Copyright © 2024

The work of Euromaidan Press is supported by the International Renaissance Foundation

When referencing our materials, please include an active hyperlink to the Euromaidan Press material and a maximum 500-character extract of the story. To reprint anything longer, written permission must be acquired from [email protected].

Privacy and Cookie Policies.

Facebook takes down 122 Russian military intel accounts that targeted Ukraine

Figure of the Week: 122
Facebook takes down 122 Russian military intel accounts that targeted Ukraine
Edited by: Yuri Zoria
Last week, Facebook announced a new takedown of 122 user accounts, pages, groups, and Instagram profiles originating in Russia that violated its policy against foreign or government interference. According to Facebook’s internal investigation, the network had links to Russian military intelligence and primarily targeted Ukraine, along with neighboring countries in the region.

Tactical Evolution

The operation was characterized by greater tactical sophistication aimed at circumventing Facebook’s monitoring capabilities and obscuring attribution – similar to the tactics observed in the Russian Internet Research Agency’s operation across eight African countries exposed last October. In particular, the individuals behind this latest network posed as locals and used fake accounts to manage several groups and pages, as well as post and comment on various content. Notably, much of this activity occurred throughout 2016 and 2017, and while some of the accounts in question were detected and disabled by Facebook’s automated systems, many remained active until last week’s takedown.

Some of the accounts claimed to be citizen journalists and used these fake personas to try to contact policymakers, journalists, and other prominent public figures in Ukraine and other countries to plant false stories about politically divisive issues. The accounts also posted content – usually in Russian, English, or Ukrainian – that focused on local news as well as major international topics like the downing of flight MH17, Russian military engagement in Syria, and the alleged leaks from Ukraine’s state security service (SBU) related to ethnic tensions in Crimea. Examples of this content provided by Facebook are consistent with pro-Kremlin disinformation narratives on these topics, for instance attempting to cast doubt on the findings of the Joint Investigation Team (JIT) that found Russia responsible for the MH17 crash, attacking politicians and public figures advocating for closer ties with the West, and attacking humanitarian groups working to document war crimes in Syria.

Lessons for the Future

The operation was examined by Graphika, a social media analytics company, prior to Facebook’s takedown of the accounts. This analysis highlights three main takeaways:

The ascendance of private messaging: beyond making public posts, these accounts engaged – and sometimes entrapped – their targets via private messaging. Such use of direct messages and emails to approach journalists and political figures has featured in several other ​information ​operations​ and is of growing tactical significance.

Coordinated activity across platforms: Graphika found that the Russian operation went beyond the Facebook accounts in question to a number of other smaller online platforms and blogs, which can be more easily leveraged to “launder” content and obscure its origins on social media.

Media organizations are targets too: agents of disinformation seek to legitimize their content by having it re-published by credible outlets to which they can outsource “the narrative baton.”

The Kremlin Is Not Alone

In addition to the Russian operation, Facebook also removed two further networks as part of this latest takedown: one originating in Iran that primarily targeted the US, and one originating in Myanmar and Vietnam that targeted audiences in the former. These operations were considerably smaller than the Russian effort: the Iranian network comprised six Facebook accounts and 5 Instagram accounts, while the Myanmar-oriented operation involved 13 Facebook accounts and 10 pages. Read more about Facebook’s prior shutdowns of Russian operations here and here.

Read more:

Edited by: Yuri Zoria
You could close this page. Or you could join our community and help us produce more materials like this.  We keep our reporting open and accessible to everyone because we believe in the power of free information. This is why our small, cost-effective team depends on the support of readers like you to bring deliver timely news, quality analysis, and on-the-ground reports about Russia's war against Ukraine and Ukraine's struggle to build a democratic society. A little bit goes a long way: for as little as the cost of one cup of coffee a month, you can help build bridges between Ukraine and the rest of the world, plus become a co-creator and vote for topics we should cover next. Become a patron or see other ways to support. Become a Patron!

To suggest a correction or clarification, write to us here

You can also highlight the text and press Ctrl + Enter

Please leave your suggestions or corrections here

    Euromaidan Press

    We are an independent media outlet that relies solely on advertising revenue to sustain itself. We do not endorse or promote any products or services for financial gain. Therefore, we kindly ask for your support by disabling your ad blocker. Your assistance helps us continue providing quality content. Thank you!

    Related Posts