[FireEye]"Distinguished Impersonator" Information Operation That Previously Impersonated U.S. Politicians and Journalists on Social Media Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests

[igor51]

"Distinguished Impersonator" Information Operation That
Previously Impersonated U.S. Politicians and Journalists on Social Media
Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests

In May 2019, FireEye Threat Intelligence published a blog post
  exposing a network of English-language social media accounts that
  engaged in     href="/content/fireeye-www/en_US/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html">inauthentic
    behavior and misrepresentation that we assessed with low
  confidence was organized in support of Iranian political interests.
  Personas in that network impersonated candidates for U.S. House of
  Representatives seats in 2018 and leveraged fabricated journalist
  personas to solicit various individuals, including real journalists
  and politicians, for interviews intended to bolster desired political
  narratives. Since the release of that blog post, we have continued to
  track activity that we believe to be part of that broader operation,
  reporting our findings to our intelligence customers using the moniker
  “Distinguished Impersonator.”

 

Today, Facebook     href="https://about.fb.com/news/2020/02/removing-coordinated-inauthentic-behavior/">took
    action against a set of eleven accounts on the Facebook and
  Instagram platforms that they shared with us and, upon our independent
  review, we assessed were related to the broader Distinguished
  Impersonator activity set we’ve been tracking. We separately
  identified a larger set of just under 40 related accounts active on
  Twitter against which Twitter has also taken recent enforcement
  action. In this blog post, we provide insights into the recent
  activity and behavior of some of the personas in the Distinguished
  Impersonator network, in order to exemplify the tactics information
  operations actors are employing in their attempts to surreptitiously
  amplify narratives and shape political attitudes.          

 

Activity Overview

 

Personas in the Distinguished Impersonator network have continued to
  engage in activity similar to that we previously reported on publicly
  in May 2019, including social media messaging directed at politicians
  and media outlets; soliciting prominent individuals including
  academics, journalists, and activists for “media” interviews; and
  posting what appear to be videoclips of interviews of unknown
  provenance conducted with such individuals to social media. The
  network has also leveraged authentic media content to promote desired
  political narratives, including the dissemination of news articles and
  videoclips from Western mainstream media outlets that happen to align
  with Iranian interests, and has amplified the commentary of real
  individuals on social media.

 

Outside of impersonating prominent individuals such as journalists,
  other personas in the network have primarily posed as U.S. liberals,
  amplifying authentic content from other social media users broadly in
  line with that proclaimed political leaning, as well as material more
  directly in line with Iranian political interests, such as videoclips
  of a friendly meeting between U.S. President Trump and Crown Prince of
  Saudi Arabia Mohammad Bin Salman accompanied by pro-U.S. Democrat
  commentary, videoclips of U.S. Democratic presidential candidates
  discussing Saudi Arabia's role in the conflict in Yemen, and other
  anti-Saudi, anti-Israeli, and anti-Trump messaging. Some of this
  messaging has been directed at the social media accounts of U.S.
  politicians and media outlets (Figure 1).

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture1.png" alt="" />
 
 Figure 1: Twitter accounts in the
    Distinguished Impersonator network posting anti-Israeli, anti-Saudi,
    and anti-Trump content

 

We observed direct overlap between six of the personas operating on
  Facebook platforms and those operating on Twitter. In one example of
  such overlap, the “Ryan Jensen” persona posted to both Twitter and
  Instagram a videoclip showing antiwar protests in the U.S. following
  the killing of Qasem Soleimani, commander of the Islamic Revolutionary
  Guards Corps’ Quds Force (IRGC-QF) by a U.S. airstrike in Baghdad in
  January 2020 (Figure 2). Notably, though the strike motivated some
  limited activity by personas in the network, the Distinguished
  Impersonator operation has been active since long before that incident.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture2.png" alt="" />
 
 Figure 2: Posts by the “Ryan Jensen”
    persona on Twitter and Instagram disseminating a videoclip of
    antiwar protests in the U.S. following the killing of Qasem Soleimani

 

Accounts Engaged in Concerted Replies to Influential Individuals on
  Twitter, Posed as Journalists and Solicited Prominent Individuals for
  “Media” Interviews

 

Personas on Twitter that we assess to be a part of the Distinguished
  Impersonator operation engaged in concerted replies to tweets by
  influential individuals and organizations, including members of the
  U.S. Congress and other prominent political figures, journalists, and
  media outlets. The personas responded to tweets with specific
  narratives aligned with Iranian interests, often using identical
  hashtags. The personas sometimes also responded with content unrelated
  to the tweet they were replying to, again with messaging aligned with
  Iranian interests. For example, a tweet regarding a NASA mission
  received replies from personas in the network pertaining to Iran’s
  seizure of a British oil tanker in July 2019. Other topics the
  personas addressed included U.S.-imposed sanctions on Iran and U.S.
  President Trump’s impeachment (Figure 3). While it is possible that
  the personas may have conducted such activity in the hope of eliciting
  responses from the specific individuals and organizations they were
  replying to, the multiple instances of personas responding to
  seemingly random tweets with unrelated political content could also
  indicate an intent to reach the broader Twitter audiences following
  those prominent accounts.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture3.png" alt="" />
 
 Figure 3: Twitter accounts addressing
    U.S.-imposed sanctions on Iran (left) and the Trump impeachment (right)

 

Instagram accounts that we assess to be part of the Distinguished
  Impersonator operation subsequently highlighted this Twitter activity
  by posting screen recordings of an unknown individual(s) scrolling
  through the responses by the personas and authentic Twitter users to
  prominent figures’ tweets. The Instagram account @ryanjensen7722, for
  example, posted a video scrolling through replies to a tweet by U.S.
  Senator Cory Gardner commenting on “censorship and oppression.” The
  video included a reply posted by @EmilyAn1996, a Twitter account we
  have assessed to be part of the operation, discussing potential
  evidence surrounding President Trump’s impeachment trial.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture4.png" alt="" />
 
 Figure 4: Screenshot of video posted by
    @ryanjensen7722 on Instagram scrolling through Twitter replies to a
    tweet by U.S. Senator Cory Gardner

 

We also observed at least two personas posing as journalists working
  at legitimate U.S. media outlets openly solicit prominent individuals
  via Twitter, including Western academics, activists, journalists, and
  political advisors, for interviews (Figure 5). These individuals
  included academic figures from organizations such as the Washington
  Institute for Near East Policy and the Foreign Policy Research
  Institute, as well as well-known U.S. conservatives opposed to U.S.
  President Trump and a British MP. The personas solicited the
  individuals’ opinions regarding topics relevant to Iran’s political
  interests, such as Trump’s 2020 presidential campaign, the Trump
  administration’s relationship with Saudi Arabia, Trump’s “deal of the
  century,” referring to a peace proposal regarding the
  Israeli-Palestinian conflict authored by the Trump administration, and
  a tweet by President Trump regarding former UK Prime Minister Theresa May.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture5.png" alt="" />
 
 Figure 5: The “James Walker” persona
    openly soliciting interviews from academics and journalists on Twitter

 

Twitter Personas Posted Opinion Polls To Solicit Views on Topics
  Relevant to Iranian Political Interests

 

Some of the personas on Twitter also posted opinion polls to solicit
  other users’ views on political topics, possibly for the purpose of
  helping to build a larger follower base through engagement. One
  account, @CavenessJim, posed the question: “Do you believe in Trump’s
  foreign policies especially what he wants to do for Israel which is
  called ‘the deal of the century’?” (The poll provided two options:
  “Yes, I do.” and “No, he cares about himself.” Of the 2,241 votes
  received, 99% of participants voted for the latter option, though we
  note that we have no visibility into the authenticity of those
  “voters”.) Another account, @AshleyJones524, responded to a tweet by
  U.S. Senator Lindsey Graham by posting a poll asking if the senator
  was “Trump’s lapdog,” tagging seven prominent U.S. politicians and one
  comedian in the post; all 24 respondents to the poll voted in the
  affirmative. As with the Instagram accounts’ showcasing of replies to
  the tweets of prominent individuals, Instagram accounts in the network
  also highlighted polls posted by the personas on Twitter (Figure 6).

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture6.png" alt="" />
 
 Figure 6: Twitter account @CavenessJim
    posts Twitter poll (left); Instagram account @ryanjensen7722 posts
    video highlighting @CavenessJim's Twitter poll (right)

 

Videoclips of Interviews with U.S., U.K., and Israeli Individuals
  Posted on Iran-Based Media Outlet Tehran Times

 

Similar to the personas we reported on in May 2019, some of the more
  recently active personas posted videoclips on Facebook, Instagram, and
  Twitter of interviews with U.S., UK, and Israeli individuals including
  professors, politicians, and activists expressing views on topics
  aligned with Iranian political interests (Figure 7). We have thus far
  been unable to determine the provenance of these interviews, and note
  that, unlike some of the previous cases we reported on in 2019, the
  personas in this more recent iteration of activity did not themselves
  proclaim to have conducted the interviews they promoted on social
  media. The videoclips highlighted the interviewees’ views on issues
  such as U.S. foreign policy in the Middle East and U.S. relations with
  its political allies. Notably, we observed that at least some of the
  videoclips that were posted by the personas to social media have also
  appeared on the website of the Iranian English-language media outlet
    Tehran Times, both prior to and following the personas'
  social media posts. In other instances, Tehran Times published
  videoclips that appeared to be different segments of the same
  interviews that were posted by Distinguished Impersonator personas.
    Tehran Times is owned by the Islamic Propagation
  Organization, an entity that falls under the supervision of the
  Iranian Supreme Leader Ali Khamenei.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/iraninfoops/Picture7.png" alt="" />
 
 Figure 7: Facebook and Instagram accounts
    in the network posting videoclips of interviews with an activist and
    a professor

 

Conclusion

 

The activity we’ve detailed here does not, in our assessment,
  constitute a new activity set, but rather a continuation of an ongoing
  operation we believe is being conducted in support of Iranian
  political interests that we’ve been tracking since last year. It
  illustrates that the actors behind this operation continue to explore
  elaborate methods for leveraging the authentic political commentary of
  real individuals to furtively promote Iranian political interests
  online. The continued impersonation of journalists and the
  amplification of politically-themed interviews of prominent
  individuals also provide additional examples of what we have long
  referred to internally as the “media-IO nexus”, whereby actors
  engaging in online information operations actively leverage the
  credibility of the legitimate media environment to mask their
  activities, whether that be through the use of     href="/content/fireeye-www/en_US/blog/threat-research/2018/08/suspected-iranian-influence-operation.html">inauthentic
    news sites masquerading as legitimate media entities, deceiving
        href="/content/fireeye-www/en_US/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html">legitimate
    media entities in order to promote desired political narratives,
  defacing media outlets’ websites to disseminate disinformation,
  spoofing legitimate media websites, or, as in this case, attempting to
  solicit commentary likely perceived as expedient to the actors’
  political goals by adopting fake media personas.

Source: "Distinguished Impersonator" Information Operation That
Previously Impersonated U.S. Politicians and Journalists on Social Media
Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests