So, err, someone is stealing the identities of reporters who barely use Twitter and exploiting them to push propaganda consistent with the kind of stuff we've seen from Iran. Today, Twitter shut down accounts imitating NY Post & Haaretz reporters thedailybeast.com/new-york-post-…
I've been watching some of these accounts since the fall when they first started tweeting out disinformation about the MEK, a dissident cult that was until somewhat recently designated as a terrorist organization by the State Dept.
This morning I noticed Israeli accounts pointing out that one of the accounts I followed was imitating a real Haaretz reporter and tweeting out a fake story about the US supposedly evacuating dozens of casualties from the Iraq ballistic missile strike to Israel (they didn't)
You can see some of it here. If you've been paying attention, you know that state-linked Iranian media have been pushing a similar narrative since the strikes
The tactics in this seemingly linked network are pretty similar:
•Create a fake account for a real person that doesn't or rarely uses twitter
•Lurk and tweet normal stuff you'd expect the imitated person to tweet
•Pub fake stories on open platforms like Medium, Odyssey Online
•Create a fake account for a real person that doesn't or rarely uses twitter
•Lurk and tweet normal stuff you'd expect the imitated person to tweet
•Pub fake stories on open platforms like Medium, Odyssey Online
Khoury account used those tactics to piggyback on another campaign w/same tactics. Fake account in the name of Macron chief of staff Alexis Kohle pumped out a story saying France was gonna deport MEK in November. liberation.fr/planete/2019/1…
Story was nonsense but came as Macron was involved in nuke talks with Iran so had the appearance of an MEK-for-nuke-progress swap. Account was nuked. But fake Khoury account took to Medium to echo it 
Fake Khoury account also tried to launch a bizarre fake story involving a phony assassination attempt against the Israeli president. Notice a subject pattern in targeting? MEK, Israel.
When the fake Khoury account popped with the Iran missile narrative this AM, went back through my files and found it had linked to a similar style account mimicking NY Post journo
✔️Impersonating a reporter
✔️MEK/Israel targeting
✔️Open platform abuse for fake stories.
✔️Impersonating a reporter
✔️MEK/Israel targeting
✔️Open platform abuse for fake stories.
This is the fake Mark Moore. I called the real Mark Moore, who's a very nice guy who was very surprised to learn his identity was stolen, just like Khoury.
And the fake Moore got up to the same kind of hijinks. Laid low and tweeted stuff from the real Moore. But the Fake Moore's also put out fake stories focused on Israel and MEK on open platforms like The Odyssey Online and Medium
All of which displays a similar set of tactics to a campaign The Daily Beast reported on months ago, where a fake account impersonated a real Toronto policeman to launch a fake story about John Bolton's family and an MEK member.
Source told us the IC was aware of the campaign and had been tracking Iranian disinformation campaigns designed to diminish Bolton's standing in the Trump admin thedailybeast.com/us-intel-offic…
So who's behind the campaign? Can't say for sure. It's certainly consistent with Iranian propaganda and it's aims but as @benimmo reminds us “content is only ever a weak signal” for attribution. Hard confirmation would have to come on the technical side.
@benimmo In the meantime, it's a good reminder to be careful about what you share and believe. For pubs, now would be a good time to inventory your reporters and kick the tires on folks who have dormant accounts to see if there's any fakers.
@benimmo One thing I'll add. For general awareness, @FireEye's reports on Iranian disinformation have been excellent. fireeye.com/blog/threat-re…
