An Israeli cyber-security company uncovered three Hebrew news sites as Iranian hack schemes.
ClearSky Cyber Security unveiled that the sites, including the Tel Aviv Times Hebrew news site, were operated from Iran as part of a "fake news" influence campaign.
Tel Aviv Times receives 65,000 surfers per month, according to SimilarWeb.
The sites run by Iran in Hebrew are part of an extensive international campaign, which, according to ClearSky, has reached hundreds of thousands and possibly millions of people around the world.
- How Iran Operates a Sprawling Worldwide Disinformation Network
- Iranian Hackers Tried to Impersonate Israeli Cyber-security Company
- Hamas' Cyber Honeypot Exposes Israeli Weakness and Tech Giants' Complicity
Recently, Reuters reported that it had found similar activity in 10 different sites and 11 different languages. ClearSky was among two cyber companies that confirmed the findings Reuters reported last month.
In addition to Reuters' report, Haaretz also exposed a similar network operated by Iranian elements to promote another phishing site.
The second company was FireEye, which recently published its own report on the subject, and explained that the company's new report completes the image of the global Iranian phishing system.
The network includes hundreds of fake news sites, of which about 100 are currently active phishing sites and hundreds of fake accounts established on social networks (Facebook, Twitter, Telegram, Instagram, YouTube) that "support" these sites, FireEye said.
The company added in their report that the disinformation campaign regularly spread false information to 30 countries in more than 18 languages.
ClearSky's report said that the Iranian propaganda system has been operating in dozens of countries for more than six years. They added that in the early stages of its establishment, it promoted Iranian interests mainly in the Middle East in countries such as Turkey, Egypt and Afghanistan. According to the company, these countries are considered by Iran to be "first target" countries for disseminating the ideas of the Islamic revolution and the "Vilayat-e Faqih" – referring to Iran's Supreme Leader, Ali Khamenei. In 2014, the Iranians expanded the goals and established new news sites for every country and body that interest Iran.
According to the researchers, the sites serve different purposes in different regions. In the Middle East and North Africa, the sites disseminate disinformation on issues relevant to Iran. The researchers believe that the main goal of the campaign is to present Iran in a positive light, as a balancing state in the region, while presenting Saudi Arabia and Israel as countries that violate peace and order in the subcontinent.
Sites such as Tel Aviv Times, which operate in countries in conflict with Iran, are also used to deter the public, the company added.
The site, which copies a significant portion of its reports from legitimate news sites such as Israel Hayom, Makor Rishon and Kipa, deals not only with issues that are close to Iran's heart, but masquerades as a news site covering all areas, including sports, entertainment and technology. When the site's editors deal with issues that are relevant to Iran, they copy the reports from regular websites, but make minor changes in the headlines to adapt them to their goals.
An example of this can be found in an article on the commander of the Revolutionary Guards’ Quds force, Qassem Soleimani, which was copied from Israel Hayom and based on an interview with Soleimani, in which he referred to the Trump government's threats against Iran. The site's administrators intensified the contents of the article, apparently to increase the threat to Israel.
ClearSky's report said that the fake article contained in-depth content on Soleimani's remarks and presented quotes that did not appear in the original article. The company also notes that the fake article contained more accurate information about the roles of the sources quoted in the article, showing deeper acquaintance with the subject. The fake article also included quotes from a speech Soleimani gave that had not appeared in the original article, the researchers wrote.
ClearSky said that the infrastructure targeting Israel is supported by 14 fake profiles on Facebook and 11 fake profiles on Twitter, all of which are still active, and includes Facebook pages with tens of thousands of followers, Twitter accounts and Instagram.
One of the Tel Aviv Times Facebook pages says that the organization operates from Washington, United States, but its phone number has an Ireland country code. Haaretz tried calling the number, but the line was disconnected.