Twitter and Facebook both announced action against malicious accounts originating from Iran, Russia, and Venezuela on Thursday. They accused the banned accounts of spreading disinformation in an effort to influence the 2018 midterm elections, among other political objectives.

According to the Washington Post on Thursday, Twitter banned thousands of malicious accounts. The somewhat surprising news is that most of them came from Iran. 418 of the suspicious users were sourced to Russia, and 764 to Venezuela, while over 2,600 of them were linked to an Iranian influence campaign first detected in 2018. Twitter noted that the Iranian government blocks its service but many Iranians are able to evade the block by using virtual private networks.

The Washington Post said that roughly a third of the Iranian accounts posted tweets in English and only a “small fraction” of them were related to the U.S. midterm election. The Venezuelan accounts were far more active, pumping out some 50,000 tweets related to the U.S. election.

Twitter’s report on these disinformation campaigns offered a mixture of good and bad news. The good news is that online “election meddling” appeared less vigorous than in 2016 and Twitter was able to identify and suspend many of the mischievous accounts before Election Day, thanks in part to the use of sophisticated artificial intelligence programs to discover suspicious accounts.

The bad news is that more bad actors around the world appear to be adopting Russian information-warfare tactics. Many of the suspicious accounts posted messages intended to confuse voters about when they should head to the polls. The Venezuelan accounts generated a large number of tweets intended to influence other Venezuelans. The Iranian accounts frequently tweeted about Israel and the Palestinians. Twitter did not find enough evidence to definitively link any of these influence operations to their respective governments.

Facebook wrote at much greater length about the Iranian influence campaign it uncovered:

Today we removed multiple Pages, groups and accounts that engaged in coordinated inauthentic behavior on Facebook and Instagram. This activity was directed from Iran, in some cases repurposing Iranian state media content, and engaged in coordinated inauthentic behavior targeting people across the world, although more heavily in the Middle East and South Asia. These were interconnected and localized operations, which used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.

Facebook shut down a total of 783 pages, groups, and accounts involved with “coordinated inauthentic behavior tied to Iran.” This influence campaign spread across a wide range of countries besides the United States, including Afghanistan, Albania, Algeria, Bahrain, Egypt, France, Germany, India, Indonesia, Iran, Iraq, Israel, Libya, Mexico, Morocco, Pakistan, Qatar, Saudi Arabia, Serbia, South Africa, Spain, Sudan, Syria, Tunisia, and Yemen.

Facebook reported the users who ran these pages “typically represented themselves as locals, often using fake accounts, and posted news stories on current events,” frequently recycling reports, videos, and commentary from Iranian state media.

ABC News reported the simultaneous release of information on fake accounts was no coincidence, as Facebook and Twitter shared information in their effort to detect influence networks.