The accounts posted content critical of Iran's government and supportive of Mujahedeen-e-Khalq, a dissident group known as MEK. In many cases, the Facebook and Instagram accounts used fake profile names and photos. Facebook determined the accounts were being run from a single location in Albania by a group of individuals working on behalf of MEK. Facebook found other telltale clues suggesting a so-called troll farm, in which workers are paid to post content, often misinformation, to social media.

For one, researchers found that the activity seemed to follow the central European workday, with posts picking up after 9 a.m., slowing down at the end of the day, and with a noticeable pause at lunch time.

''Even trolls need to eat,'' Ben Nimmo, who leads Facebook's global threat intelligence operation, told reporters on a conference call on Tuesday.

MEK is a leading group opposing the Iranian government. It killed Americans before the 1979 Islamic Revolution and was labelled as a terrorist organization by the State Department until 2012. Nevertheless, US politicians from both parties including Rudy Giuliani and Newt Gingrich have given paid speeches to MEK in the past.

The network of fake accounts was most active in 2017 and again in late 2020, Facebook said. In all, more than 300 accounts, pages and groups on Facebook and Instagram were removed as part of the company's action. Around 112,000 people followed one or more of the Instagram accounts.

In some cases, the fake accounts used photos of Iranian celebrities or deceased dissidents. A small number of the more recent Instagram accounts appear to have used profile pictures that were computer generated.