Facebook accounts tied to Iranian state media have created fake accounts and sponsored advertisements online, opening up a new frontier in Facebook’s attempts to limit bad behavior online that was originally centered on Russia.

Today, Facebook said that it had shut down 652 pages, groups and accounts on Facebook and Instagram after receiving a tip from a third-party cybersecurity company. That firm, FireEye, told Facebook earlier this summer that a network called “Liberty Front Press” that was linked to Iranian state-run organizations, despite sometimes posing as independent media and civil society groups.

“Broadly speaking, the intent behind this activity appears to be to promote Iranian political interests, including anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as to promote support for specific U.S. policies favorable to Iran,” FireEye writes. “In the context of the U.S.-focused activity, this also includes significant anti-Trump messaging and the alignment of social media personas with an American liberal identity.”

“However,” it adds, “it is important to note that the activity does not appear to have been specifically designed to influence the 2018 U.S. midterm elections, as it extends well beyond U.S. audiences and U.S. politics.”

Previous Facebook investigations have uncovered influence campaigns in the U.S. that are likely sponsored by Russian military intelligence services; Iran is a new threat. Facebook executives said today that the company wasn’t able to ascertain the motives of the bad actors.

Facebook, once again, caught the fake accounts in advance of the election, not like in 2016. But the continued attempts — plus the addition of a new foreign adversary — shows that Facebook will have to play constant defense through November, at least.