Facebook has taken down multiple pages, groups, and accounts on Facebook and Instagram for “coordinated inauthentic behavior”; the accounts were related to two operations originating in Russia. One of the operations was focused on Ukraine and ran into nearly a hundred Facebook accounts, pages, and groups, they posted content relating to Eastern Ukraine, Russian politics, political news in Europe, politics in Ukraine and the Syrian civil war. Atlantic Council’s DFRLab notes there wasn’t enough open-source evidence to conclude whether the pages were connected to Russian authorities, but the pages in the network led people toward three websites that shared content from Russian state propaganda outlets.
- The operations ran 62 Facebook accounts, 10 Pages and 25 Groups.
- 34,000 accounts followed one or more of these Pages, 86,000 accounts joined at least one of these Groups. The most-followed page had about 21,000 followers and another page had 2000 followers.
- $1 spent on Facebook ad in March 2017, paid for in US dollars.
Pages share news from propaganda website: Four of the eight pages were linked to a website called infopolk.ru. The name translates from Russian as “info regiment,” and the website and associated pages called on users to “take part in the InfoWar.” Four of the Facebook pages namely @infopolk, @syriainfowar (dealing with the Russian operation in Syria), @ykrainanasha (“Ukraine is ours”), and @allnovorossiya (the name “Novorossiya” is sometimes used to refer to the Russian-backed separatist regions of Ukraine), were sharing content from infopolk.ru.
The infopolk.ru websites directed users to Russia and pro-Russia websites, an offered options to share the news pieces on social media. It also offered Android users a downloadable app to be able to share content from the website by scanning a QR code.
Hunting for cryptocurrencies; cryptojacking: A downloadable file with malicious code was found on the website aka Coinhive, which is the top malicious threat to internet users who user the Monero cryptocurrency. “The code, which can be planted on a website without the user’s consent, steals the visitor’s processing power in a bid to mine bits of Monero cryptocurrency.”
Ukraine pages, Russian propaganda
The second operations came from a smaller network from Russia focused on Austria, the Baltics, Germany, Spain, Ukraine and the United Kingdom. Individuals behind this network used fake accounts to join groups, impersonate other users and to amplify allegations about a public figure working on behalf of intelligence services. They also distributed content on local politics including NATO, religious issues, and immigration.
- 16 Facebook accounts, 4 Pages and 1 Instagram account.
- 1,100 accounts followed one or more of these Pages, 80 accounts followed the Instagram account.
One page, @antifashistcom, called itself the “anti-fascist forum of Ukraine” was the oldest page in the network, according to DFRLab, and had the largest following of 21,000. This page also shared content from antifashist.com, relating to posts on Ukraine-Russia politics. Its worth noting that the content appeared to be largely copied from other sources.
Not all the articles were pro-Kremlin, although many were. This appears to have been a technique to give the site the appearance of legitimacy by presenting genuine news from other sources as its own.
Another page, @infocenter.odessa, was posing as a news page in Odessa, Ukraine. Its most recent post was in January 2018 and directed to a copy of an antifashist.com article. “The Facebook page appears to have been a dormant asset, likely identified on the basis of the accounts used to set it up”, although the website was still actively posting as of May 6, 2019.