Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests

Original Post from FireEye
Author: Alice Revelli

In August 2018, FireEye Threat Intelligence released a report
exposing what we assessed to be an Iranian
influence operation
leveraging networks of inauthentic news
sites and social media accounts aimed at audiences around the world.
We identified inauthentic social media accounts posing as everyday
Americans that were used to promote content from inauthentic news
sites such as Liberty Front Press (LFP), US Journal, and Real
Progressive Front. We also noted a then-recent shift in branding for
some accounts that had previously self-affiliated with LFP; in July
2018, the accounts dropped their LFP branding and adopted personas
aligned with progressive political movements in the U.S. Since then,
we have continued to investigate and report on the operation to our
intelligence customers, detailing the activity of dozens of additional
sites and hundreds of additional social media accounts.

Recently, we investigated a network of English-language social media
accounts that engaged in inauthentic behavior and misrepresentation
and that we assess with low confidence was organized in support of
Iranian political interests. In addition to utilizing fake American
personas that espoused both progressive and conservative political
stances, some accounts impersonated real American individuals,
including a handful of Republican political candidates that ran for
House of Representatives seats in 2018. Personas in this network have
also had material published in U.S. and Israeli media outlets,
attempted to lobby journalists to cover specific topics, and appear to
have orchestrated audio and video interviews with U.S. and UK-based
individuals on political issues. While we have not at this time tied
these accounts to the broader influence operation we identified last
year, they promoted material in line with Iranian political interests
in a manner similar to accounts that we have previously assessed to be
of Iranian origin. Most of the accounts in the network appear to have
been suspended on or around the evening of 9 May, 2019. Appendix 1
provides a sample of accounts in the network.

The Network

The accounts, most of which were created between April 2018 and
March 2019, used profile pictures appropriated from various online
sources, including, but not limited to, photographs of individuals on
social media with the same first names as the personas. As with some
of the accounts that we identified to be of Iranian origin last
August, some of these new accounts self-described as activists,
correspondents, or “free journalist[s]” in their user descriptions.
Some accounts posing as journalists claimed to belong to specific news
organizations, although we have been unable to identify individuals
belonging to those news organizations with those names.

Narratives promoted by these and other accounts in the network
included anti-Saudi, anti-Israeli, and pro-Palestinian themes.
Accounts expressed support for the Joint Comprehensive Plan of Action
(JCPOA), commonly known as the Iran nuclear deal; opposition to the
Trump administration’s designation of Iran’s Islamic Revolutionary
Guard Corps (IRGC) as a Foreign Terrorist Organization; antipathy
toward the Ministerial to Promote a Future of Peace and Security in
the Middle East (a U.S.-led conference that focused on Iranian
influence in the Middle East more commonly known as the February 2019
Warsaw Summit); and condemnation of U.S. President Trump’s veto of a
resolution passed by Congress to end U.S. involvement in the Yemen conflict.

Figure 1: Sample tweets on the Trump
administration’s designation of Iran’s IRGC as a Foreign Terrorist Organization

Interestingly, some accounts in the network also posted a small
amount of messaging seemingly contradictory to their otherwise
pro-Iran stances. For example, while one account’s tweets were almost
entirely in line with Iranian political interests, including a tweet
claiming that “iran has shown us that his nuclear program is peaceful
[sic],” the account also posted a series of tweets directed at U.S.
President Trump on Sept. 25, 2018, the same day that he gave a speech
to the United Nations in which he excoriated the Iranian Government.
The account called on Trump to attack Iran, using the hashtags
#attack_Iran, #go_to_hell_Rouhani, #stop_sanctions, #UnitedNations,
and #trump_speech; other accounts in the network, which likewise
predominantly held pro-Iran stances, echoed these sentiments, using
the same or similar hashtags. It is possible that these accounts were
seeking to build an audience with views antipathetic to Iran that
could then later be targeted with pro-Iranian messaging.

Apart from the narratives and messaging promoted, we observed
several limited indicators that the network was operated by Iranian
actors. For example, one account in the network, @AlexRyanNY, created
in 2010, had only two visible tweets prior to 2017, one of which, from
2011, was in Persian and of a personal nature. Subsequently in 2017,
@AlexRyanNY claimed in a tweet to be “an Iranian who supported
Hillary” in a tweet directed at a Democratic political strategist.
This account, using the display name “Alex Ryan” and claiming to be a
Newsday correspondent, appropriated the photograph of a genuine
individual also with the first name of Alex. We note that it is
possible that the account was compromised from another individual or
that it was merely repurposed by the same actor. Additionally, while
most of the accounts in the network had their interface languages set
to English, we observed that one account had its interface language
set to Persian.

Impersonation of U.S. Political Candidates

Some Twitter accounts in the network impersonated Republican
political candidates that ran for House of Representatives seats in
the 2018 U.S. congressional midterms. These accounts appropriated the
candidates’ photographs and, in some cases, plagiarized tweets from
the real individuals’ accounts. Aside from impersonating real U.S.
political candidates, the behavior and activity of these accounts
resembled that of the others in the network.

For example, the account @livengood_marla impersonated Marla
Livengood, a 2018 candidate for California’s 9th
Congressional District, using a photograph of Livengood and a campaign
banner for its profile and background pictures. The account began
tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from
Livengood’s official account earlier that month:

Figure 2: Tweet by suspect account
@livengood_marla, dated Sept. 24, 2018 (left); tweet by Livengood’s
verified account, dated Sept. 1, 2018 (right)

The @livengood_marla account plagiarized a number of other tweets
from Livengood’s official account, including some that referenced
Livengood’s official account username:

Figure 3: Tweet by suspect account
@livengood_marla, dated Sept. 24, 2018 (left); tweet by Livengood’s
verified account, dated Sept. 3, 2018 (right)

The @livengood_marla account also tweeted various news snippets on
both political and apolitical subjects, such as the confirmation of
Brett Kavanaugh to the U.S. Supreme Court and the wedding of the UK’s
Princess Eugenie and Jack Brooksbank, prior to segueing into promoting
material more closely aligned with Iranian interests. For example, the
account, along with others in the network, commemorated the United
Nations’ International Day of the Girl Child with a photograph of
emaciated children in Yemen, as well as narratives pertaining to the
killing of Saudi journalist Jamal Khashoggi and Saudi Shiite child
Zakaria al-Jaber, intended to portray Saudi Arabia in a negative light.

In another example, the account @ButlerJineea impersonated Jineea
Butler, a 2018 candidate for New York’s 13th Congressional
District, using a photograph of Butler for its profile picture and
incorporating her campaign slogans into its background picture, as
well as claiming in its Twitter bio to be a “US House candidate,
NY-13” and linking to Butler’s website,

Figure 4: Suspect account @ButlerJineea
(left); apparent legitimate, currently inactive account
@Jineea4congress (right)

These and other accounts in the network plagiarized tweets from
additional sources beyond the individuals they impersonated, including
other U.S. politicians, about both political and apolitical topics.

Influence Activity Leveraged U.S. and Israeli Media

In addition to directly posting material on social media, we
observed some personas in the network leverage legitimate print and
online media outlets in the U.S. and Israel to promote Iranian
interests via the submission of letters, guest columns, and blog posts
that were then published. We also identified personas that we suspect
were fabricated for the sole purpose of submitting such letters, but
that do not appear to maintain accounts on social media. The personas
claimed to be based in varying locations depending on the news outlets
they were targeting for submission; for example, a persona that listed
their location as Seattle, WA in a letter submitted to the Seattle
subsequently claimed to be located in Baytown, TX in a
letter submitted to The Baytown Sun. Other accounts in the
network then posted links to some of these letters on social media.

The letters and columns, many of which were published in 2018 and
2019, but which date as far back as 2015, were mostly published in
small, local U.S. news outlets; however, several larger outlets have
also published material that we suspect was submitted by these
personas (see Appendix 2). In at least two cases, the text of letters
purportedly authored by different personas and published in different
newspapers was identical or nearly identical, while in other
instances, separate personas promoted the same narratives in letters
published within several days of each other. The published material
was not limited to letters; one persona, “John Turner,” maintained a
blog on The Times of Israel website from January 2017 to
November 2018, and wrote articles for the U.S.-based site Natural
News Blogs
from August 2015 to July 2018. The letters and
articles primarily addressed themes or promoted stances in line with
Iranian political interests, similar to the activity conducted on
social media.

Figure 5: Sample letter published in
Galveston County’s (Texas) The Daily News, authored by suspect
persona Mathew O’Brien

We have thus far identified at least five suspicious personas that
have had letters or other content published by legitimate news
outlets. We surmise that additional personas exist, based on other
investigatory leads.

“John Turner”: The John Turner persona has been active since at
least 2015. Turner has claimed to be based, variously, in New York,
NY, Seattle, WA, and Washington, DC. Turner described himself as a
journalist in his Twitter profile, though has also claimed both to
work at the Seattle Times and to be a student at Villanova
University, claiming to be attending between 2015 and 2020. In
addition to letters published in various news outlets, John Turner
maintained a blog on The Times of Israel site in 2017 and 2018
and has written articles for Natural News Blogs. At least one
of Turner’s letters was promoted in a tweet by another account in the network.

“Ed Sullivan”: The Ed Sullivan persona, which has on at least
one occasion used the same headshot as that of John Turner, has had
letters published in the Galveston County, Texas-based The Daily
, the New York Daily News, and the Los Angeles
, including some letters identical in text to those authored
by the “Jeremy Watte” persona (see below) published in the Texas-based
outlet The Baytown Sun. Ed Sullivan has claimed his location to
be, variously, Galveston and Newport News (Virginia).

“Mathew Obrien”: The Mathew Obrien persona, whose name has also
been spelled “Matthew Obrien” and “Mathew O’Brien”, claimed in his
Twitter bio to be a Newsday correspondent. The persona has had
letters published in Galveston County’s The Daily News and the
Athens, Texas-based Athens Daily Review; in those letters, his
claimed locations were Galveston and Athens, respectively, while the
persona’s Twitter account, @MathewObrien1, listed a location of New
York, NY. At least one of Obrien’s letters was promoted in a tweet by
another account in the network.

“Jeremy Watte”: Letters signed by the Jeremy Watte persona have
been published in The Baytown Sun and the Seattle Times,
where he claimed to be based in Baytown and Seattle, respectively. The
texts of at least two letters signed by Jeremy Watte are identical to
that in letters published in other newspapers under the name Ed
Sullivan. At least one of his letters was promoted in a tweet by
another account in the network.

“Isabelle Kingsly”: The Isabelle Kingsly persona claimed on her
Twitter profile (@IsabelleKingsly) to be an “Iranian-American” based
in Seattle, WA. Letters signed by Kingsly have appeared in The
Baytown Sun
and the Newport News Virginia local paper The
Daily Press
; in those letters, Kingsly’s location is listed as
Galveston and Newport News, respectively. The @IsabelleKingsly Twitter
account’s profile picture and other posted pictures were appropriated
from a social media account of what appears to be a real individual
with the same first name of Isabelle. At least one of Kingsly’s
letters was promoted in a tweet by another account in the network.

Other Media Activity

Personas in the network also engaged in other media-related
activity, including criticism and solicitation of mainstream media
coverage, and conducting remote video and audio interviews with real
U.S. and UK-based individuals while presenting themselves as
journalists. One of those latter personas presented as working for a
mainstream news outlet.

Criticism/Solicitation of Media Coverage

Accounts in the network directed tweets at mainstream media outlets,
calling on them to provide coverage of topics aligned with Iranian
interests or, alternatively, criticizing them for insufficient
coverage of those topics. For example, we observed accounts
criticizing media outlets over their lack of coverage of the killing
of Shiite child Zakaria al-Jaber in Saudi Arabia, as well as Saudi
Arabia’s conduct in the Yemen conflict. While such activity might have
been intended to directly influence the media outlets’ reporting, the
accounts may have also been aiming to reach a wider audience by
tweeting at outlets with a large following that woud see those replies.

Figure 6: Sample tweets by suspect
accounts calling on mainstream media outlets to increase their
coverage of alleged Saudi activity in the Yemen conflict

“Media” Interviews with Real U.S., UK-Based Individuals

Accounts in the network, under the guise of journalist personas,
also solicited various individuals over Twitter for interviews and
chats, including real journalists and politicians. The personas appear
to have successfully conducted remote video and audio interviews with
U.S. and UK-based individuals, including a prominent activist, a radio
talk show host, and a former U.S. Government official, and
subsequently posted the interviews on social media, showing only the
individual being interviewed and not the interviewer. The interviewees
expressed views that Iran would likely find favorable, discussing
topics such as the February 2019 Warsaw summit, an attack on a
military parade in the Iranian city of Ahvaz, and the killing of Jamal Khashoggi.

The provenance of these interviews appear to have been
misrepresented on at least one occasion, with one persona appearing to
have falsely claimed to be operating on behalf of a mainstream news
outlet; a remote video interview with a US-based activist about the
Jamal Khashoggi killing was posted by an account adopting the persona
of a journalist from the outlet Newsday, with the
Newsday logo also appearing in the video. We did not identify
any Newsday interview with the activist in question on this
topic. In another instance, a persona posing as a journalist directed
tweets containing audio of an interview conducted with a former U.S.
Government official at real media personalities, calling on them to
post about the interview.


We are continuing to investigate this and potentially related
activity that may be being conducted by actors in support of Iranian
interests. At this time, we are unable to provide further attribution
for this activity, and we note the possibility that the activity could
have been designed for alternative purposes or include some small
percentage of authentic behavior. However, if it is of Iranian origin
or supported by Iranian state actors, it would demonstrate that
Iranian influence tactics extend well beyond the use of inauthentic
news sites and fake social media personas, to also include the
impersonation of real individuals on social media and the leveraging
of legitimate Western news outlets to disseminate favorable messaging.
If this activity is being conducted by the same or related actors as
those responsible for the Liberty Front Press network of inauthentic
news sites and affiliated social media accounts that we exposed in
August 2018, it may also suggest that these actors remain undeterred
by public exposure or by social media platforms’ shutdowns of their
accounts, and that they continue to seek to influence audiences within
the U.S. toward positions in line with Iranian political interests.


Appendix 1: Sample Twitter accounts identified in this network,
currently suspended.


Display Name


Creation Date



Michael Anderson

Free journalist #resist




Sam Michelson


In search of reality.






Jason Campbell

It’s our duty to leave our Country-to our
children-better than we found it




Sara Martin





Lisa Brown





Jennifer Parker





Susan Scott

Don’t think too hard, just have fun with




Linda Jackson

I drink lots of tea…




Mark Adams








New York








Very angry

mad at politicians

favor of sick minds


North Carolina, USA


Jenny Mick



mother of


Pennsylvania, USA


Jane Anton

Daughter of best parent.


your best, just let your success shows your efforts.


California, USA


Antonio Rabin

Student at Harvard college.

somehow into

I love gym




Angel of human

I do into beauty and humanity


California, USA


Alicia Hernan

Wife, mom of tow sons, student,

in favor
of peace.


New York, USA


Thomas Race


sports and into Music and


Michigan, USA


Emma Wilkerson

Student in college  studying International


Sunnyvale, CA



free person from everywhere

I’m somehow into


New York, USA


Iman Rashed

Correspondent at 
🎥📸Freelance Journalist.    ➡️➡️oppose War and Brutality
💆‍♂️I was born in Beirut




emily anderson

In search of peace.

Really into politics
and justice.

Love US and other countries.


New York, USA


naava ford





maaz ross

follow back





high educated free journalist in favor of

in search of reality

Middle East


New York, USA


Jineea Butler

US House candidate, NY-13


U.S. Congressional Candidate for NY District
13 serving Harlem, Washington Heights and Western Bronx.US


Anya Tynio





Marla Livengood






save the US


Washington, DC


Elizabeth Warren not for 2020

Single. Iranian-American. Lifestyle.And a
tad of politics. @ewarren not for 2020.


Seattle, WA


Mathew Obrien

A single boy,@Newsday correspondent ,
interested in news Scientist🔬. Animal 🐘 and Nature lover🌲,
hiker and backpacker♍   .


New York, NY



The fight for human rights never sleeps,
standing up for human rights across the world, wherever
justice, freedom, fairness and truth are denied.


New York, USA


ashley cohen

follow me to get follow back


Arizona, USA


josef sanchez





jan guillou










rajat sharma





Suzan Nicholson

follow me to get follow back


Las Vegas, NV


diana culi





guillem balague





habib ayyoub





James Anderson

No Magats 🚫, 🔥 Anti War & Hate, Pro
Equality, Humanity, Humor & Sensible Gun Reform


New York, USA


John H.T

Journalist. RTs Are not necessarily
endorsements. All views my own. #Resist


Washington, USA


Alex Ryan

New Yorker, @Newsday correspondent.

don’t have a soul. You are a Soul. You have a body.


New York, USA

Table 1: Sample Twitter accounts identified in
this network

Appendix 2: Sample letters published in news outlets submitted by
personas identified in this network, August 2018 to April 2019.



Author’s Listed Location



Aug. 1, 2018



The Baytown Sun (

Title: “Trump’s wall just a vanity project”

letter argues against the Trump administration’s proposed
border wall with Mexico. The text of the letter is identical
to that published in Galveston County’s The Daily News
( on Aug. 4, 2018, three days later.

Aug. 4, 2018



Galveston County’s The Daily News

Title: “Trump cares not one wit about effects of

The text of the letter is identical to that
published in The Baytown Sun on Aug. 1.

Oct. 11, 2018



The Baytown Sun (

Title: “Time to fight for it”

The letter,
written from the point of view of an individual aligned with
the U.S. political left, calls on individuals to fight for

Oct. 23, 2018


Newport News

New York Daily News (

Title: “Don’t shrug off Khashoggi’s murder”

letter argues that “the most fitting and best memorial to
Jamal Khashoggi,” a Saudi journalist who was murdered in the
Saudi embassy in Istanbul, “would be the swift end to the war
in Yemen.”

Oct. 23, 2018


Newport News

Los Angeles Times (

Title: “Don’t shrug off Khashoggi’s murder”

letter is identical to that published in the New York Daily
News on the same day.

Nov. 27, 2018


New York, NY

Times of Israel (

Title: “Saudi Arabia’s foreign policy is failing”

The letter states that the murder of Jamal Khashoggi is
“the latest in a series of foreign policy blunders” committed
by the Saudi Crown Prince Mohammed Bin Salman.

Nov. 30, 2018


New York, NY

Times of Israel (

Title: “Relations with Israel will not benefit Gulf

The letter argues that the Gulf states will
not benefit from normalized relations with Israel, stating
that “the Arab street” would not support those relations and
that such a move would be risky for “the Gulf’s unelected

Dec. 26, 2018

Isabelle Kingsly


The Baytown
Sun (

Title: “Wild West sheriff”

The letter argues
that Trump is not an aberration in U.S. history, but rather an
ideological descendant of various U.S. historical currents;
the article also calls him “an authoritarian, racist

Jan. 18, 2019



Seattle Times (

Title: “ISIS’ ideology not defeated”

The letter,
written in response to an article about Americans killed by an
ISIS suicide bomber in Syria, asserts that the Islamic
extremist ideology espoused by the terrorist group remains

March 1, 2019



The Baytown Sun (

Title: “Sins of Saudi Arabia”

The letter is
condemnatory of Saudi Arabia, citing its actions in the Yemen
conflict, the killing of Jamal Khashoggi, the killing of
Zakaria al-Jaber, a Shiite child, in Medina, and the
imprisonment of Saudi women activists. The letter also defends
Iran, stating that it is not responsible for similar

April 9, 2019



Galveston County’s The Daily News

Title: “Sanctioning Islamic corps is pure madness”

The letter condemns the Trump administration’s designation
of the IRGC as a Foreign Terrorist Organization and claims
that Trump is seeking to start a war with Iran.

April 11, 2019

Matthew Obrien


Athens Daily
Review (

Title: “Trump, Bolton trying to start war with

The letter, similar to the April 9 letter
published in Galveston County’s The Daily News, claims that
Trump and Bolton are trying to start a war with Iran to use
the war in Trump’s 2020 presidential campaign, while
disregarding the alleged crimes of Saudi Arabia.

April 11, 2019

Isabelle Kingsly

Newport News

Press (

Title: “An uneasy path – Re; Recent Iran sanction

The letter also argues that Trump and Bolton
are seeking to start a war with Iran toward political

April 19, 2019

Jeremy Watte


The Baytown
Sun (

Title: “Escalating hostility toward Iran”

letter argues that the election of Trump to the U.S.
presidency has set the U.S. on a dangerous course and condemns
the U.S. withdrawal from the Iran nuclear deal (JCPOA),
stating that “the ayatollahs have welcomed this abrogation of
honor on Trump’s part.”

April 23, 2019



Galveston County’s The Daily News

Title: “Escalating hostility toward Iran is wrong,

The text of this letter is nearly
identical to that authored by Jeremy Watte and published in
The Baytown Sun on April 19, excepting changes made in several

Table 2: Sample letters published in news
outlets submitted by personas in this network

Go to Source
Author: Alice Revelli

Leave a Reply

Your email address will not be published. Required fields are marked *

WordPress Appliance - Powered by TurnKey Linux