This is a state-aligned actor best known by the name of its major persona, IUVM, the "International Union of Virtual Media", which primarily amplifies Iranian regime messaging but poses as independent.

We did a deep dive into it at @DFRLab last year. https://medium.com/dfrlab/trolltracker-an-iranian-messaging-laundromat-218c46509193
IUVM is based on websites, so they have the infrastructure to keep on trying.

They came to coronavirus relatively late - end of February - but when they did, there were a few core narratives.

1) Blame America.

Surprised?
One IUVM piece suggested that the U.S. was to blame for coronavirus because it was accused of creating AIDS back in the 1980s.

That was the original Soviet "Operation INFEKTION." Still doing the rounds today.
IUVM likes its memes. This one sums up the narrative pretty vividly.
Second theme: attack the Western media.

A common approach that we've seen in disinfo operations before: blame bad news on "bad journalists".

One story accused the BBC of a disproportionate focus on Iran, but...
... if you freeze the frame and enlarge the shot, you'll see they actually refer to @bbcpersian, for whom focusing on Iran is pretty much their job.
Another story headlined the U.S. being in "panic", but it was actually a copy-paste from @Reuters with a scare headline added.

No mention of panic in the actual article.
There was another angle to the geopolitics, too. A slew of memes thanked the Chinese people for their help.

The timing was interesting. A month after Chinese aid started to arrive, but just four days after the U.S. said that America aid to Iran was not sanctioned.
Of course, posting on websites doesn't get you very far.

We found a bunch of suspected IUVM assets on various platforms, mostly created between late Jan and late Feb.

Here, for example, one account on @instagram.

Note the lack of reaction. Life's hard for a newborn account.
We found a handful of assets on @Facebook. Combined following, a few hundred. Compare that with the ~200,000 of the first takedown in 2018.

This is why it's so important to expose and explain info ops. The more people start looking for them, the harder it is to hide.
Their timelines were full of content like this: messaging from IUVM or Iranian state media without the attribution.

Typical of this actor in style and narrative. Sometimes it acts like a covert government press department.
Oddly, that account mostly posted anti-US memes, but it did insert a couple of praise posts about the U.S. President and his wife, um, "Melanie".

Trying to reach a pro-Trump audience?
Some of the other assets had an intriguing African focus. "Ethiopianow" and "Durban Daily."

Created February 17, 2020. Combined following: 23.
They were on Twitter, too. Again, IUVM content (and screen name on this one), low following (85 for this account).

It really feels like IUVM is struggling to rebuild right now.
You can follow @benimmo.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: