President Trump dies of coronavirus and gives strength to Mike Pence. Black Lives Matter protesters surround the Clintons’ home in New York and shoot chimneys. These are some of the false scandals that a hacked Twitter account of an Israeli media outlet tried to generate readers for a few brief moments before this month, Twitter says the trolls that magnify them are connected to Iran.
The incident ended as temporarily as it began and the media, Israel Hayom, regained control of its account. But piracy wasn’t a remote event. Over the next year, hackers have damaged several Twitter accounts of news organizations and at least one online. page to plant fake stories. A new investigation through The Daily Beast and Mandiant Threat Intelligence suggests that hackers in Iran could have been the incidents.
Twitter accounts used to magnify Israel Hayom’s fake stories have been used to promote fake articles planted through hackers in orthodox Jewish news and on the Twitter account of a Bahraini media outlet. Iran-related accounts also came to attention on a false account posing as one of America’s best-known doctors, Zeke Emanuel.
The Daily Beast shared its findings with Twitter. La social media company suspended about 80 accounts for violating its platform manipulation policies on identity theft, coordinated amplification and spam.
“At this stage, we are investigating thoroughly, but early technical and behavioral signs recommend that those accounts be interconnected and originate in Iran,” a Twitter spokesperson said in a statement. “As always, we reveal each and every account and tweet that we can reliably partner with state actors in our public archives, the only ones of its kind in the industry. “
The Daily Beast has not identified express hackers guilty of violations of the Twitter account and website, but coordinated and overlapping amplification of the break-in through Iran-linked social media accounts suggests a relationship between hackers planting stories and accounts. trolls who publish them.
When hackers broke into Israel Hayom’s Twitter account to try to trick users into believing Trump is at the door of death and that Black Lives Matter comes after the Clintons, they slipped revealing regional content. that the Israeli government had discovered a Hezbollah submarine off Haifa.
When users pointed to the obviously fake content, a handful of Twitter accounts were launched into a coordinated defense of scenarios with copied and pasted chat issues to verify and defend against skeptics. Israeli forces!” and “We will have to settle for Hezbollah’s wonderful military capability that can annihilate Israel. “
Unconvincing and unsuccessful amplification attempts involve a series of similar hacking incidents involving propaganda trolls connected to Iran.
Twitter accounts fahad_alm1989 and jessica722225874, of which he claimed to be a former ABC News journalist, spent much of his short lifestyle sending spam links to an article published on Hidabroot, an Orthodox Jewish news and television organization founded in Israel.
The story, then erased and written in clumsy Hebrew, contained false quotes from an Israeli minister comparing Arab leaders to donkeys led as a result of the standardization agreement between Israel and the United Arab Emirates.
In an email to The Daily Beast, the site’s directors said it had been hacked before the fake story was published.
fahad_alm1989 also continuously sent spam mentions on Twitter from valid news organizations containing links to hacked tweets from Al Bilad, a Bahraini news organization that briefly lost its Twitter account in August and September. Tweets from Al Bilad’s compromised account have been deleted but, like Hidabroot’s Fake Story, screenshots captured at the time show that the account tweeted a complaint from the United Arab Emirates for normalizing diplomatic relations with Israel. In an Instagram post, Al Bilad showed that he had been hacked and subjected to a series of attempts at robbery in the hour.
It is unclear who is to blame for account theft amplified through Iran-linked trolls, but committing valid news sites to publish fabricated news articles is a resolution that expands fear of cybersecurity researchers, according to Lee Foster, senior director of data operations research at Mandiant Threat Intelligence.
“The commitment of valid news websites to publishing fabricated stories is a tactic we’ve noticed from stakeholders, and we’re increasingly involved in the perceived credibility of those sites and the direct success they have for a broad audience,” Foster said.
Drawing attention to pirated stories is not the only way Iran-linked trolls were looking for an idea of their propaganda. When hackers could not borrow genuine goods from the online page of a valid news agency or Twitter accounts, Iran-linked trolls simply imitated. other people to see to make their way into the audience
Among the goals of his identity theft crusade were Dr. Zeke Emanuel, brother of Obama’s White House staff leader, Rahm Emanuel, and president of the Department of Medical Ethics at the University of Pennsylvania. would be forced to obtain a remedy for COVID-19 in FEMA camps in a racist conspiracy narrative collected through accounts of pro-Iranian trolls.
“I didn’t have a Twitter account before that,” Emanuel told the Daily Beast in an email. “Someone congratulated me for accessing Twitter and this is the first time I’ve found out about the account. Frankly, identity theft is very good. “
Identity theft took place in mid-May, when pro-Iranian trolls were spreading a similar racist discourse about the pandemic, in the past reported through The Daily Beast. At the time, a story in the call of a true World Health Organization executive, mis-verified through the social media company, sparked a false conspiracy over the Trump administration that he was testing a coronavirus vaccine in black Americans, in an obvious reminder of Tuskegee’s reports, one of the darkest moments in American medical ethics.
Iranian trolls also became the leader of an Israeli hospital in an effort to embarrass Tajikistan’s president and son. The story passed through the executive director of a hospital in Herzliya to falsely claim that Rustam Emomali, the president of the National Assembly of Tajikistan and son of Tajikistan President Emomali Rahmon, had been treated for straight cancer in Israel. Emomali and the Tajik government denied the accusations and described them as “deliberate provocation. “
The genuine Israeli hospital official responded to requests for comment. Twitter suspended the fake account by impersonating him after The Daily Beast informed the company.
Relations between Iran and Tajikistan were reportedly strained after Tajikistan state television recently aired allegations of Iran-funded militants in central Asian country, a civil war in the 1990s.
Twitter has suspended 4 accounts discovered through The Daily Beast and FireEye, but has not yet connected them to a crusader or a larger player.
The accounts, which were mainly passed down by journalists, used a series of tricks attributed to Iranian actors, adding fake tweet amplifiers from hacked Twitter accounts used to criticize the United States and Saudi Arabia.
In June, hackers took over a missing Twitter account, @ArabiaNow, run by Qorvis Communications on behalf of the Saudi Arabian Embassy in Washington, D. C. , and used two false stories about the Trump Organization obtaining structure contracts in Saudi Arabia and Saudi Arabia is awarding contracts to Israeli cybersecurity company Checksecurity Point.
Qorvis responded to a request for comment from The Daily Beast.
All 4 accounts also tweeted forged domain names that intended to resemble the websites of valid news organizations in a form of a misinformation crusade known as Endless Mayfly. The University of Toronto Citizen Lab first met Endless Mayfly as a “misinformation activity that fakes genuine news websites with typographical errors, registering sites with spelling errors, to drive” critical narratives toward Saudi Arabia, the United States, and Israel. “
The counterfeit sites tweeted through the 4 suspended accounts resemble anything directly from Mayfly’s book of the game, with fake news sites, stories targeting the United States, Israel and Saudi Arabia, and their amplification has been spamted in genuine Twitter media responses. The sites, intended to look like genuine pages of The Independent Australia, Israel National News and Nouvelobs, used a misspelled URL and copied addresses from sites registered in high-level domain names to spread false stories about israeli Prime Minister Benjamin Netanyahu’s son. a false attempt at american-Israeli coup.
And although Twitter has not yet attributed all 4 accounts to a larger activity or player, the percentage overlaps with newly suspended accounts connected to Iran. In componentnticular, all 4 accounts amplified Zeke Emanuel’s fake account and Al Bilad’s Twitter hack. account, which excel in the activity of Iranian trolls attributed via Twitter, that is, they seem to be part of a broader and pro-Tehran disinformation campaign.