NEW: Facebook has removed more than 1,700 assets linked to two Egyptian digital marketing firms targeting audiences in Middle East and North Africa. Here's our EXCLUSIVE look at the assets that were deleted. medium.com/dfrlab/faceboo…
These assets were linked to two marketing firms, NewWaves and Flexell, that were at the center of two separate purges in August and October 2019, respectively.
The DFRLab corroborated the link to NewWaves but was unable to corroborate any direct connection to Flexell.
Facebook provided us a subset of these assets consisting of seven FB groups, 73 pages, and 1,191 Instagram accts ahead of the takedown and was able to corroborate the company’s assessment of inauthentic and coordinated activities between these assets before they were removed.
The assets bear familiar hallmarks reminiscent of previous campaigns orchestrated by marketing companies NewWaves and the similarly named Newave, registered in Egypt and the United Arab Emirates, respectively.
In August 2019, the DFRLab published an investigation into the network shortly after Facebook removed those assets. medium.com/dfrlab/faceboo…
The investigation found evidence that the network’s Facebook and Instagram assets coordinated their activity and that a related set of Twitter accounts appeared to be a part of the same campaign.
The existence of a Twitter network operating in unison with assets on Facebook is also reminiscent of a BuzzFeed investigation into Flexell’s operations published in October 2019. buzzfeednews.com/article/janely…
The Instagram and Facebook assets interspersed uplifting and humorous content with politically charged narratives, presumably to garner a wide following before pivoting into regional politics.
These assets targeted countries in the MENA region, including Turkey, Iran, Qatar, Bahrain, Sudan, Somalia, and Libya among others, with Facebook adverts meant to promote the network. 
Despite being targeted at these countries, the administrators for these pages were mostly based in Egypt.
The DFRLab found that the network created fake Facebook accounts, using publicly available images, to act as administrators for these groups. Most of the Facebook and Instagram assets were postured as females, likely as a means of targeting a male demographic.
We also linked the off-platform websites featured in this subset of Facebook assets to similar websites seen in the earlier takedown of NewWaves assets August 2019, through analyzing the WordPress files the sites used.
The main suspect behind this network was NewWaves’s owner, Amr Hussein, who was identified as a former military officer and self-described expert in “internet warfare” in a New York Times piece following the removal of the assets by Facebook. nytimes.com/2019/09/06/wor…
Hussein used the pseudonym “Amr Hussien” for the Facebook profile and website registration records linked to him in this investigation.
You can read our exclusive analysis of the latest FB takedown here. medium.com/dfrlab/faceboo…
