Treadstone 71, LLC, the cyber intelligence and counterintelligence company, today released details of an Iranian intelligence-backed influence operation.
“The Islamic Revolutionary Guard Corps (IRGC) and Ministry of Intelligence and Security (MOIS) joint operation targeted Iranian dissident groups using a timely and coordinated campaign of disinformation. The IRGC Cyber Units triggered core team members with military precision aimed at the National Council of Resistance of Iran (NCRI) annual online conference,” said Jeff Bardin, Chief Intelligence Officer at Treadstone 71. “The IRGC, MOIS, and low-level Basij Cyber Units flooded Twitter with nearly one hundred twelve thousand tweets over sixty hours using hashtags and content intent on controlling the social media narrative.”
Treadstone 71 observed IRGC Cyber Unit members playing an essential role in managing the campaign, ensuring specific hashtags trended in Iran and globally. At least nine other accounts belonging to IRGC Cyber Units helped expand the movement in different social environments. Core campaign members portrayed themselves as “monarchist,” “reformist,” or “regime change advocates” on various social media platforms.
Key features of the disguised social media accounts include young women personas attracting unsuspecting users for messaging expansion and potential collaboration.
Tactics shared by campaign members:
– Limited postings by campaign leadership designed to protect IRGC and MOIS social media accounts.
– Keywords used to trigger the influence operation.
– Hashtag repetition and cloning by nearly 25,000 Twitter users
– The use of bots and fake accounts with low followership.
– Core members using Twitter for a “Dunbar’s Number” style net call notification to trigger the campaign.
– Anonymous Telegram bots for confidential communications.
Source » prnewswire