Google finds evidence of attack linked to Iran state media

Google has uncovered a disinformation attack across several of its properties that it has connected to the Islamic Republic of Iran Broadcasting (IRIB), the company said in a statement Thursday.

Why it matters: Facebook and Twitter announced earlier this week that they have uncovered coordinated disinformation campaigns linked to Iran, but this is the first time any tech firm has said it found a direct link between Iran state media and the attack.

The details:

• Google says it uncovered and terminated 39 Youtube channels (that had 13,466 total US views on relevant videos), 6 blogs on Blogger and 13 Google+ accounts associated with the disinformation campaign.
• "Technical data associated with the bad actors is strongly linked to the official IRIB IP address space" and "domain ownership information about these actors is strongly linked to IRIB account information," Google said.
• The tech giant says account metadata and subscriber information associated with these actors is "strongly linked" to the corresponding information associated with the IRIB, indicating common ownership and control.

The company was aided by FireEye, the same cybersecurity firm that helped Facebook uncover disinformation attacks earlier this week, to identify three of the Youtube channels connected to Iran.

• Google says an internal Threat Analysis Group, as well as its partners at Jigsaw and Google’s Trust & Safety team, works on identifying these types of threats. Like its tech rivals, it works with the intelligence community and outside groups to further uncover any potential attacks.

What's next? Google warns that phishing attacks, attempts by bad actors to trick users into hacking their devices and accounts, remain a threat to all email users and it is reminding Gmail users to be vigilant.

Go Deeper: Facebook reveals foreign meddling from Iran, Russia