Pro-Soleimani messaging immediately floods Twitter following general's death in drone strike

One Twitter hashtag was mentioned 95,000 times in three days, after receiving zero attention in the prior month.

The U.S. drone strike that killed Iran’s top security and intelligence commander also triggered a wave of social media propaganda apparently meant to sway international opinion on an attack that represents a dramatic escalation in the conflict between Washington and Tehran.

Twitter accounts claiming to be located in Iran and throughout the Middle East pushed out many thousands of tweets under a handful of hashtags, such as #HardRevenge and #DeathToAmerica, promising payback against the U.S. for President Donald Trump’s order to eliminate the Iranian commander. The #HardRevenge hashtag was included in 95,000 tweets between Jan. 1 and Jan. 3, according to Kanishk Karan, a researcher at the Atlantic Council’s Digital Forensics Research Lab. There were zero mentions in all of December 2019, Karan said.

The wide availability of propaganda again highlights the difficulty that social media platforms encounter when trying to keep pace with such fraught geopolitical events. Often, social media campaigns are designed to exploit existing divisions in U.S. public opinion, and may coincide with other disruptions, like cyberattacks.

Whether some or all of the posts were the result of a planned social media campaign also was not immediately clear, though the sudden #HardRevenge activity “seems like a collaborative and coordinated effort,” Karan said.

As a general in the Islamic Revolutionary Guard Corps, Qassem Soleimani served as the architect of Iranian military networks operating in Iraq, Syria and Lebanon. He was killed Friday when a U.S. MQ-9 Reaper drone fired missiles into an automotive convoy that was leaving Baghdad’s International Airport early on Jan. 2.

Most of the tweets with the #HardRevenge hashtag seemed to amplify the same images of Soleimani, often shown in a military uniform in front of a flag, or alongside Iran’s Supreme Leader, Ayatollah Khamenei. It was not immediately clear whether the accounts were controlled by real people or automated bots, Karan added.

Users tweeted in a variety of languages, including English, Arabic and Farsi, to follower counts ranging from one or two to more than 3,500, in some cases.

Many of the accounts were created only in recent months, as tension between the U.S. and Iran grew. Often, they used Soleiman’s image as their profile picture, while some tried to spread pictures of U.S. military personnel with targets on their faces. Other posts included vivid depictions of mutilated bodies, with users claiming, without evidence, the images depicted Soleimani’s remains.

“Using technology and human review in concert, we proactively monitor Twitter to identify attempts at platform manipulation and mitigate them,” a Twitter representative said in a statement. “We have clear rules in place to address threats of violence, abuse and harassment, and hateful conduct. We will take action when we identify accounts that violate these rules.”

The company in June 2019 removed 4,779 accounts it said we linked to the Iranian government. Most of those accounts tweeted international news stories with an angle that portrayed the government in a positive light, while others were focused on engaging in conversations about Israel, and another subset used false identities to target global conversations about Iran, Twitter said at the time.

Posts on Instagram also appeared, containing graphic images of a beheaded Trump and messages instructing the U.S. to “prepare the coffins,” along with images of flag-covered caskets.

This activity comes after suspected Iranian operatives have spent years experimenting with new kinds of online propaganda and disinformation. One campaign involved an Iranian-aligned entity spreading fabricated news articles by posting them on websites that masqueraded as well-known, credible news outlets. The group, unveiled last year by the University of Toronto’s Citizen Lab, used websites like “theatlatnic.com,” rather than “theatlantic.com” to promote anti-Saudi articles that sometimes would gain traction on social media.

“The campaign was neither strikingly clever nor particularly sensitive to the culture of the intended audience,” the report said at the time. “However, it eluded blocking and detection for years, generated some social media engagement and achieved a few successful cross-overs into mainstream news.”

Update, Jan. 3, 8:13 pm ET: This story has been updated to include comment from Twitter. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems