Iran-Based Psychological Operation Sets Saudi Aramco in Its Crosshairs

An Iran-based psychological operation that previously tried to demoralize Israelis via social media is now targeting Saudi Arabia’s state-owned oil company, Aramco, by calling for real-world attacks. The orchestrating role of the “Car Online” Telegram channel was first uncovered by the Foundation for Defense of Democracies (FDD) when Car Online was organizing a network to pose as Israelis on X to harm Israeli morale, using ChatGPT to translate posts from Persian into Hebrew.

Two days after U.S. strikes against Iranian nuclear facilities, Car Online shifted its focus to encouraging participants to incite Yemenis to strike Aramco with missiles, claiming Saudi money helps fund American bombs. 

Posts on X Call for Revenge on Saudis for Alleged Funding of Israel

On June 23, Car Online instructed its roughly 400,000 subscribers to post a series of tweets in Arabic addressing Yemenis directly. It asked users to post a specific hashtag, #أرامكو (#Aramco), referencing the Saudi state-owned oil giant. Car Online provided a model post to its participants that calls for revenge against Saudi Arabia and says that Saudi money funds Israel as well as U.S. bombs.

Though the precise text of the network’s posts tends to vary moderately, all participating accounts are consistent in calling for revenge against the United States. One post declared that Aramco is the lifeblood of U.S. colonialism. Another asks “lion-hearted Yemeni men” to target Aramco with missiles.

Car Online suggests an attack on Aramco can significantly damage the United States and its allies. Several posts on its Telegram channel claim that the United States and Europe depend heavily on oil imports, characterizing Europe as a strong supporter of Israel.

Network Seems To Be Independent of Tehran Regime

Car Online describes itself as “economic media” and appears to have once posted about financial topics. It began instructing its subscribers to engage in pro-regime psychological operations on June 17.

It is unlikely a state actor runs this channel, as it criticizes Iran’s leadership and expresses frustration with the armed forces. It is unclear why Car Online is still able to operate despite regime restrictions on the internet, though some Iranians have found “pockets of connection” amid the regime-imposed internet blackout.

Yemen’s Iran-Backed Houthi Rebels Hit Saudi Oil Facility in 2019

The decision by Car Online to call specifically on Yemenis to strike Aramco draws on a precedent set in September 2019, when the Iran-backed Houthi rebels in Yemen claimed responsibility for a sophisticated drone and missile strike on Aramco facilities — but Iran actually carried out this attack, according to Saudi Arabia, the United States, and other countries. The strike temporarily cut Saudi oil production in half and disrupted 5 percent of global supply. Car Online’s recent campaign apparently seeks to motivate Yemen’s Houthi rebels, who are better armed now than in 2019, to actually strike Aramco.

Social Media Threats Can Do More Than Shape Public Opinion

Car Online’s newly discovered campaign marks a significant shift in this Iranian psychological operation. While it previously aimed for cognitive effects (demoralizing Israelis), it now aims for physical and economic effects.

It is not clear whether Car Online’s operators understand that the Houthis did not actually carry out the 2019 attack on Aramco. Nor is it clear that a social media campaign can affect major decisions of a group that controls half of Yemen and takes its cues from Tehran, which provides it with ballistic missiles and other weapons.

Nevertheless, governments should take such threats seriously and conduct deep investigations to identify the actors behind them. Corporations like Aramco that play a critical role in global energy can also invest in social listening tools and threat monitoring services to protect themselves, if they do not do so already.

Max Lesser is a senior analyst on emerging threats at the Center on Cyber and Technology Innovation (CCTI) at FDD, where Maria Riofrio is an intern. For more analysis from CCTI and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.