Thread by @benimmo

Thread: how a cluster of websites laundered Iranian regime messaging and passed it around the network @FireEye exposed last week.

medium.com/dfrlab/trolltr…

One of the interesting things about the original network was how often they cited a website called IUVMPress. (The acronym stands for the International Union of Virtual Media.)

Here's Instituto Manquehue, one of the sites identified by FireEye, listing them as an author.

Here's britishleft.com, another one in the network, reproducing them repeatedly.

Worth noting that the "about" page for britishleft.com is almost identical with the "about" page for the @TheCanaryUK.

(H/t the real @UnaMullally for the spot.)

And here's another one in the group, libertyfrontpress.com, sharing a byline with IUVMPress.

(Also, that reference to President Macaron is poetry.)

There's certainly a lot to the IUVM group. Eight sites listed here, and there were at least two more.

Multimedia. Webstories, ticker, TV, cartoons, archive...

To see the forensics on their traffic, there's this thread from @josh_emerson.

It traces back to the group @FireEye found. Per @jc_stubbs and @LeeFosterIntel, the registrant email was the same, too.

https://twitter.com/josh_emerson/status/1033480612403994624

The IUVM group's geopolitics are pretty clear. TV and cartoon examples here.

Its ticker shares an interesting set of other outlets. Press TV, al-Manar, TeleSur, Fars, Veterans Today... RT features there too.

The vocabulary is pretty specific, too. Compare their statute (which says their HQ is in Tehran) with Ayatollah Khamenei's rhetoric.

"Global arrogance states." "Global arrogance powers."

It goes beyond mere ideological matches, though.

Here's IUVMPress on Russia's Syria claims, compared with PressTV. Boxes show matched text.

Same here. IUVMPress on the left, PressTV on the right.

Same image, same story, only IUVMPress lacked the lede.

And not attributed.

The copies came within a couple of hours. Compare Google timelines here.

It wasn't just PressTV. Here's IUVMPress compared with Khamenei's official website. Match.

Here's IUVMPress compared with a piece from Real Progressive Front, another one in the network (and therefore not real, as such).

Match.

IUVMPress and usjournal.net, yet another member of the network.

Match.

In this case, IUVMPress was the intermediary.

Story from Khamenei's website, copied without attribution by IUVMPress.

Same story on britishleft.com, attributed to IUVMPress.

Laundering.

Here, the transmission goes usjournal.net --> IUVMPress --> britishleft.com

Again, original source not attributed.

This is just the start. There's more websites out there which copied IUVMPress systematically.

More links there?

Upsum: These didn't look like attempts to cause disruption in other countries. More like a vector for passing Iranian regime messaging into unsuspecting audiences.

Definitely pro-regime. The use of language and official sources make it look regime-linked. /

Thread ends.