Groups connected with the Iranian government have increased their attempts to influence this year’s U.S. presidential election, with some reportedly creating fake news sites targeting voter groups on both the far left and right. One site claims it is reporting news from the city of Savannah.
A Friday report from Microsoft’s Threat Analysis Center found groups have laid the groundwork for influence campaigns on trending election-related topics to stir up controversy or sway voters as November nears.
A network of four websites masquerading as news outlets engaging voter groups on opposite ends of the political spectrum has also emerged. These sites contain messaging on LGBTQ issues, the Israel-Hamas conflict and the U.S. presidential candidates. Microsoft also found evidence that these sites are using artificial intelligence-based tools to plagiarize some of their content from U.S. publications.
One site, called Savannah Time, claims to be a “trusted source for conservative news in the vibrant city of Savannah.”
An “About Us” box on the Savannah Time website lifts a slogan from conservative news website The Daily Wire: “We’re opinionated, we’re noisy, and we’re having a good time.”
The site focuses on Republican politics and LGBTQ issues, including sex reassignment, and bills itself as “delivering accurate, insightful, and locally relevant news coverage that aligns with conservative values and principles.” It claims that it is “more than just a news outlet; it’s a reflection of the values that make Savannah unique.”
The Savannah Time website has a few peculiarities. Each post has view counts that increase by exactly 13 views every time the web page is refreshed. Its local news section does not contain posts about Savannah, but rather national trending news. There are several published interviews with conservative pundit Michael Barone, but it is unclear if they are fabricated. Barone did not respond to request to confirm if the interviews were real.
State Rep. Ron Stephens and state Sen. Ben Watson, Republicans who represent Savannah, both told The Atlanta Journal-Constitution they had never heard of the website. Nor had several other Savannah civic, business and political leaders.
A majority of voters in Chatham County, where Savannah is located, supported Joe Biden in the 2020 presidential election. Biden won the state of Georgia by fewer than 12,000 votes that year over then-President Donald Trump. This year’s election between Trump and Vice President Kamala Harris is expected to be very close.
The Microsoft report also listed examples of Iranian groups fabricating information, impersonating figures and launching cyberattacks against institutions and candidates.
One group known for impersonating social and political activist groups to stoke chaos and doubt about election integrity, began staging their operations in late March, according to MTAC. Another group linked to the Islamic Revolutionary Guard Corps (IRGC) sent phishing emails to a high-ranking official of a presidential campaign from the compromised email account of a former senior adviser. Days later, the same group unsuccessfully attempted to log into an account belonging to a former presidential candidate. A separate group linked with the IRGC compromised a user account at a county-level government in a swing state with an unknown motive, the report said.
Another site, called Nio Thinker, caters to liberal audiences. The site’s early articles focused on the Israel-Hamas conflict, but stories have shifted broadly to climate change, immigration and the presidential election. It bills itself as “your go-to destination for insightful, progressive news and analysis that challenges the status quo.” This site does not have a location.
MTAC said in the report that it hasn’t observed significant social media traction of these sites, though it is possible engagement will increase closer to election day.
Iranian cyber-enabled influence operations have appeared in the last three U.S. election cycles, according to the MTAC report. Compared with Russian campaigns, Iran’s operations appear later in the election season and employ cyberattacks geared more toward election conduct than swaying voters.
MTAC also said it has seen all actors incorporating AI content in their operations. But many are pivoting back to techniques that have proven effective in the past, including simple digital manipulations and mischaracterization of content.
Politically motivated websites disguised as independent local news organizations — sometimes called “pink slime” websites — have existed for at least 10 years. They often appear ahead of elections in places that have swing congressional districts, and present candidates and policies favored by the entities funding the website in a favorable light. Many of the articles are computer-generated, according to a Columbia Journalism Review report from 2019.
At least 1,265 websites are masquerading as local news for political purposes or have connections to dark money, according to a June report from misinformation tracking company NewsGuard. This is more than the number of daily local newspapers in the U.S., which at the time was 1,213, as reported by Axios.
-Adam Van Brimmer contributed to this report.
About the Author
