Facebook this week said it removed three unrelated networks of accounts, pages, and groups that engaged in inauthentic behavior on behalf of foreign governments or threat actors.
The networks involved the use of fake accounts meant to mislead others on Facebook and Instagram, and were taken down due to their behavior, not because of the content posted, the social media company says.
Originating in Russia, the first of the networks was primarily targeted at Ukraine and its neighboring countries. Facebook removed 78 accounts, 11 pages, and 29 groups, as well as four Instagram accounts that were violating its policy against foreign or government interference.
Fake accounts were used to manage groups and pages and to post and comment, with the individuals behind the campaign posing as citizen journalists and attempting to contact policymakers, journalists and other public figures in the region.
The pages had approximately 500 followers and over 6,100 accounts joined at least one of these groups. The Instagram accounts amassed roughly 100 followers, Facebook reveals.
The second network that was taken down originated in Iran and included 6 Facebook accounts and 5 Instagram accounts. Mainly targeting the United States, the network is connected to the 783 pages, groups and accounts linked to Iran that the social platform took down in January.
“They shared posts about political news and geopolitics including topics like the US elections, Christianity, US-Iran relations, US immigration policy, criticism of US policies in the Middle East and public figures as well as video interviews with academics, public figures and columnists on issues related to Iran and US elections,” Facebook explains.
According to FireEye, these accounts were related to the wider network of fake social media accounts set up to support Iranian political interests that it refers to as Distinguished Impersonator, and which was initially detailed in May 2019.
FireEye also linked 40 Twitter accounts to this network and says that Twitter recently took action against them.
The 11 accounts Facebook removed now were impersonating prominent individuals, including journalists and U.S. liberals, and were “amplifying authentic content from other social media users broadly in line with that proclaimed political leaning, as well as material more directly in line with Iranian political interests,” FireEye explains.
The security firm observed a direct overlap between six of the personas on Facebook and those on Twitter. While the Twitter accounts actively commented on posts by influential individuals and organizations, Instagram accounts posted screenshots of this activity. The Instagram accounts had roughly 60 followers, Facebook revealed.
The third network that Facebook recently took down originated in Myanmar and Vietnam and focused on Myanmar. It included 13 Facebook accounts and 10 pages, with the individuals behind the activity posing as independent telecom consumer news hubs.
According to Facebook, approximately 265,600 accounts followed one or more of these pages. The network operators also spent around $1,155,000 for ads on Facebook.
Related: Facebook Takes Down Vast Iran-led Manipulation Campaign
Related: Twitter, Facebook Target State-Linked Accounts Made to Manipulate
Related: Facebook Takes Down Misleading Campaigns From Iraq, Ukraine

More from Ionut Arghire
- Lumu Raises $30 Million for Threat Detection and Response Platform
- Cisco Warns of IOS Software Zero-Day Exploitation Attempts
- Russian Zero-Day Acquisition Firm Offers $20 Million for Android, iOS Exploits
- Misconfigured TeslaMate Instances Put Tesla Car Owners at Risk
- Firefox 118 Patches High-Severity Vulnerabilities
- Stolen GitHub Credentials Used to Push Fake Dependabot Commits
- Google Open Sources Binary File Comparison Tool BinDiff
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
Latest News
- Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Lumu Raises $30 Million for Threat Detection and Response Platform
- Government Shutdown Could Bench 80% of CISA Staff
- Moving From Qualitative to Quantitative Cyber Risk Modeling
- Cisco Warns of IOS Software Zero-Day Exploitation Attempts
- Russian Zero-Day Acquisition Firm Offers $20 Million for Android, iOS Exploits
- Sysdig Launches Realtime Attack Graph for Cloud Environments
