Facebook just announced another takedown set:
- Russia: military intel targeting Ukraine and neighbourhood;
- Iran: 11 assets targeting US;
- Myanmar: telecoms providers targeting competitors.
@Graphika_NYC report on the Russian op to follow.
about.fb.com/news/2020/02/r…
- Russia: military intel targeting Ukraine and neighbourhood;
- Iran: 11 assets targeting US;
- Myanmar: telecoms providers targeting competitors.
@Graphika_NYC report on the Russian op to follow.
about.fb.com/news/2020/02/r…
And here's the @Graphika_NY report.
Blogs were the backbone of this operation. It also used direct messages to target individuals, and pose as citizen journalists.
Not the first time we've seen such things, but they're an under-appreciated threat.
graphika.com/reports/from-r…
Blogs were the backbone of this operation. It also used direct messages to target individuals, and pose as citizen journalists.
Not the first time we've seen such things, but they're an under-appreciated threat.
graphika.com/reports/from-r…
The main focus of the operation was Ukraine; the main activity spanned 2016-18, though a few accounts were active until the takedown.
There were a few English-language posts on Kremlin-aligned themes. The use of language was... memorable.
There were a few English-language posts on Kremlin-aligned themes. The use of language was... memorable.
The operation mainly worked in Russian and Ukrainian (bits in English, Turkish, German).
It used fake personas to create blogs on platforms including cont[.]ws and korrespondent[.]net, then posted them on Facebook and Twitter.
It used fake personas to create blogs on platforms including cont[.]ws and korrespondent[.]net, then posted them on Facebook and Twitter.
The content was aligned with Kremlin narratives: Russia good, Ukraine bad, White Helmets really bad, USA interfering, EU unnecessary...
Interestingly, there was quite a focus on the Crimean Tatars. And they couldn't resist a dig at @bellingcat and @EliotHiggins, too.
Interestingly, there was quite a focus on the Crimean Tatars. And they couldn't resist a dig at @bellingcat and @EliotHiggins, too.
One of the more interesting aspects was how this operation used direct messaging to entrap targets, and probably to land its blogs in the media.
This persona posed as a journalist to ask leading questions of a Ukrainian politician and a Crimean Tatar leader.
This persona posed as a journalist to ask leading questions of a Ukrainian politician and a Crimean Tatar leader.
In this one, the persona pretended to be from the Russian service of @radiosvoboda / @RFERL.
Reason to think this was done via DMs? Screenshots (caveat: such things can be photoshopped, in which case this would be disinfo rather than entrapment).
Reason to think this was done via DMs? Screenshots (caveat: such things can be photoshopped, in which case this would be disinfo rather than entrapment).
It looks like the operation also managed to plant some of its blogs as bylines in local news outlets, especially in Moldova and Ukraine.
It's a classic approach for an intelligence operation: establish a false persona, then poison the well of information.
It's a classic approach for an intelligence operation: establish a false persona, then poison the well of information.
Watch out for this approach. The Fancy Bears did it (GRU). The Iranian "Endless Mayfly" did it (h/t @citizenlab).
There's more to info ops than scattergun trolls. Some ops can be laser-focused on the individual, especially journalists and politicians.
citizenlab.ca/2019/05/burned…
There's more to info ops than scattergun trolls. Some ops can be laser-focused on the individual, especially journalists and politicians.
citizenlab.ca/2019/05/burned…
