Content targeting the United States government surfaced on Instagram and Twitter following the death of Qasem Soleimani

GRAPHIC CONTENT WARNING: The article below contains a photoshopped image depicting graphic violence.

Following the January 2 military strike by the U.S. military that killed, among others, Qasem Soleimani, major general of Iran’s Islamic Revolutionary Guard Corps (IRGC), social media platforms saw a substantial increase of engagement about the event. Among the deluge, the vast majority of social media engagement seemed to be authentic, from a wide array of social media users, which is to be expected during a news event of this magnitude. However, some discrete accounts on Instagram and Twitter showed signs of inauthentic behavior while targeting the United States government.

While open source research cannot at this time determine the magnitude of coordinated or inauthentic engagement within the broader online conversation about Soleimani’s death, a large portion of online engagement was driven by sentiment and polemic aligned with Iran.

Iran has developed a sophisticated apparatus to conduct information operations as an extension of its foreign policy, which the DFRLab has reported extensively on and is included at the conclusion of this article. Most of the previously known online information operations from Iran have been conducted along the lines of present the Iranian narrative and persuade audiences to it, much of the time using misleading tactics, as opposed to engaging on all sides of a narrative to cause confusion or chaos in the information environment.

In response to Soleimani’s death, the hashtag #HardRevenge started to trend on Twitter on January 3. The hashtag appeared to be a call for an equivalent and retaliatory strike by the Iranian regime against the United States. The DFRLab found that at least 77 percent of the campaign comprised retweets. However, the DFRLab could not identify any bot activity in boosting the hashtag, though bots are often used to achieve such a lopsided tweet-to-retweet ratio. Additionally, alongside the hashtag, posts mentioned President Trump 6,760 times and Secretary Pompeo 2,049 times, suggesting a targeted attack on top U.S. officials. The high amount of retweets indicated that much of the amplification was not unique messages from individual users but rather recycled content boosted by unique users.

According to SabaMedia.Info, an app that gives top Twitter trends in Iran, the top trending hashtag was the Farsi version of the same words: #انتقام_سخت (which roughly translates to “#HardRevenge”). This hashtag in particular was frequently accompanied by strong language reflecting a desire for retaliation against the United States.

https://twitter.com/esmaeel2018/status/1212993256146890752

This would not be the first instance the DFRLab has documented large scale coordinated or inauthentic behavior targeting Western officials with messages aligned with the Iranian government’s positions. However, it is extremely important to note that this type of spike in online engagement is not uncommon in Iran or across the Shia Muslim community online.

As an example from February 2019, Iranian accounts carried out a spam attack on Secretary Pompeo’s Instagram page. The attack was carried out in response to a post from Pompeo regarding the unrest in Venezuela at the time, as the Iranian accounts expressed their support for regime of Nicolás Maduro. Analysis suggested that there was a high level of coordinated and inauthentic behavior in the campaign.

Of note in this most recent case, the DFRLab also identified an instance of a small number of commercial accounts on Instagram being repurposed to post a picture of coffins and tagging the White House. One account went from promoting tennis shoes to a rhetorical attack on the United States, posting an image of a child running between flag-draped coffins with the words “Prepare the coffins.”

Prior to posting the image, however, the account — arzan101 — appeared to have been exclusively promoting tennis shoes.

Other Instagram posts appeared to share the same violent image, and most appeared around the same time, a sign of possible coordination. Set to the backdrop of an authentic global conversation, a handful of Instagram accounts repurposed simultaneously around violent posts may have been coordinated but not likely inauthentic. There is no indication in open sources the accounts were directly linked to the Iranian government, and the anti-U.S. sentiment was shared well beyond the reach of official Iranian government audience reach.

Conclusion

The revenge hashtags trending in Iran and elsewhere showed how social media platforms are in many cases the first point of escalation across wide audiences. Hashtags calling for vengeance were quick to appear following Soleimani’s death. This could preface a set of more intensive information operations from Iran.

The DFRLab will continue to monitor developments across the Middle East, in particular in English and Farsi and between Iran and the United States, over the coming days.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.

The DFRLab has produced one of the largest bodies of primary, open source reporting on information operations from Iran. The lessons of the past might point to the events of the future, so we invite you to read our previous stories highlighted below.

December 16, 2019: Visual forensics corroborate reports of Iran’s lethal crackdown on protests

October 24, 2019: Facebook takes down Iranian assets, some targeting Latin American audiences

May 30, 2019: Facebook Removes Iran-based Assets. Again.

April 19, 2019: Facebook Dismantled Iranian Influence Operation

March 26, 2019: KEY FINDINGS: Iranian Propaganda Network Goes Down

March 26, 2019: IN DEPTH: Iranian Propaganda Network Goes Down

February 25, 2019: #TrollTracker: Spam Attack on Secretary Pompeo

January 31, 2019: #TrollTracker: Outward Influence from Iran

October 26, 2018: #TrollTracker: Facebook Uncovers Iranian Influence Operation

October 17, 2018: #TrollTracker: Twitter Troll Farm Archives

August 29, 2018: #TrollTracker: An Iranian Messaging Laundromat

August 27, 2018: #TrollTracker: Iran’s Suspected Information Operation