Facebook Takes Down Another Batch of 'Unsophisticated' IRGC Accounts

An Iranian cyber-network linked to the IRGC has been pulled from Facebook for posting content encouraging Iranians to “praise the military and criticize opposing factions”.

In its latest report on coordinated inauthentic behavior (CIB), the social media giant said it had removed some 93 accounts, 14 pages, 15 groups and 194 Instagram accounts in September that were targeting domestic audiences, particularly in Lorestan province. 

Facebook found most of the group’s activity was linked to individuals associated with the IRGC, despite apparently intense efforts by group members to conceal their identities and organized nature. 

“This is the first covert influence operation we’ve disrupted in Iran that is focused almost entirely inside the country,” the report said. “The people behind this activity relied on fake accounts… to post primarily on Instagram as local news entities named after cities in Lorestan.”

Many of the fake accounts purported to be Iranian Kurds, including young Kurdish women. Others were dressed to look like supporters of exiled opposition group the Mojahedin-e Khalq Organization (MEK), in an apparent attempt to build audiences.

Caption reads: “On the anniversary of the establishment of the hypocrites (known as the Mujahedin-e-Khalq), today the average member age is 71 years old, the group's members have gone from 8,000 members to only 2,400, over 400 of their members have died from heart disease or cancer (due to stress)”.

Some of the accounts changed their names several times and attempted to directly message people on Instagram. They also re-posted content from Iranian state media and government officials.

The operation was criticized by Facebook as “not particularly novel or sophisticated”, with the IRGC posing - again - as local news entities in a bid to lend credibility to its propaganda, and batch-purchasing fake followers to look more popular and trustworthy. 

These outlets primarily posted about news and current events in Lorestan, including voter turnout in the 2020 Iranian election and criticizing the MEK, the Kurdish nationalist movement, the US and Saudi Arabia. 

Caption reads: "Attention attention attention attention... Publishing the same fake map in the virtual space leads to good. This map will be taken, respect users please. Take action towards publishing the original map of our dear country."

Around 4,300 other accounts - either genuine or paid-for - were following one or more of the IRGC-linked pages, while 3,600 joined one or more of their groups and more than 590,000 followed one or more of their Instagram accounts. 

But, Facebook’s investigators said, this had failed to translate into “authentic engagement”: many real social media users who came across the content had called it out as fake. 

Previous reports by Facebook have said that Iran is responsible for the second-largest amount of organized disinformation across its platforms, second only to Russia. In May 2011, it revealed it had uncovered 23 separate Iranian-origin influence networks on Facebook, WhatsApp and Instagram, out of a total of 150 worldwide. Nine of those Iranian influence networks were linked directly to the state-owned Islamic Republic of Iran Broadcasting (IRIB). 

Facebook’s monthly CIB reports aim to reveal coordinated efforts by domestic and non-governmental campaigns to manipulate public debate for a strategic goal. In the latest report, investigators stressed: “We know that influence operations will keep evolving in response to our enforcement, and new deceptive behaviors will emerge.”

Related coverage:

Three Years of Facebook Takedowns of Iran-Sponsored Fake News Pages

PressTV Offline as FBI Swoops on Pro-Iran 'Disinformation' Websites

Iranian Online Network Still Peddling Coronavirus Disinformation

Iranian State Media's Disinformation about the Protests in the US

Facebook Pulls Plug on "Troll Farm" Posting Pro-Iranian Opposition Content