Facebook Inc, Twitter Inc and Alphabet Inc collectively removed hundreds of accounts tied to Iranian actors that a cybersecurity firm said on Tuesday were promoting Iran's geopolitical agenda around the world.
Facebook has identified and banned more accounts engaged in misleading political behaviour ahead of the US midterm elections in November.
The social network said on Tuesday that it had removed 652 pages, groups, and accounts linked to Russia and, unexpectedly, Iran, for "coordinated inauthentic behaviour" that included the sharing of political material.
Facebook has significantly stepped up policing of its platform since last year when it acknowledged that Russian agents successfully ran political influence operations on Facebook aimed at swaying the 2016 presidential election.
The social network said it had not concluded its review of the material and declined to say how or why the state-backed actors were behaving the way they did. But it said it has informed the US and UK governments as well as informed the US Treasury and State departments because of ongoing sanctions against Iran.
"There's a lot we don't know yet," CEO Mark Zuckerberg said on a hastily called conference call with reporters on Tuesday afternoon.
Investigations involving Iran and Russia
Facebook said the actions to remove the pages, groups and accounts on Tuesday morning were the result of four investigations, three involving Iran, and one involving Russia.
The first involved a group called "Liberty Front Press" that set up multiple accounts on Facebook and Instagram that were followed by 155,000 other accounts. The group was linked to Iranian state media based on website registrations, IP addresses and administrator accounts, Facebook said. The first accounts were created in 2013 and posted political content about the Middle East, the UK, and the US, although the focus on the West increased starting last year, Facebook said.
FireEye, a cybersecurity firm that alerted Facebook to the "Liberty Front Press" group, called it an influence operation apparently aimed at promoting Iranian political interests "including anti-Saudi, anti-Israeli, and pro-Palestinian themes" and support for the US-Iran nuclear deal.
President Donald Trump withdrew the US from that agreement earlier this year.
While that group did not appear to be attempting to influence the US midterms, FireEye said its analysis "does not preclude such attempts being made." Several social media personas it found related to the group masqueraded as liberal US activists who supported Sen. Bernie Sanders.
Facebook disrupted hack attempts
The second group also had multiple accounts and 15,000 followers. The group was linked to "Liberty Front Press" and attempted to hack people's accounts to spread malware. Facebook said it disrupted those attempts.
A third group also operated out of Iran had as many as 813,000 followers, and also shared political content about the Middle East, the UK and US.
In all the Iranian-linked groups spent some $12,000 in advertising and hosted 28 different events.
A fourth group that attempted to influence politics in Syria and the Ukraine was connected to sources that Facebook said the US had linked to Russian military intelligence.
"We're working closely with US law enforcement on this investigation," Facebook said in a blog post.