One of the odd things about operation #SecondaryInfektion was how little it was on Twitter - even less than on Facebook.
So far, we've found one account, that the FB account pointed to. Ostensibly a Ukrainian girl in Germany.
The operation used this account (now suspended) to ping stories to German politicians and commentators, especially AfD.
The nastiest story it posted, and the only one that got any traction, was a claim based on a forged "guide to Muslim immigrants" in Germany.
As ever, posted by a single-use burner account.
As so often, other single-use burner accounts posted it to other platforms in German and English.
The tone was openly vicious and Muslim-baiting.
This time, it got picked up on the far right in Germany. This is one of the operation's Facebook accounts, but it's sharing an article that traces back, via Wordpress, to Journalistenwatch, not to the operation itself (as far as we know).
The thing is, unlike the operation's own production, the Journalistenwatch variant actually got some traction.
That's an anti-Islam and anti-immigrant fake, probably created, and certainly promoted, by a Russian information operation, penetrating the German far right.
That's not the only time the operation tried to reach the far right, either.
There's one story we've found so far about the @Europarl_EN elections. It followed the classic pattern.
We found this one via a French-language account that, unusually, posted two stories. (Bad OPSEC there.)
The second one accused mainstream politicians of a "war against the right."
It was based on a forged letter attributed to @AnnaMariaCB.
We language-checked the letter (in Swedish) with experts. Definitely non-native (though probably not machine translated).
One of the things about this op is how many languages its operators were +almost+ competent in. That's a major human investment.
This time, the language versions came in French, German and English almost simultaneously.
Note meinbezirk.at again. The op used it repeatedly.
The English version was posted on Medium by a single-use burner account. Surprised?
It started, "It became known earlier that," which is just not English-language journalism, but works in Russian as “Ранее стало известно, что..."
(These from TASS and Sputnik.)
These may be my favourite quotes of the whole operation.
Those extreme rights are pretty damn scarily, no?
Oh, and "informational war," again.
It looks like the operation's security habits were slipping by this stage, because they posted the story with an account on meinbezirk.at that posted one other thing.
That was a claim of an "information war" against Germany by the US and Poland. Typically divisive.
The operation's Twitter account then pinged the story directly to 16 different people, mostly AfD politicians.
"People are actively discussing this online. Can you comment?"
Direct targeting.
As so often, though, the article didn't get traction. At least some of that looks like it was because of user wariness.
That, at least, is a positive sign, as far as it goes.
But the thing is, all this op needs is to succeed once; the Muslim-baiting story arguably did just that.
Using so many burner accounts means that it's hard to get impact, but hard to disrupt the whole operation, because they already burned their own assets.
Expect more.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
🚨BREAKING🚨 @Meta took down two covert influence ops:
Big one from Russia🇷🇺 targeting Europe with spoofed media websites like the Guardian and Spiegel
First one from China 🇨🇳 to focus on both sides of domestic US 🇺🇸 politics and Czech-China relations. about.fb.com/news/2022/09/r…
@Meta The operations were very different, but both worked on multiple social media platforms and petitions sites.
The Russian op was even on LiveJournal (cute).
List of domains, petitions etc in the report. #OSINT community, happy hunting!
@Meta China: this was the first Chinese network we’ve disrupted that focused on US domestic politics ahead of the midterms and Czech foreign policy toward China and Ukraine.
It was small, we took it down before it built an audience, but that’s a new direction for Chinese IO.
🚨JUST OUT🚨
Quarterly threat report from @Meta’s investigative teams.
Takedowns from around the world:
Cyber espionage in South Asia;
Harassment in India;
Violating networks in Greece, South Africa, India;
Influence ops from Malaysia & Israel
AND... about.fb.com/news/2022/08/m…
A deep dive into a Russian troll farm, linked to people with ties to what’s known as the Internet Research Agency.
It used fake accounts across the internet to make it look like there’s support for Russia’s war in Ukraine - and to pretend the troll farm's doing a good job.
The operation called itself “Cyber Front Z”.
We think of it as the Z Team, because it was about as far from being the A Team as you can get.
🚨JUST OUT🚨
Quarterly threat report from @Meta’s investigative teams.
Much to dig into:
State & non-state actors targeting Ukraine;
Cyber espionage from Iran and Azerbaijan;
Influence ops in Brazil and Costa Rica;
Spammy activity in the Philippines... about.fb.com/news/2022/04/m…
🚨 TAKEDOWN 🚨
This weekend, we took down a relatively small influence operation that had targeted Ukraine across multiple social media platforms and websites. It was run by people in Russia and Ukraine: about.fb.com/news/2022/02/s…
It consisted of approx 40 accounts, Groups and Pages on FB and IG, plus on Twitter, YouTube, VK, OK, Telegram.
It mainly posted links to long-form articles on its websites, without much luck making them engaging. It got very few reactions, and under 4k followers.
It ran a few fake personas posing as authors. They had fake profile pics (likely GAN), and unusually detailed public bios - e.g. former civil aviation engineer, hydrography expert.
The op posted their articles on its websites and social media, & amplified them using more fakes.
Personal 🧵 based on years of OSINT research into influence operations since 2014.
Looking at the Russian official messaging on “de-nazification” and “genocide”, it’s worth putting them in context of the many different Russian IO that targeted Ukraine over the years.
* Iran, targeting the UK, focusing on Scottish independence;
* Mexico, a PR firm targeting audiences across LATAM;
* Turkey, targeting Libya, and linked to the Libyan Justice and Construction Party (affiliated w/Muslim Brotherhood).
It’s not the first time for an Iranian op to pose as supporters of Scottish independence.
In the past, FB found a page that copied and posted political cartoons about independence as far back as 2013. @Graphika_NYC writeup here (pages 26-27) graphika.com/reports/irans-…