Facebook takes down troll farm linked to Iranian opposition group

Facebook on Tuesday announced it had removed 14 networks in 11 countries for using fake accounts to amplify deceptive campaigns, including one linked to an exiled militant Iranian group operating a troll farm out of Albania.

The social media giant took down 1,167 Facebook accounts, 290 Instagram accounts, 255 Pages, and 34 Groups in the month of March for their connections to these "coordinated inauthentic behavior" campaigns, which targeted a range of countries including Israel, Mexico, Benin, and Georgia.

Facebook also highlighted in its report that three groups it took action against were using profile photos likely generated by machine learning technologies. It had removed four other groups using similar techniques since September 2019. The company said it can often easily recognize these photos through telltale errors, like unnaturally distorted backdrops or facial features—one image the company included showed glasses that had asymmetrical frames with different legs, hinges, and connections on each side. Although theses images can be automatically spotted, they show how malicious actors are adopting new tactics and techniques to try to improve their campaigns.

"We’ve seen actors shift tactics to avoid detection," said Nathaniel Gleicher, the company's Head of Security Policy. "Actors are trying [to conceal their operations] but are getting caught sooner."

Taking down a troll farm

One campaign that Facebook provided an in-depth analysis of was a troll farm operated out of Albania linked to the exiled Iranian opposition group Mojahedin-e Khalq. The company said it took down 128 accounts, 41 Pages, 21 Groups, and 146 Instagram accounts linked to the operation, which primarily targeted an Iranian audience.

Ben Nimmo, Facebook's Global Influence Operations Threat Intelligence Lead, said the operation started in 2016 and peaked in activity in 2017. Activity "fell off steeply" in 2018 and 2019, but Facebook noticed an uptick in the second half of 2020 and began investigating the activity. What they found was the markings of a traditional troll farm: a pool of several hundred accounts run from a single location with a shared technical infrastructure. The accounts even operated on a schedule, posting seven days a week, generally between 6am and 7pm local time, with a break around midday. "Even trolls need to eat," said Nimmo.

Nimmo added that it was difficult to know the full reach of the operation or how many human actors were involved, but they amassed a following of around 120,000 globally.

The MEK was founded in the 1960s as a leftist group that opposed Iran's monarchy and fought alongside the Islamic Revolutionary Guard Corps to overthrow the U.S.-backed Shah. Following the Iranian revolution, the IRGC cracked down on the group, which reestablished its base in Iraq with support from Saddam Hussein. The group was designated a terrorist organization in 1997, but the Obama administration removed the designation in 2012.

Since then, the group has advocated for regime change in Iran, and has cultivated high-profile allies in the U.S., including Rudy Giuliani and former Trump national security advisor John Bolton.

It's not the first time that the group has been spotted for running troll social media operations. In 2019, The Intercept outed a Twitter account with more than 80,000 followers for being a fake persona operated by a team of four MEK social media trolls. The fake persona contributed to several media outlets, including Forbes, The Hill, and The Daily Caller. Twitter suspended the account following the report, and several sites removed the author's byline.

On Facebook, the operation posted primarily in Farsi, with some posts in Arabic and English, the company said. In addition to using profile photos generated by machine learning technology, the operation made use of photos of prominent people, including a famous Iranian poet.

However, Facebook said "despite the high volume of posts and comments, most of the operation's activity achieved little to no audience visibility," while its Instagram accounts—which performed slightly better—averaged just over 700 followers each. In a press call, Gleicher attributed the poor performance to automated removal of some accounts early on, as well as other measures the company has taken to make it difficult to conceal such operations.