Facebook takes down Russian network impersonating European news outlets

Facebook parent Meta says it has disrupted a large Russian network of fake accounts impersonating European news outlets to push a pro-Kremlin view of the war in Ukraine.

Separately, the social media giant says it also took down a network originating in China targeting the U.S. midterm elections and criticizing the Czech government.

While the campaigns were not connected, the dual takedowns underscore how social media platforms continue to be ripe targets for efforts to shape the narratives around high-profile events, said Ben Nimmo, Meta's global threat intelligence lead.

"There's a shooting war going on in Ukraine, there are elections coming up in the U.S.," he said. "And we're seeing influence operations that are talking about those things."

Russia campaign targeted European support for Ukraine

Meta said the Russian operation was the largest and most complex it has disrupted since President Vladimir Putin invaded Ukraine in February.

"You can actually sum up everything it was saying in ten words: 'Ukraine's bad. Russia's good. Stop the sanctions. Stop supplying weapons,'" Nimmo said.

It involved more than 60 websites pretending to be legitimate, high-profile European news organizations, including the U.K.'s The Guardian and Daily Mail, Germany's Der Spiegel and Bild, and Italian news agency ANSA.

The spoofed websites were built with care, Nimmo said, under the apparent theory that imitating a big brand would draw a big audience. They copied the layouts of outlets' real sites and imitated their web addresses. In some cases they used bylines and photos of real journalists and included working links to other news articles.

But Nimmo said that level of detail is what doomed the operation. Meta began investigating the fake sites after journalists, researchers and members of the public flagged them this summer.

"They overreached themselves," he said. "If you pretend to be Spiegel in Germany in front of an audience where Spiegel is one of the best-known brands in the country, then what you're doing is increasing the risk that somebody is actually going to look at you and say, 'Wait a minute, this is not the real thing.'"

The various fake sites ran articles in multiple languages with pro-Kremlin narratives, including accusing the Ukrainian government and military of corruption and warning of dire consequences from European sanctions on Russia.

The bulk of the spoofed news sites were German, but others imitated outlets in the U.K., Italy, France, Ukraine, and Latvia. In earlier phases, the operation created its own brands posing as news outlets, some of which were shared by official Facebook pages of Russian embassies.

The network promoted links to its websites using fake accounts on Facebook, Instagram, Twitter, Telegram and Russia's LiveJournal as well as petition websites including Change.org. Many of the fake accounts used profile pictures generated by artificial intelligence, and a large number claimed to work for Netflix.

"They were trying to do a kind of smash-and-grab raid on the information environment," Nimmo said. "They were trying to create these fakes and push them out so fast and so loudly that they reached real people before they got caught."

Using fake social media accounts to drive traffic to external websites has become a common tactic in influence operations, also used by a separate Russian influence campaign that Meta removed in the early days of the invasion.

Facebook removed more than 2,300 accounts, pages and groups on Facebook and Instagram, which collectively accumulated around 5,500 followers. The network spent about $105,000 on ads promoting links to the fake websites.

These amplification tactics were crude, Meta said, with many of the posts, accounts and ads detected by its automated systems.

Chinese network took aim at divisive political issues

The Chinese network was much smaller and less sophisticated, and gained little, if any, traction. It consisted of 92 accounts, pages and groups on Facebook and Instagram that collectively gained around 280 followers.

It's the first time Meta has taken down a China-based effort focusing on the U.S. midterm elections. In the spring and summer of this year, fake accounts posed first as conservative Americans and then as liberals posting about U.S. politics, figures including President Joe Biden, Sen. Marco Rubio (R-Fla.) and Florida's Republican governor, Ron DeSantis, and contentious topics such as abortion access and gun rights.

Meta said there were similarities to another network of China-based fake accounts it removed in 2020, which posted, in part, about the U.S. presidential election.

What is different this time, Nimmo said, is the direct focus on American politics rather than critiquing the U.S. government.

"All the operations from China that we've seen before talk about America rather than talking to America," he said. "It looks like they were using these divisive issues, these hot political issues, as a window into American conversations."

The network also posted in Chinese about geopolitics, accusing the U.S. of conducting surveillance and cyberattacks against China. In a separate cluster of activity, the fake accounts impersonated Czechs, criticizing the Czech government's support for Ukraine and warning against antagonizing China.

The network posted sporadically and typically during Chinese working hours. Its posts got little engagement on Facebook and Instagram, with some other users calling them out as fake, and hashtags it used when posting about American politics were rarely used by accounts outside the network, Meta said.

In addition to Facebook and Instagram, the network also operated on Twitter and two Czech petition websites – a similarity it shared with the Russian campaign.

"That they're moving off social media and trying to find other platforms where they can reach people, whether they're a big operation or a small one – that's an interesting development," Nimmo said. "They're looking for a safe place on the internet where they're not going to get taken down."

Editor's note: Meta pays NPR to license NPR content.

Copyright 2022 NPR. To see more, visit https://www.npr.org.