Facebook, operating on a tip from the threat intelligence company FireEye who authored the research, announced on Tuesday that it had removed 51 accounts, 36 pages, and seven groups, as well as three Instagram accounts that it believed were part of the same campaign.
The New York Daily News and Seattle Times didn’t immediately respond to requests for comment.
After this story was published, Hillary Manning, the Los Angeles Times’s vice president of communications, told CNN that the letter to the editor published on her paper’s site “appears to have been generated through the content management system we currently use” and they have removed it from their site.
In a statement, Twitter said it has removed at least 2,800 inauthentic accounts from Iran since May, though it wasn’t privy to the specifics of the FireEye report.
Lee Foster, the author of the FireEye study, was careful to stress that his research only showed that the campaign was coordinated to support Iran’s goals, and stopped short of tying it to the Iranian government.
Facebook, however, was confident concluding that the campaign was conducted from within Iran’s borders, Nathaniel Gleicher, the company’s head of cybersecurity policy, said on a call with reporters.
“We can prove” the operation was conducted in the country, Gleicher said, though he declined to share specifics, citing a desire to keep the people who run such campaigns from learning how Facebook researches them.
“This Iranian active measures campaign shows that third-party adversaries have learned a lesson from 2016, disinformation works, and it works best when combining social media with old-school local newspaper outreach,” Thomas Rid, a professor at Johns Hopkins who studies government disinformation campaigns, told CNN.
“Whether this lesson is accurate is another question,” he said.