Rouhani — suggested that they will remain committed to the nuclear agreement. What will happen if the other sides, especially the US, violate the deal?

Compared to other countries in the Middle East, how is the establishment of democracy and free speech in Iran?

How would you predict the US-Iran relations in the coming years?

The answers were anti-American, pro-Iranian, or both.

Iran has proven, to itself and the world, that diplomacy and economic expansion are what gives a country real power.

Iran is, without a doubt, one of the most democratic countries in the Middle East at the moment.

America is clearly putting together an anti-Iran coalition disguised as an ‘anti-terrorism’ effort.

The relationship between the US & Iran is likely to remain strained as the US seems incapable of anything else but to continue its campaign of provocation. Thankfully Iran has re-elected a candidate who has proven he can handle hostile political situations with patience and calm, a skill which will become incredibly important in the foreseeable future.

Of the eight latest stories featured on the homepage, only one had a vaguely Latin American theme — footballer Lionel Messi. Far more concerned Middle Eastern geopolitics, criticizing the U.S. and Saudi Arabia.

(Source: en.institutomanquehue.org)

While the Institute’s English page contained more original content than the Spanish one, it was equally aligned with Iranian foreign policy.

The other core website identified by FireEye was libertyfrontpress.com, self-described as an “independent media organization” offering news “without any distortions, made by the mainstream media in favor of their contributors, in support of the oppressed and the downtrodden.”

Diagnostically, it also wrote that it aimed “to inspire action on the likes of social justice, civil liberties and human rights.”

The About page, with the relevant text highlighted. (Source: libertyfrontpress.com)

As of August 22, the libertyfrontpress.com homepage featured a range of reporting on United States, United Kingdom, and international politics, largely from a left-leaning or liberal point of view.

Again, the great majority of its content was copied verbatim from other sources; however, these were drawn from more sources than in the case of institutomanquehue.org. For example, the top story as of August 22, a profile of Colombian politician Ivan Duque, reproduced a Newsweek article; the article featured the Newsweek logo, and a link to the original.

Left: The post on LibertyFrontPress, June 18, 2018, archived on August 22, 2018. Right: The original story, June 17, 2018. (Source: libertyfrontpress.com / Newsweek)

Other top stories were taken verbatim from the Guardian (on British Labor leader Jeremy Corbyn), The Hill (on Trump’s lawyer Rudy Giuliani), and Al Jazeera (on migrant rescue ship Aquarius).

One piece was copied from the Independent, in the UK, and criticized British government support for Israel.

Left: The article on LibertyFrontPress.com, June 18, 2018, archived on August 22, 2018. Right: The original in the Independent, June 18, 2018. (Source: libertyfrontpress.com / Independent)

It is questionable whether this constitutes plagiarism, since the original source and link were prominently displayed; it may constitute copyright violation, if libertyfrontpress.com did not have a syndication agreement with the publications it copied.

It did give the site an easy way of stocking itself with legitimate, well-written and largely left-leaning content.

Other content was drawn from much more contentious sources. An extremely hostile article accusing Israel’s Prime Minister Benjamin Netanyahu of disinformation was taken word for word from Canadian-based site globalresearch.ca, a known hub of false stories.

Left: The article on libertyfrontpress.com, May 8, 2018. Right: The original on globalresearch.ca, May 1, 2018. Both archived on August 22, 2018. (Source: libertyfrontpress.com / globalresearch.ca)

Another post, dated June 17, gave a partial transcript of an interview between Syrian President Bashar al-Assad and Iran’s state-owned Arabic-language channel, al-Alam TV. This post appeared to be original content; it resembled a full transcript provided by Syrian pro-regime outlet al-Masdar on June 13, but differed in the detail.

Above: The al-Masdar transcript. Below: The libertyfrontpress.com version. These are evidently two different translations of a common source. Archived on August 22, 2018. (Source: almasdarnews.com / libertyfrontpress.com)

The libertyfrontpress.com version was shorter (under 2,000 words, against more than 5,000). Its headline differed from that of al-Masdar, placing the emphasis on Syria’s relationship with Iran, and Assad’s intention of visiting Tehran.

Left, the al-Masdar headline. Right, the libertyfrontpress.com version. Archived on August 22, 2018. (Source: almasdarnews.com / libertyfrontpress.com)

The content selected by libertyfrontpress.com focused on those parts of the interview which dealt with Iran, and especially the comparison with Russia.

Excerpt from the libertyfrontpress.com version of the interview, showing the focus on content dealing with Iran. (Source: libertyfrontpress.com)

The fact that one of the few original articles on the site took an interview by an Iranian state outlet, and condensed it to focus on comments about Syria’s relationship with Iran, betrays a clear interest in, and bias in favor of, Iran.

Another apparently original article reported that Iran’s regional rival Saudi Arabia had been defeated in an assault on the port city of Hodeidah, Yemen on June 14, 2018.

Article by libertyfrontpress on June 14, 2018; note the barely comprehensible use of language. Archived on August 22, 2018. (Source: libertyfrontpress.com)

This was written in barely comprehensible English, and may have been machine translated, as in this sentence:

A mission on the implementation of the Saudi-led by the destruction of a coalition frigate, under the auspices of the Saudi naval gunfire, intends to deploy forces on the Al-Hodeidah coast, as well as the capture of hundreds of them at the least heavy defenses, was a serious failure.

The post maximized its rhetoric, while minimizing linguistic and editorial competence.

Meanwhile, another Ansarullah commander insists that the Saudi coalition used anything they had on the attack , there was nothing they did not fly or did not have on the battlefield, but, the Saudi coalition only They have won the battle on TV screens and virtual networks, but in real battle, they have merely defeated.

In fact, according to mainstream media, the Saudi-led assault continued, and captured Hodeidah airport two days later.

This article read like war propaganda, rather than a credible piece of journalism. A Google search for specific sentences from the article did not turn up other instances of their use online, confirming that it was original content.

Again, this fits with the perception of the site as an anti-Saudi outlet, in line with Iran’s known foreign policy.

The Social Media Feeds

The Instituto Manquehue feed, @insmanquehue, blended anti-American, anti-Israeli and anti-Saudi content with Latin American coverage.

Tweets by @InsManquehue, on (clockwise from top left): Israeli torture of Palestinian children; Saudi Arabia using banned weapons in Yemen; Israel and the U.S. creating a unit to “generate chaos” in Iran; Saudi Arabia “massacring” children; Trump planning an invasion of Venezuela; and America “persecuting” the center-left. (Source: Google cache)

The main Facebook page, @InsManquehue, according to residual Google results, also shared assorted anti-Israel, anti-Saudi and anti-U.S. content.

Instituto Manquehue Facebook traces, showing a “tsunami of cholera” in Yemen, Israeli soldiers’ violence, images from Gaza and claims of Israel “colonizing territories in Africa and Latina America.” (Source: Google)

The Instagram account with the same handle largely posted content on Latin American issues, according to a Google cache of online service Picbear dated to August 21, 2018. Most of the posts pointed to institutomanquehue.org, but copied their language verbatim from HispanTV.

Comparison of @InsManquehue Instagram posts, left, and HispanTV articles, right. (Source: Google cache / HispanTV / HispanTV)

A few posts showed geopolitical interest; one recorded the visit of the Mayor of Jerusalem to Latin America, with a #racist hashtag added, while another focused on Chinese military exercises aimed at striking U.S. targets. Both articles were taken from HispanTV (here and here).

Instagram posts by @insmanquehue. (Source : Google cache)

Their impact was small. The Twitter account only had 2,881 followers, despite having posted almost 12,000 times since it was created in September 2014.

The institute’s Twitter profile. (Source: Google cache)

The Instagram page counted 9,000 followers, but followed 7,000 accounts itself, suggesting a followback system rather than organic interest.

Follower stats for @InsManquehue on Instagram. (Source: Google cache)

The institute also had backup Facebook and Instagram accounts under the handle @institutomanquehue. Neither had meaningful impact, with only a handful of followers and likes.

Google results for @institutomanquehue, showing the impact on Instagram and Facebook. (Source: Google)

libertyfrontpress.com also had an array of social media feeds. The Twitter feed was captured by Google’s cache. Some of its posts focused on Gaza, Venezuela, Yemen, and an Iranian missile test — foreign-policy priorities for Iran. One post called for the Mujahedeen Khalk group, an opponent of the Iranian regime, to be banned, using the hashtag #BanTerrorOrg.

Cached post by @libertyfrontpr. (Source: Google cache)

Far more, however, attacked U.S. President Donald Trump, not only over his handling of relations with Iran, but more generally. These largely shared memes from other anti-Trump accounts.

Left: Posts by @libertyfrontpr, captured by Google cache. Right: Original versions. (Source: Google cache / Twitter / @NWPinPDX / @StopTrump2020)

The Twitter bio read:

“As an independent news media organization we aim to inspire action on the likes of social justice & human rights & advocate transparency in politics.”

This is too close to the language used on the website’s “About” page to be a coincidence.

According to FireEye’s report (page 12), @LibertyFrontPr changed its name to @berniecratss in July 2018, and began targeting supporters of progressive U.S. politician Bernie Sanders. According to Google’s cache, it had the same biography, and was created in the same minute, confirming the identification.

Left: Bio for @libertyfrontpr. Right: Bio for @berniecratss. (Source: Google cache)

The renamed account posted a large volume of anti-Trump comment, together with more occasional posts espousing Iran’s foreign-policy views.

Tweets by @berniecratss on Trump. (Source: Twitter / Google cache)
Tweets by @berniecratss on Iran and Israel. (Source: Twitter / Google cache)

This largely appears to have been an attempt at infiltrating the pro-Sanders community in order to insert specific messages tailored to Iran’s foreign policy. On at least one occasion, the feed promoted a street protest, in an echo of Russia’s interference operations in the U.S.

@berniecratss’ protest tweet. (Source: Twitter / Google cache)

Both handles also had Facebook equivalents, but neither performed well, according to Google searches for their handles.

Google search results for the two handles on Facebook. Note that Berniecratss had only one like. (Source: Google)

On Instagram, a number of posts by @berniecratss have been preserved by the Google cache of Picbear. They show an account which was routinely anti-Trump and left-leaning, but which occasionally posted geopolitical content reflecting Iran’s stance on the Middle East.

Posts by @berniecratss on Instagram. (Source: Picbear / Google cache)

Picbear also saved posts from @liberty_front_press and @libertyfrontpress. Those which were saved focused exclusively on U.S. politics and attacks on Trump — including, ironically, on the issue of Russia’s interference in the U.S.

Posts by @liberty_front_press on Instagram. (Source: Picbear / Google cache)
Posts by @libertyfrontpress on Instagram. (Source: Picbear / Google cache)

These were not as overtly aligned with Iran’s interests. However, their bios were word for word the same as the Twitter accounts and webpage, confirming their connection.

Bio pages for the three Instagram accounts. (Source: Picbear / Google cache)

Conclusions

The associated social media feeds, linked by identical biographies, performed in a very similar way. Their content was seldom as overtly pro-Iranian as the websites’, and appeared aimed more at building an audience in the target communities.

Those communities were largely anti-establishment and left-leaning protest groups in the United States and United Kingdom.

The operation’s exposure, through the use of Iran-based telephone numbers and email addresses, suggests that it was run amateurishly, much as the original Russian troll operation was. Its goal appears to have been to insert pro-Iran messaging into potentially receptive audiences.

Few of its posts achieved notable impact, but it remained in operation for a considerable period.

It is perhaps most striking as the first full-scale troll operation run by a country other than Russia to have targeted Western protest groups. Some of its tactics appeared borrowed from Russia; others appear home-grown.

It underscores the ongoing danger which Western democracies face from disinformation actors who use the anonymity of the internet, and the anger of Western communities, to pass their own messages into the debate.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

@DFRLab is a non-partisan team dedicated to exposing disinformation in all its forms. Follow along for more from the #DigitalSherlocks.


This post was updated on August 27 to clarify the identification of the @LibertyFrontPr and @Berniecratss accounts, and correct the translation of the phrase “tsunami del cólera” in the caption to the image of Instituto Manquehue’s Facebook videos.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade