On Thursday, the company reported it was pulling off compromised pages and accounts that ‘manipulate public debate’ and were linked to Ukrainian politician parties and politicians.
“We removed 105 Facebook accounts, 24 Pages, and five Instagram accounts that originated in and targeted Ukraine. We began looking into this activity after reviewing public reporting by Bukvy, a news media organization in Ukraine. Our investigation found links to individuals associated with Sluha Narodu, a political party in Ukraine.”
According to the company’s findings, “the people behind this network used a combination of authentic and fake accounts — some of which had already been detected and disabled by our automated systems — to post, manage Pages posing as independent news Pages, and drive people to off-platform websites masquerading as news entities. Some of these accounts went through significant name changes over time.”
“They frequently shared posts from legitimate news organizations in Ukraine, in addition to posting their own content. This network unpublished and deleted many of its Pages and accounts in February 2021 when some of this activity was reported on by Bukvy.”
The ‘Bukvy’ investigation earlier found that these groups and accounts shared content on politics, corruption, Covid-19 that planted manipulative narratives promoting the ruling ‘Servant of the People’ party and targeting Zelensky’s political rivals Petro Poroshenko and Vitaliy Klitchko
The exposed network reportedly paid over $210,000 running coordinated influence campaigns and targeted Facebook ads.
The Facebook team also exposed another network of 477 Facebook accounts, 363 Pages, 35 Groups and 29 Instagram accounts that ‘originated in and targeted Ukraine’.
According to the investigation, the Ukraine-focused activity was attributed to entities and individuals sanctioned by the US Treasury Department — Andriy Derkach, Petro Zhuravel, also political consultants associated with Volodymyr Groysman and Oleg Kulinich.
The assessment found that the network was run by three separate teams of operators — each connected to a different politician: Derkach, Groysman and Kulinich.
“The individuals behind this activity managed a long-running deceptive influence operation (IO) across multiple social media platforms and their own websites, primarily copying and pasting news content from other Ukrainian news media. They built a ready-made network of seemingly independent media websites and social media assets that worked to promote content favorable to the three politicians and their political groups,” says the company report.
The promotional campaign on Facebook reportedly cost these politicians and their political consultants about $500,000 paid in the US dollars and Russian roubles.
Facebook called their coordinated activities a “network of networks” given the scope and sophistication of its operations that extended across multiple internet platforms and their own websites.
“We saw corresponding activity on YouTube, Telegram and the Russian network VKontakte. We also saw at least a dozen branded websites, some of which changed their domains repeatedly,” stated the report.
The assessment also highlighted the tricks network operatives used to conceal their identity and coordination.
“The records for their more recent websites are privacy-protected and obscure the owners’ names. Their fake accounts were set up one by one or in small batches over a period of months, likely to evade automated detection. Some of the accounts had detailed biographies to appear more authentic, while some of their Groups and Pages appeared to have been purchased. When it comes to their profile photos, we noticed a number of patterns [..] Some appeared to be photos of other people taken from across the internet. Others used female photos likely generated using machine learning techniques like generative adversarial networks (GAN). In an unusual technique, some of the accounts had profile photos that looked like they were created by scanning old-style printed passport photos.”
The network was found out to use similar patterns to boost engagement.
‘The fake accounts’ activity on some posts was perfunctory, and consisted of short comments — only two or three words or memes and GIFs without text [..] The network used its fake accounts to boost its own content and comments about it. For example, the first fake account would post a favorable article about a politician. Others would then make supportive comments, more fakes would like the post, and still more would like the comments.”
According to the Facebook assessment, ‘some of this network’s content supported the politicians and parties with whom the operators were directly associated — Derkach’s Nash Krai Party, Groysman’s Ukrainian Strategy Party, and Kulinich’s Trust (Dovira) group.’
The findings showed that ‘his network posted supportive content and comments about a wide range of political actors in Ukraine, across the entire political spectrum, seemingly without much ideological preference’. Among the political actors promoted by the network activities were Viktor Bondar and the Revival Party and the ruling ‘Servant of the People’ party.