Facebook, Twitter and Alphabet have collectively removed hundreds of accounts tied to Russian and Iranian users that cybersecurity firm FireEye said were promoting Russia's and Iran's geopolitical agendas around the world.
Some of the Twitter and Facebook accounts were designed to appear as if they belonged to real people in the United States, Britain and Canada, according to FireEye. The accounts used various hashtags to engage in U.S. culture, including "lockhimup," "impeachtrump" and "notmypresident."
Twitter called the effort "coordinated manipulation" and said it had removed 284 accounts.
Facebook said it had removed 652 pages, groups, and accounts linked to Russia and Iran, citing "coordinated inauthentic behavior."
Hundreds of thousands of people followed Facebook pages implicated in the campaign.
The move was the result of four investigations – three involving Iran and one involving Russia – FireEye said.
Facebook said the accounts spent about $12,000 in various currencies to advertise through Facebook and Instagram. The social media giant said it had notified the U.S. Treasury and State departments of the purchases, which may violate sanctions.
U.S. conglomerate Alphabet, which includes Google and YouTube, was unavailable for comment.
According to FireEye, the Iranian-linked campaign used a network of fake news websites and fraudulent social media personas across Facebook, Instagram, Twitter, Google Plus and YouTube to push narratives in line with Iranian interests.
The campaign was aimed at users in the United States, the U.K., Latin America and the Middle East.
Iranian activity included "anti-Saudi, anti-Israeli, and pro-Palestinian themes," and advocacy of policies favorable to Iran such as the 2015 Iran nuclear deal, FireEye said.
The Iranian Mission to the United Nations was unavailable for comment.
Russia has been linked to similar online influence campaigns, including an effort to sow political divisions among U.S. voters.
But FireEye said its findings showed that the same tactics are now being used for different aims.
The finding comes as concerns are rising about foreign attempts to disrupt the U.S. midterm elections in November.
Microsoft on Monday said that hackers linked to the Russian government sought to steal email login credentials from U.S. politicians and think tanks.
Facebook has significantly stepped up policing of its platform since last year, when it acknowledged that Russian agents successfully ran political influence operations on the social media platform aimed at swaying the 2016 presidential election.
The social network said it had not concluded its review of the material and declined to say how or why state-backed actors were behaving the way they did.
"There's a lot we don't know yet. We're working closely with U.S. law enforcement on this investigation," Facebook CEO Mark Zuckerberg said.
FireEye said the Iranian activity did not appear to be "dedicated" to influencing the upcoming U.S. midterm elections, though some of the posts aimed at American users did adopt "left-leaning identities" and took stances against President Donald Trump.
That activity "could suggest a more active attempt to influence domestic U.S. political discourse is forthcoming. We just haven't seen that yet," said Lee Foster, an information operations analyst with FireEye.
The firm said U.S.-focused activity ramped up last year, after Trump took office, with websites and social media accounts posting memes and articles, some apparently copied from legitimate U.S. and Iranian news outlets.
Arabic-language, Middle East-focused websites appear to be part of the same campaign, the company said.
