An apparent Iranian influence operation targeting Internet users worldwide is significantly bigger than previously identified, encompassing a sprawling network of anonymous websites and social media accounts in 11 different languages.
Facebook and other companies said last week that multiple social media accounts and websites were part of an Iranian project to covertly influence public opinion in other countries. A Reuters analysis has identified 10 more sites and dozens of social media accounts across Facebook, Instagram, Twitter and YouTube.
US-based cybersecurity firm FireEye and Israeli firm ClearSky reviewed the findings and said technical indicators showed the web of newly identified sites and social media accounts – called the International Union of Virtual Media, or IUVM – was part of the same campaign, parts of which were taken down last week by Facebook, Twitter and Alphabet.
IUVM pushes content from Iranian state media and other outlets aligned with the government in Tehran across the Internet, often obscuring the original source of the information such as Iran's PressTV, FARS news agency and Al-Manar TV, run by the Iran-backed Shiite Muslim group Hezbollah.
PressTV, FARS, Al-Manar TV and representatives for the Iranian government did not respond to requests for comment. The Iranian Mission to the United Nations last week dismissed accusations of an Iranian influence campaign as "ridiculous."
The extended network of disinformation highlights how multiple state-affiliated groups are exploiting social media to manipulate users and further geopolitical agendas, and how difficult it is for tech companies to guard against political interference on their platforms.
In July, a US grand jury indicted 12 Russians whom prosecutors said were intelligence officers, on charges of hacking political groups in the 2016 US presidential election. US officials have said Russia, which has denied the allegations, could also attempt to disrupt congressional elections in November.
Ben Nimmo, a senior fellow at the Atlantic Council's Digital Forensic Research Lab who has previously analyzed disinformation campaigns for Facebook, said the IUVM network displays the extent and scale of the Iranian operation.
"It's a large-scale amplifier for Iranian state messaging," Nimmo said. "This shows how easy it is to run an influence operation online, even when the level of skill is low. The Iranian operation relied on quantity, not quality, but it stayed undetected for years."
App store and satirical cartoons
Facebook spokesman Jay Nancarrow said the company is still investigating accounts and pages linked to Iran and had taken more down on Tuesday.
"This is an ongoing investigation and we will continue to find out more," he said. "We're also glad to see that the information we and others shared last week has prompted additional attention on this kind of inauthentic behavior."
Twitter said the company had removed a further 486 accounts for violating its terms of use since last week, bringing the total number of suspended accounts to 770.
"Fewer than 100 of the 770 suspended accounts claimed to be located in the US and many of these were sharing divisive social commentary," Twitter said.
Google declined to comment but took down the IUVM TV YouTube account. A message on the page on Tuesday said the account had been "terminated for a violation of YouTube's Terms of Service."
IUVM did not respond to multiple emails or social media messages requesting comment.
The organization does not conceal its aims, however. Documents on the main IUVM website says its headquarters are in Tehran and its objectives include "confronting with remarkable arrogance Western governments and Zionism front activities."
IUVM uses its network of websites, including a YouTube channel, breaking news service, mobile phone app store, and a hub for satirical cartoons mocking Israel and Iran's regional rival Saudi Arabia, to distribute content taken from Iranian state media and other outlets which support Tehran's position on geopolitical issues.
The IUVM network operates in English, French, Arabic, Farsi, Urdu, Pashto, Russian, Hindi, Azerbaijani, Turkish and Spanish.
Much of the content is then reproduced by a range of alternative media sites, including some of those identified by FireEye last week as being run by Iran while purporting to be domestic American or British news outlets.
FireEye analyst Lee Foster said iuvmpress.com, one of the biggest IUVM websites, was registered in January 2015 with the same email address used to register two sites already identified as being run by Iran. ClearSky said multiple IUVM sites were hosted on the same server as another website used in the Iranian operation.
