New from me: investigation by The Daily Beast and @FireEye finds three reporter personas planted dozens of pro-Iranian fake articles in dozens of Arabic-language news outlets. Stories were based on spoofed, hacked, and forged sites/material…
We shared our finding with Facebook. In their release of the December coordinated inauthentic behavior takedown, Facebook found four Iran-linked accounts involved in trying to spread some of the material we sent. Accounts were active in 2020 but stopped by FB's spam detection
So what did the accounts get up to? Attempts at election meddling, for one. Here's an example of how the cycle often worked. In October, someone impersonated an Israeli cybersecurity official on FB to claim that Israel & the UAE were secretly funding the Trump campaign
This was, of course, bullshit. But up pops one of the reporter personas, Rumaisa Hanaoui to flag it on Twitter and launder the fakery into an Arabic-language story for the Algerian daily, El Wamid…
Shadia Ben Yousef was one of the most active journo personas and her fake stories caused real pain to at least one person. When Najwa Qassem, a popular Al Arabiya anchor, passed away suddenly of a heart attack, Ben Yousef wrote a story suggesting the UAE murdered her
In a cruel twist, the Ben Yousef persona invented a fake quote from Qassem's friend, Rima Najm, who wrote of her shock, hurt, and confusion seeing her name used with a fake quote to push a conspiracy theoru about her friend's death…
Some of Ben Yousef's stories were so absurd they were actually funny. When coronavirus hit, the personas planted stories trying to paint the US as the source of the virus. They used a forged tweet from a French MP to suggest that McDonalds McNuggets spread the virus
Facebook was able to attribute some of the activity they found from suspended accounts to Iranian territory. But there are other hints of a possible Iran nexus. For instance, at least two of the stories appeared on fake news domains seized by DOJ and attributed to the IRGC
While Facebook acted quickly, unfortunately Twitter still hasn't responded to the emails I sent them weeks ago warning about these accounts, including one pretending to be a jihadi group threatening attacks. cc @yoyoel
Account was part of an effort to threaten the Bahrain conference on the Arab-Israeli peace conference. They created a phony Twitter account for a fictitious jihadist group to issue threats against it in an attempt to disrupt. You'd think Twitter would care about that ¯\_(ツ)_/¯
One tangent I'll raise. We were never able to get this attributed so it's technically not part of the above basket but it is odd so I'll flag. When the personas were pushing that impersonated Israeli cyber security official for the election conspiracy, they stole another identity
The Rumaisa Hanaoui persona was one of a very few accounts that tweeted a link to the fake claim that the UAE was funding Trump's reelection. The other was an account impersonating a real life antifa activist. We talked to the real guy and he confirmed this was fake.
Even stranger, when you scrolled through his timeline it turned out the fake antifa account was "feuding" with another fake account impersonating Joey Gibbs, the head of the right wing extremist group Patriot Prayer.
We can't say that the same people behind the reporter personas are the same people behind the impersonated Antifa and Patriot Prayer accounts and have the same links to Iran. There isn't enough evidence to support any conclusions about origins and linkages yet
But given Iran's demonstrated interest in imitating the Proud Boys (remember the FL election emails and the BLM impersonations) and seizing on our dysfunctional civil society to stoke violence, this is something I'd like to follow up on. If you see any strange impersonations...
...feel free to drop me a line.
If you're a researcher, academic or a journalist and you'd like to see all of the articles in this story, I've got a spreadsheet I'm happy to share privately. Drop a line.

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Adam Rawnsley

Adam Rawnsley Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @arawnsley

14 Jan
How did the zip ties and flex cuffs seen in the hands of rioters at the senate become a go-to piece of far right gear? @KELLYWEILL and I took a look at the history of zip ties on the far-right…
Not surprisingly, immigrants were among the early victims of the far right's zip tie fetish. As undocumented immigrants became a right wing hobby horse during GWB's attempts to pass immigration reform, militias traveled to the border to mount vigilante patrols.
Among those militias were Rusty's Rangers, led by Kevin Massey, who held suspected migrants at gunpoint in zip ties. As this search warrant application footnote shoes, among Massey's devotees was Barry Croft, one of the militia members who allegedly tried to kidnap Gov Whitmer Image
Read 8 tweets
17 Nov 20
Perhaps they should ask themselves some hard questions about the management of the Hoover Institution and why so many people spouting the stuff they have to denounce came to be employed there
Read 5 tweets
19 Oct 20
New: Iranian disinformation trolls have been amplifying fake stories planted by hackers in breached twitter accounts and at least one website, according to reporting by The Daily Beast and Mandiant Threat Intelligence.…
Early this month, something strange happened. Hackers broke into Israel Hayom’s Twitter account and tweeted fake stories about Trump dying of COVID, BLM firing shots outside the Clinton’s house and a Hezbollah submarine…
We dug into the accounts amplifying those stories and found they had a long, strange trail of involvement in similar incidents. @LeeFosterIntel and his team at Mandiant had been tracking them, too.
Read 11 tweets
20 Jul 20
New from me: Racist Disinformation Campaign Impersonates Tammy Duckworth. Handful of accounts have been using a forged letter from Duckworth's office to falsely claim that "black separatists" were responsible for the Bonhomme Richard Navy ship fire.…
The accounts involved impersonated Yoni Chetboun, an Israeli special operations Lt Col who went on to serve in the Knesset, and a nonexistent reporter for France24. They've since been suspended from Twitter.
Dig through those two accounts' histories, you'll see they set up copycat websites to push their stories. The "Kelly Turner" account linked to a fake article about the Bonhomme fire lphinfo/.org, a website meant to resemble a real Israeli weekly hosted at
Read 16 tweets
6 Jul 20
Twitter just suspended 16 Twitter accounts that were part of a network of fake personas. Together they spent the last year placing about 90 opeds in +40 different news outlets. Newsmax. Washington Examiner. Jerusalem Post. Real Clear Media.…
Meet The Arab Eye/Persia Now network.
The network had about 17 different personas. Most on Twitter. Some not.
Read 29 tweets
18 May 20
There's an update to this story about the bogus defense contractor report that claims coronavirus leaked from a Wuhan lab. The Daily Beast obtained a second satellite image, this time from Airbus, showing one of the report's key claims is false.…
One of the central claims is that there was "absolutely no traffic" by the Wuhan Institute of Virology after the alleged leak from Oct 14-19. This claim is based on mobile device data and the authors claimed there were "roadblocks" put in place to prevent traffic coming near it.
@ArmsControlWonk already did a great job showing that nearby construction was likely the source of that "roadblock" theory and that there was normal traffic around. This Airbus Defence and Space image from Oct 15 shows plenty of traffic (see the callouts in red) running nearby.
Read 9 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!