Facebook took down over 500 pages, groups and accounts on March 26, identifying them as part of a pro-Iranian propaganda network that attacked Israel, the United States, Saudi Arabia, and the Gulf States.

The network operated in multiple languages and targeted multiple regions, including South Asia, East Africa, and West Africa, as well as countries such as Indonesia. In some cases, the network directly reproduced Iranian state messaging, steering social media users towards websites that repurposed content from state outlets and passed it on as their own.

In a blog post, Facebook explained:

The top takeaways are set out in the DFRLab’s accompanying post. In the interest of transparency and of preserving the activity of this network for future study, this article sets out more evidence to underpin the findings.

The network strongly resembled earlier operations linked to a group called IUVM, the International Union for Virtual Media, which has been the subject of investigations and takedowns for inauthentic behavior since August 2018. IUVM launders content from Iranian state outlets such as PressTV, reprinting it without attribution to pass it on to unsuspecting readers. Its exact relation to the Iranian state is unclear.

The revelations began in August 2018, when investigative company FireEye traced a number of apparently independent websites focusing on Western audiences to Iranian email addresses and web providers. The DFRLab exposed IUVM as a key player in the network later the same month. In October, Twitter published over a million tweets from accounts in the network that it had suspended. More on the DFRLab’s analysis of this data can be found here.

Journalists at Reuters exposed still more of the network in November, discovering over 70 websites targeting 15 countries in 16 languages. In January, Facebook took down 783 accounts and pages, which it assessed as “directed from Iran, in some cases repurposing Iranian state media content.”

The network was remarkable for its scale and geographic diversity. The repetition of Iranian state narratives, the location of managers in Iran, and the sheer number of accounts, websites, countries, and languages involved, suggest that this was a state-backed operation, as few private groups would have the resources necessary to run such a large undertaking from Iran.

The pages targeted at least 15 countries. Several dozen pages had already been taken down before the DFRLab began its analysis, so this list should not be considered exhaustive.

Indonesia appears to have been the most targeted, with 19 different pages focusing on the country or posting in Indonesian. Many were linked by the name “Berita Dunia,” meaning “World News,” and posted links to website beritadunia.net, whose articles featured prominently in the Twitter exposé last October.

Despite the focus, the “Info and Ads” section of the page confirmed that most of its managers were in Iran, rather than Indonesia.

India was the second most targeted country, with 14 pages refurbishing Iran’s stance on international issues for a local Indian audience. The Indian-focused Facebook page with most followers was “The Leaders News” (@leadernewx), which counted over 180,000 followers.

The page’s “About” section linked to a website called theleadersnews[.]com, but gave no other affiliation. Its self-description attacked a world run by “one hegemonic superpower and its allies,” and accused “‘liberal’ state power” of “medieval barbarism.”

All the page’s most recent posts shared articles from the website of the same name, which were routinely anti-U.S., pro-Iranian, anti-Israel, and pro-Hezbollah. This very much reflects Iran’s foreign-policy positions.

Its posts were primarily copies, with attribution, of articles from known Iranian laundering sites exposed in the earlier takedowns, including IUVM. Archive versions of the theleadersnews articles lifted directly from IUVM can be seen here, here, and here. Archived versions copied from another suspected Iranian laundromat site, AHTribune, can be seen here, here, and here.

This modus operandi is identical with that of websites in the IUVM network, detailed above.

Despite its following of 180,000, the overall engagement on the page’s posts was low, apart from a spike on September 1, 2017.

A close look at The Leaders News’s page suggests the page was either repurposed, acquired, or hacked, as the page was dedicated to Indian international cricket player Hardik Pandya until September 24, 2017.

The spike was caused by a single post about Pandya and two new “girl fans.” This post received 132,000 responses.

A few weeks later, the page started posting domains from the website which shared its name. The graphic below puts domains posted by the page according to timeline:

This suggests that the page was created to build an Indian audience by posting about an Indian cricket star, and then repurposed to pass that audience Iranian messaging. Alternatively, the page may have been hacked or otherwise taken over.

Many pages focused on the conflict in Yemen and the Palestinian situation, both core issues in Iran’s foreign policy. They covered them mainly from the Iranian perspective, demonizing Israel, Saudi Arabia, and the United States.

Eight pages focused on Nigeria. For instance, a page called Just for Informing Nigeria was allegedly run by Nigerians, while in fact the location of the page managers was Iran or Sudan.

Other pages covered the detention of Nigerian Shia leader Ibrahim Zakzaky, but also included political events in Yemen, and the situation of its Shia minority. For instance, the page Free Zakzaky Now shared a post from Facebook user “Ibrahim Ishaq Shia” with images from a demonstration in Nigeria in support of Yemenis who were killed by Saudi Arabia — a core Iranian foreign-policy message.

One Facebook page, called “Sunnis Demanding Zakzaky’s Freedom,” specifically emphasized how both, Sunni and Shia, want to free the Shia, Nigerian cleric. The page also claimed in its “About” section: “it is not the matter of Sunnis or Shias! It is the matter of our holy religion, Islam. It is and should be all about Humanity! It is all about Unity.”

The page mostly published content calling for an end to the Shia-Sunni conflict and for the reunion of the main branches of Islam.

There was also the page Palasdinu za ta zama “yantacciya, which covered the February 2019 Nigerian presidential election.

Systematically, the pages promoted messages that were in line with the Iranian government’s strategic narratives. For example, they routinely attacked Israel, particularly in the context of the Israeli-Palestinian conflict in Gaza.

They also attacked the United States, both over its foreign policy in general and its decision to relocate its embassy in Israel to Jerusalem in particular.

They also promoted Iran’s role as a regional power and power-broker.

Some of the pages, like the “Berita Dunia” group, pointed to websites that reproduced Iranian state content verbatim.

For example, the page “Qods International News Agency” (named after the Arabic name for Jerusalem, al-Quds or al-Qods, and a term used in earlier Iranian operations, including a Twitter account called @VoiceOfQuds) posted an article on the crash of a U.S. F-35 fighter, linking to an article on the website qodsna.com which was published on September 29, 2018.

The article was a word-for-word copy of an article which appeared on Iranian regime channel PressTV the day before. The only difference was that the Qods page claimed itself as the author of the piece, by inserting “Qods New Agency (Qodsna)” in the dateline.

The Leader Times posted a word-for-word copy of an article about a phone call between Russia’s and Iran’s foreign ministers regarding Venezuela from Iran Daily, the official daily newspaper of the government of Iran.

Iran Daily mentioned that the original source of the publication was IRNA, the official news agency of Iran (see the blue underline above). The Leader Times omitted the attribution, making it look like an original publication.

Two Facebook pages, Sen-Aftruth and Afric-Truth, linked to the news domain Aftruth.com in their about section and shared the same logo as the domain in their profile picture. Sen-Aftruth appeared to mostly share links of French articles from the news outlet Aftruth.com. The posts linking to Aftruth.com as well as the posts on Afric-Truth barely gained any engagement.

The large number of shared articles on Sen-Aftruth linking to the Aftruth.com domain and the clear affiliation of both Facebook pages to the same domain suggest that both pages were used to amplify content on Aftruth.com.

Aftruth.com verbatim posted articles from iuvmpress.com, without attributing the source. Two examples of these articles focused on Israel and its alleged benefit from the Indian-Pakistani conflict as well as human rights violations in Saudi Arabia. The articles first appeared on iuvmpress.com and then on Aftruth.com.

Another article focused on the “anti-Iranian summit” held in Poland, further pushing anti-US and anti-Poland messaging due to both countries’ prominent roles at the Middle East conference in Warsaw. One month later, iuvmpress.com changed the title slightly and used a different picture to publish the same article again.

This was precisely the behavior of the IUVM-linked websites and social media assets that featured in earlier exposures and takedowns. This behavior reinforces the conclusion that the network in the latest takedown also served to amplify Iranian regime messaging and used social media to drive users toward laundromat websites.

The impact of the pages varied widely. Some pages had little or no engagement, and no followers at all. At least one page had not even posted prior to the takedown.

Others, meanwhile, had tens of thousands of followers. The Facebook page مش عايزنهم (translated from Arabic: “I Do Not Want Them”) garnered up to 97,986 likes and 98,207 followers since it was first created on May 21, 2015.

An analysis of the “Info and Ads” section of the page revealed that the primary locations of people who managed the page included Iran (six people), Egypt (three people), Sudan (one person), and Syria (one person).

The content on the page was mostly centered around anti-American, anti-Israel, and anti-Saudi messaging. One video published on the page derided a U.S. soldier and showed the logo of “In the Now,” a social media outlet owned by Kremlin-controlled media outlet RT. Open-source investigation could not confirm the origin of the video. Other videos focused on an incident in which an Israeli policeman allegedly disrespect a mosque, and another in which the U.S. Secretary of State allegedly acknowledged a purported partnership between Saudi Arabia and Israel.

The posts of the page gained very little engagement, as illustrated by the likes, shares, and video views of the examples below.

Overall, the operation does not appear to have had a systematically high impact.

The operation strongly resembled the earlier IUVM operation. Facebook did not attribute it to IUVM directly, but the latest network used the same techniques and pointed to some of the same websites, making attribution to the same network likely, although not confirmed.

In particular, pages across the network reproduced IUVM content, as well as content from other websites which have featured in earlier exposés and takedowns.

The network functioned by steering users towards ostensibly independent news websites, which amplified Iranian regime propaganda, often copied verbatim from regime assets. The social media content therefore served as a secondary amplifier, rather than a direct audience-engagement tool.

Despite the heterogeneous nature of the assets — they were spread across many countries, languages, and cultures — their messaging was largely homogeneous. It dealt with issues of importance to the Iranian government, supporting Palestinians and Shia Muslims on one hand, and attacking Israel, the United States, Saudi Arabia, and the conduct of the military campaign in Yemen on the other.

The focus on South Asia was noteworthy. Indonesia and India had the most pages targeted at them; African countries also featured prominently. This expands the known area of Iranian influence operations, which have thus far been primarily exposed in the Middle East and in the West.

The apparent impact of the operation was mixed at best, and often modest. Some pages had high follower counts but scored little engagement; others had few or no followers. While follower count cannot directly be used to measure the effect of the campaign overall, it does suggest that, on Facebook itself, the impact was limited.

Given the scale of the operation and the number of websites behind it, this is likely to be an ongoing story. The DFRLab will continue to track Iranian efforts.

Follow along for more in-depth analysis from our #DigitalSherlocks.