Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cyberwarfare

Twitter, Meta Remove Accounts Linked to US Influence Operations: Report

For years, hundreds of Twitter, Facebook and Instagram accounts engaged in manipulation and spam that promoted pro-Western narratives, a new report from Graphika and the Stanford Internet Observatory (SIO) reveals.

For years, hundreds of Twitter, Facebook and Instagram accounts engaged in manipulation and spam that promoted pro-Western narratives, a new report from Graphika and the Stanford Internet Observatory (SIO) reveals.

As part of multiple covert campaigns, the troll farms were using deceptive tactics to promote pro-Western narratives to social media users in the Middle East and Central Asia. Two overlapping sets of accounts were removed in July and August 2022 by Twitter and Facebook parent Meta, Graphika and SIO report.

“These campaigns consistently advanced narratives promoting the interests of the United States and its allies while opposing countries including Russia, China, and Iran,” the report reads.

The behavior was linked to roughly 150 Twitter accounts active between March 2012 and February 2022, which posted approximately 300,000 tweets, and which were divided into two different sets of activity: the overt US government messaging campaign called the Trans-Regional Web Initiative, and a series of covert campaigns of unclear origin. Twitter said the countries of origin appeared to be the United States and the United Kingdom.

Graphika and SIO linked the activity to a set of “39 Facebook profiles, 16 pages, two groups, and 26 Instagram accounts” that Meta has disabled, and which were active between 2017 and July 2022. The researchers said Meta linked the accounts to the US.

While focusing on the covert campaigns associated with these accounts, Graphika and SIO also discovered low-level open-source connections with the overt activity, such as content sharing, but could not “assess further the nature of the relationship between the two activity sets”.

The analyzed activity is similar to previously observed cases of social media abuse for manipulation and spam, and shows that threat actors conducting influence operations use a limited set of tactics, regardless of their targeted audiences.

“The assets identified by Twitter and Meta created fake personas with GAN-generated faces, posed as independent media outlets, leveraged memes and short-form videos, attempted to start hashtag campaigns, and launched online petitions: all tactics observed in past operations by other actors,” the report reads.

Advertisement. Scroll to continue reading.

According to Graphika and SIO, the troll farms had a rather limited impact, as most of their tweets had only a handful of likes or retweets. While 19% of the covert accounts had more than 1,000 followers, the most-followed accounts were overt accounts claiming to be connected to the US military.

Graphika and SIO grouped the accounts into four different clusters, based on the targeting of specific regions and nations, namely Central Asia, Iran, Afghanistan, and an Arabic-speaking group ‘Middle East’ (which includes activity related to Iraq, Syria, Lebanon, and Yemen).

SecurityWeek has contacted Meta and Twitter for comments on the report.

Related: Pro-Russian Hackers Spread Hoaxes to Divide Ukraine, Allies

Related: CISA Warns Critical Infrastructure Organizations of Foreign Influence Operations

Related: Facebook Battles Cyber Campaigns Targeting Ukraine

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cyberwarfare

WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Cyberwarfare

Russian espionage group Nomadic Octopus infiltrated a Tajikistani telecoms provider to spy on 18 entities, including government officials and public service infrastructures.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Cyberwarfare

Several hacker groups have joined in on the Israel-Hamas war that started over the weekend after the militant group launched a major attack.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Cyberwarfare

The war in Ukraine is the first major conflagration between two technologically advanced powers in the age of cyber. It prompts us to question...

Cybercrime

On the first anniversary of Russia’s invasion of Ukraine, cybersecurity companies summarize the cyber operations they have seen and their impact.

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...