Updated at 09:45. ET
Facebook has taken down 652 accounts, pages and groups originating from Iran. The accounts were used for political disinformation and aimed at users in the Middle East, Latin America, UK and the United States, according to Facebook.
This is the first announcement of this size from Facebook about a coordinated campaign of influence from Iran. Twitter followed soon after it had also suspended 284 accounts "to engage in coordinated manipulation." These accounts also appeared to originate from Iran.
Facebook said it was spelled by cybersecurity firm FireEye, which said the network of accounts across social media platforms pressed "stories [that] include anti-saudi, anti-Israeli and pro-Palestinian themes, as well as support for specific US policies which is beneficial to Iran, "such as the US-Iran nuclear agreement.
"The activity we have discovered is important and demonstrates that actors outside of Russia continue to engage in and experiment with online social media driven influences to shape political discourse," said FireEye in his first report.
The accounts closed by Facebook had a total of 81
Facebook says it was able to draw a link between part of the network called "Liberty Front Press" to Iranian state media. Its first accounts date back to 2013.
Another subset of the network dates back to 2016 and was "also engaged in traditional attacks on cyber security, including attempts to hack people's accounts and spread malware", according to Facebook.
Separately, Facebook also said that it removed an unspecified number of accounts linked to the Russian military intelligent services.
Facebook said the campaign that came from Iran and Russia did not seem to be linked or coordinated with each other, but "used similar tactics by creating networks of accounts to mislead others about who they were and what they did."
In July Facebook blocked 32 Russian linked accounts and pages on Facebook and Instagram.
Facebook news comes on the same day Microsoft revealed that a Russian military intelligence unit had targeted conservative American thought tanks. Microsoft said that it had closed 84 fake websites linked to this group in just two years.
Facebook said it is still investigating these findings and has shared the information with US and British governments. Due to US sanctions involving Iran, the company has also informed US Treasury and government departments.
AILSA CHANG, HOST:
We are learning today about ongoing cyber attacks against political targets in the United States. We have talked a lot about how Russia has been involved in disinformation campaigns, but now they are not the only state actor who has been accused of a major US technology company about these types of efforts. Facebook said tonight that it has discovered and disturbed an Iranian disinformation campaign on its network. It is in addition to a new Russian disinformation campaign.
NPR's political reporter Tim Mak is on this story and he joins us now. Welcome.
TIM MAK, BYLINE: Thank you.
CHANG: So you can just start us telling us what exactly did Facebook discover this evening?
MAK: So Facebook says it has taken down a coordinated network of pages originating in Iran and targeted to users in the Middle East, Latin America, UK and US. And then this campaign takes about 652 pages with almost a million Facebook followers and thousands of dollars for advertising.
See these Facebook and Instagram accounts – they did a lot of things. They pretended to be an independent Iranian media organization, while actually connecting back to Iranian state media. In other parts of the network, they were fake like news organizations and civil society organizations to spread political disinformation. And this campaign also involved more traditional types of cyber attacks. This is like attempting hacking and effort to spread what we call malware. The network of accounts also pushed reports that include anti-saudi, anti-Israeli, pro-Palestinian themes, as well as support for specific US policies that are beneficial to Iran.
CHANG: So how did Facebook find out that these campaigns themselves occurred?
MAK: It's interesting. They were originally tipped by not their internal security processes, but by FireEye, a third-party cybersecurity company. And then Facebook launched a survey and they revealed hundreds of these Iranian-linked accounts. Facebook has also emphasized work on US law enforcement, and it shared information about this disinformation campaign it has discovered with US and US governments. Also because Iran is currently subject to some rather strict sanctions, Facebook has informed the state treasury and government departments of what they found through the survey they announced tonight.
CHANG: Now much of this type of activity has not been
MAK: Yes, we have talked a lot about …
MAK: … Russian disinformation.
CHANG: Over and over.
MAK: And now it looks like the Iranian campaign took a side out of Russia's playbook, you know – and we do not know – that Facebook tonight announced not only an Iranian campaign because that's what I mean is what's new about …
MAK: … What we learn today. But they also announced that it is – that Facebook has disturbed new Russian accounts. I mean, we spoke three weeks ago when Facebook beat down more than 30 Russian accounts. It had a huge amount, and after that it looks like what Iranians have done in this case. Separately, Microsoft in a separate message – they said they had fired a tried attack on conservative thought tanks and the US government of a Russian hacking group called Fancy Bear. So here's senator Lindsey Graham on a cybersecurity consultation this afternoon.
(19659017) LINDSEY GRAHAM: America is under cyber attack. We start shopping, but not fast enough and not compelling enough.
CHANG: Does it appear that there are more cyber attacks this year? I mean, do you have any sense of it in your reporting?
MAK: Yes. Senator Mark Warner said that there are many technology companies that largely interfere with any of these campaigns by state actors. We'll see it again and again probably in the coming months as we approach the mid-term election. We are – what we are concerned about is not just Russian network operations, not just Iranian network operations, but possibly also from North Korea and China.
CHANG: It's NPR's Tim Mak. Thanks.
MAK: Thank you a lot. Transcription provided by NPR, Copyright NPR.