In all, Citizen Lab said it had identified 73 web domains created by the group, 135 ersatz articles it had posted and 11 fake identities like Mona A. Rahman, often used as bylines on the fake articles. Some of the articles had been previously flagged as false by reporters and researchers, who sometimes pointed at Russia as the likely culprit. But the overall operation has not previously been described and linked to Iranian interests.
The group appears to still be active, according to Citizen Lab, though most of its operation has been shut down. “On the surface, they look like a not-very-successful viral advertising campaign,” said John Scott-Railton, a senior researcher at Citizen Lab.
But the fabricated article on Israeli politics impressed a former senior Israeli intelligence official, who spoke on the condition of anonymity. The fake article concocted by the group quoted Tamir Pardo, a former director of Mossad, the Israeli intelligence agency, as saying in a talk at Harvard that Avigdor Lieberman, Israel’s defense minister, had been dismissed by Prime Minister Benjamin Netanyahu after it was discovered that he was a Russian mole.
The fabricated article was spread on Nov. 14, 2018, through a Twitter account for “Bina Melamed,” a common Israeli name.
In fact, Mr. Lieberman had just resigned in protest of a cease-fire ending fighting in Gaza, and Mr. Pardo had just spoken at the Belfer Center. The rest of the article was an invention. But the former Israel official said he was struck by the overnight creation of the fake Harvard website and the “superfast reaction to events.”
“It shows an admirable understanding of the online world,” the official said. Months later, a search on the web for the bogus headline still turns up a few hits.
For Mr. Al-Ahmed, the Saudi critic in Washington, the Citizen Lab research simply underscored the hazards for activists online. In what appears to have been a separate operation last year, he was contacted by a woman posing as a BBC journalist who asked to interview him; she, too, turned out to be a fraud.