Once again, Facebook is notifying the media that it has mass-removed accounts exhibiting "coordinated inauthentic behavior on Facebook and Instagram." This time around, Mark Zuckerberg said the cull caught up 652 pages that it says were linked to a campaign originating in Iran, as well as an unspecified number of accounts linked to Russian military intelligence services. Like Microsoft's announcement last night and Facebook's last notice in July, these changes are part of a push for security around elections happening in 2018, including the just-concluded events in Mexico, and the US midterms in November.
While Facebook attributed the moves announced today to four separate investigations, it acknowledged that security company FireEye tipped it off to a network of sites starting with "Liberty Front Press." Facebook connected the page's backers to Iranian state media, saying that some of the accounts were created as early as 2013, while targeting viewers in the Middle East, UK, US and Latin America. One of the pages had 155,000 followers, and one of its Instagram accounts notched 48,000 followers. While some of the pages found pretended to be news and other organizations, a second group of "inauthentic" news pages showed evidence of attempts to hack accounts and spread malware.
FireEye posted this map making many of the connections between suspected pages in the network. It also identified a number of Twitter accounts linked to the campaign, and some Arabic-language sites that weren't included in its report. Tonight Twitter also announced it had suspended some 284 accounts "for engaging in coordinated manipulation" that it believes originated in Iran, but did not give many other details.
Another part of the Facebook investigation found fake accounts targeting Middle East users that dated back to 2011, and included a page with more than 800,000 followers. Altogether, pages in the campaign spent more than $12,000 on Facebook ads, and since Iran is under sanctions, Facebook is also working with the Treasury and State departments. According to FireEye's report, the pages it found did not appear to be specifically aimed at the 2018 midterm US elections, and extended well beyond just US audiences. What is apparent is that there's not just one group using social media to run influence campaigns that can reach nearly anywhere, and it's unlikely they'll stop making attempts.
Update (8/22): Russia has responded, with Kremlin spokesperson Dmitry Peskov saying the allegations are baseless. He also commented on Microsoft's recent takedowns of phishing sites it linked to Russian hackers: "They are all trying to outdo one another with their statements," he said.