San Francisco, Facebook and Twitter have removed hundreds of accounts originating in Iran and Russia that were designed to mislead people across multiple Internet services in the Middle East, Latin America, Britain and the US.
While Facebook has removed 652 pages, groups and accounts for “coordinated inauthentic behaviour” that originated in Iran and Russia, Twitter suspended 284 accounts, many of which originated from Iran.
“We’re still investigating, and we have shared what we know with the US and UK governments. Since there are US sanctions involving Iran, we’ve also briefed the US Treasury and State Departments,” Nathaniel Gleicher, Head of Cybersecurity Policy at Facebook, said in a statement on Tuesday.
“Working with our industry peers today, we have suspended 284 accounts from Twitter for engaging in coordinated manipulation. Based on our existing analysis, it appears many of these accounts originated from Iran,” Twitter said.
These campaigns created networks of accounts to mislead others about who they were and what they were doing, according to Facebook.
Facebook also removed Pages, groups and accounts that can be linked to sources the US government had previously identified as Russian military intelligence services.
“While these are some of the same bad actors we removed for cybersecurity attacks before the 2016 US election, this more recent activity focused on politics in Syria and Ukraine,” Facebook said.
For example, these accounts are associated with Inside Syria Media Centre, which the Atlantic Council and other organisations have identified for covertly spreading pro-Russian and pro-Assad content.
“We’re working closely with US law enforcement on this investigation, and we appreciate their help. These investigations are ongoing – and given the sensitivity we aren’t sharing more information about what we removed,” Facebook added.
Facebook acted on these accounts after FireEye, a global cybersecurity firm, gave it information in July about “Liberty Front Press”, a network of Facebook Pages as well as accounts on other online services.
Based on FireEye’s tip, Facebook started an investigation into “Liberty Front Press” and identified additional accounts and Pages from their network.
“We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins,” Facebook informed.
The first “Liberty Front Press” accounts were created in 2013. Some of these attempted to conceal their location, and primarily posted political content focused on the Middle East, as well as the UK, US and Latin America.
Beginning in 2017, they increased their focus on the UK and US.
Accounts and Pages linked to “Liberty Front Press” typically posed as news and civil society organisations sharing information in multiple countries without revealing their true identity, said Facebook.
Facebook recently deleted 32 Pages and accounts attempting to influence the US mid-term elections.
