Iranian Influence Operations - July 2020

Treadstone 71 monitors Iranian cyber and influence operations. On July 17, 2020, we noticed spikes in Twitter activity surrounding specific hashtags. The primary hashtag (مريم_رجوي_گه_خورد ) targeted Maryam Rajavi. For example, Maryam Rajavi is the leader of the People's Mujahedin of Iran, an organization trying to overthrow the Iranian government, and the President-elect of its National Council of Resistance of Iran (NCRI).[1] July 17, 2020, represents the #FreeIran2020 Global Summit online for the NCRI. The below report represents our assessment of an Iranian influence operation targeting the July 17, 2020 event.

Assessment

Treadstone 71 assesses with high confidence that the Iranian government, likely the Ministry of Intelligence and Security (MOIS) using Basiji cyber team members, executed an influence operation targeting the NCRI and the July 17, 2020, online conference.

 The intent of the 111,770 tweets likely included:[2]

• The need to present malicious content about the NCRI during the summit.
• Preventing in-country Iranian citizens from seeing NCRI content.
• Causing chaos and confusion amongst NCRI members and Iranian citizens.
• Emphasize divisions amongst content viewers.
• Hashtag cloning to control the narrative.

The MOIS effort is seemingly disjointed but, in fact, is a highly coordinated disinformation campaign. The program involves many fake accounts posting hundreds of tweets during a specific time. The posts use hashtags and direct targeting of political figures to gain maximum attention and, subsequently, more retweets.