Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Fraud Risk Management

Facebook Removes More Accounts Linked to Russia

Facebook is again cracking down on fake accounts and pages linked to a Russian troll farm known as the Internet Research Agency or the country's military intelligence units that were being used for disinformation campaigns.

See Also: Protecting Australia’s Vital Energy Grid with Stronger Security Culture

Meanwhile, the FBI issued a fresh warning about threat actors who are attempting to target U.S. voting infrastructure.

On Thursday, Facebook announced that it had removed three networks with Russian ties from its various platforms that included hundreds of fake users, pages, groups and postings. Each network focused on a different region in an attempt to spread disinformation or fake news about politics and current events.

"The networks … targeted many countries around the world and had very limited following globally at the time of disruption," Nathaniel Gleicher, the head of security policy for Facebook, noted in a blog post. "Much of this activity focused on two things: creating fictitious or seemingly independent media entities and personas to engage unwitting individuals to amplify their content and driving people to other websites that these operations control."

A network that mainly targeted the U.S. included five Facebook accounts, one page, one group and three Instagram accounts that all appeared tied to the Internet Research Agency, the Russian group that waged an election-related disinformation campaign in 2016. About 4,800 users followed at least one of the Facebook pages, and another 5,600 followed at least one of the Instagram accounts, the social media company reports.

Facebook says it received information from the FBI about these accounts and began investigating this network for what the company calls "coordinated inauthentic behavior."

This is the second time this month that Facebook has announced that it closed down accounts and pages related to Russia's IRA (see: Russian Election Misinformation Campaign Re-Emerges).

Patterns of Behavior

The operators behind the network tied to Russia's IRA that targeted the U.S. attempted to use the social media accounts to drive users to an off-platform site that posed as an independent think tank based in Turkey, Facebook says.

The fake user accounts posed as U.S., Canadian and Turkish citizens who were attempting to recruit others to write articles for this off-platform site and were also spreading fake news about current events, according to the social media company.

"The people behind this activity posted off-platform articles primarily in English and Turkish about global news and current events relevant to the countries they targeted, including local elections; geopolitical conspiracies; presidential and parliamentary elections in Hong Kong, Spain, the U.K. and the U.S.; social and racial injustice; police brutality; the coronavirus pandemic; criticism of U.S. sanctions in the Middle East, U.S. foreign policy and U.S. allies, including Israel; and politics in Venezuela," Facebook says.

In addition to removing the IRA-linked network, Facebook removed two other networks for the same type of inauthentic behavior.

One network included 214 Facebook accounts, 35 pages, 18 groups and 34 Instagram accounts and mainly focused on Syria and Ukraine but also targeted Turkey, Japan, Armenia, Georgia, Belarus and Moldova. A small portion of this network's activity also focused on the U.K. and the U.S, according to Facebook. The social media company traced the accounts to members of Russia's military intelligence services.

The other network, which included 23 Facebook accounts, six pages and eight Instagram accounts, focused almost exclusively on events in Belarus. These pages were also traced back to the Russian military, according to Facebook.

FBI Alert

The social media giant’s actions against the three networks came on the same day the FBI, along with the U.S. Cybersecurity and Infrastructure Security Agency, issued a fresh warning that unspecified threat actors are attempting to target voting infrastructure.

"Cyber actors continue attempts against election systems that register voters or house voter registration information, manage non-voting election processes or provide unofficial election night reporting," the agencies state. "These attempts could render these systems temporarily inaccessible to election officials, which could slow, but would not prevent, voting or the reporting of results."

The FBI and CISA also note there has been "no reporting to suggest cyber activity has prevented a registered voter from casting a ballot, compromised the integrity of any ballots cast or affected the accuracy of voter registration information." Local election officials can use provisional and paper ballots to ensure the integrity of the vote, the agencies say.

Earlier this week, the FBI and CISA warned about potential efforts by nation-state hackers, as well as some cybercriminals, to use social media to sow doubts about the vote tallies in November (see: FBI, CISA Warn of Election Results Disinformation Campaigns ).