Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Fraud Risk Management

Russian Election Misinformation Campaign Re-Emerges

Facebook Takes Down Accounts Associated with Russia's 'Internet Research Agency' Troll Farm
Russian Election Misinformation Campaign Re-Emerges
Screenshots from accounts associated with Russia's IRA troll farm (Source: Facebook)

The Russian troll group that interfered in the 2016 U.S. election is at it again, using sham accounts and a fake news site to spread disinformation in advance of the November election, Facebook reports.

See Also: OnDemand | Combatting Rogue URL Tricks: How You Can Quickly Identify and Investigate the Latest Phishing Attacks

Facebook says it removed 13 accounts and two pages from its social media platform in August that had links to the Internet Research Agency, the Russian group that waged a disinformation campaign in 2016.

In a report about "coordinated inauthentic behavior," Facebook notes that the company received a tip from the FBI about the activity.

While the Facebook report notes that these IRA-linked accounts and pages were in the early stages of developing an audience, the creators behind them used sophisticated techniques - including computer-generated photos - to create online personas and to manage content.

"These personas operated across a number of internet services and used fake names and profile photos generated likely using machine learning techniques … and posed as news editors from various countries, including the U.S.," according to the company's report. "They recruited unwitting freelance journalists to write on particular topics in English and Arabic."

The 13 Facebook accounts and two pages mainly focused their attention on users in the U.S., U.K., Algeria and Egypt, plus other English-speaking countries as well as countries in the Middle East and North Africa, Facebook says.

Twitter also announced Tuesday that it had removed five accounts that the company says had links to Russian state actors and were also associated with the fake news operation that the IRA was attempting to build.

The removal of the IRA-linked accounts comes amid concern that Russia, along with other countries, is stepping up its efforts to interfere in the November election using disinformation tactics (see: Final Report: More 2016 Russian Election Hacking Details).

In a recent video interview with Information Security Media Group, Christopher Krebs, director of the U.S. Cybersecurity Infrastructure and Security Agency, warned that Russia, China and Iran are all seeking to influence the November election (see: Election Security: A Progress Report From CISA's Krebs).

A More Targeted Effort

The latest Russian campaign attempted to target "left-leaning" communities in the U.S., U.K. and elsewhere by highlighting social and racial justice issues as well as political controversies in the European Union and NATO countries, Facebook says.

Among the issues and controversies that these pages and accounts highlighted are alleged Western war crimes and corruption; environmental issues; tensions between Israel and Palestine; the coronavirus pandemic; criticism of fracking; the presidential campaign of Democrat Joe Biden and his running mate, Kamala Harris; and U.S. President Donald Trump and his policies, according to the report.

Some of this content came from a fake news site called "PeaceData," published in both English and Arabic. The domain associated with the site was registered on Feb. 6, according to the report by Graphika, a social network analysis company, which helped analyze the accounts for Facebook.

The creators behind these IRA-linked accounts and pages hired freelance writers to produce content subjects for the sites, according to the Graphika report. Twitter also noted that the accounts the company removed its platform had links to PeaceData.

The disinformation campaign used artificial intelligence-generated images to create fake personas, Graphika reports. Many of these fake profiles were also shared on Twitter and LinkedIn in an attempt to enhance the appearance of authenticity.

Fake personas associated with the "PeaceData" news site possibly created with AI tools (Source: Graphika)

"The ease with which influence operations can now leverage machine learning to generate fake profile pictures is an ongoing concern," the Graphika report notes. "At present, the AI-generated profile pictures used by influence operations have been relatively easy to recognize, and the use of such images does little to mask other behavioral clues."

The Facebook report and the Graphika analysis note that the latest Russian operations were small compared to the IRA trolls’ efforts in 2016. And it appears that the creators of these accounts were attempting to more carefully target users to influence their election-related decisions. Overall, the accounts had about 14,000 followers, with just over 200 followers of the English-language versions of these sites.

"It continues a trend of influence operations trying to use a smaller number of more convincing and carefully crafted accounts to target communities and publications," Graphika says.

More to Come?

Tom Kellermann, the head of cybersecurity strategy at VMware who served as a cybersecurity adviser to former President Barack Obama, expects to see more election-related misinformation behavior by the Russians and others over the next 60 days.

"The FBI director warned that our Cold War adversary is extremely active," Kellermann told ISMG. "We should be more concerned about efforts to hack voter rolls and subsequent integrity attacks."

Leo Pate, an application security consultant at security firm nVisium, notes that social media platforms such as Facebook and Twitter have gotten better at finding and removing this types of content, but that might not be enough to stop all the disinformation that is likely to come before November.

"It is great that Facebook and other social media platforms are developing processes to combat this," Pate tells ISMG. "However, these efforts are still in the early stages and it will be interesting to see if they mature, or even continue, beyond the 2020 U.S. presidential election."

Other Groups

In addition to the accounts and pages linked to the IRA, Facebook removed hundreds of other accounts that participated in other types of inauthentic behavior.

For example, Facebook removed 55 accounts, 42 pages and 36 Instagram accounts linked to CLS Strategies, a U.S. strategic communications firm. The company's accounts appeared to target users in Venezuela, Mexico and Bolivia in an effort to influence elections and politics there, according to Facebook’s report.

Facebook also removed 453 accounts, 103 pages, 78 groups and 107 Instagram accounts operated from Pakistan that focused on users in Pakistan and India. The posts appeared to be pro-India and against the Pakistani government.

IRA Sanctions

After the 2016 elections, U.S. intelligence agencies began dissecting the work of the IRA troll farm to determine how it used social media posts and fake news to create and amplify divisions over contentious issues, such as gun control, immigration and migration, according to news reports.

The IRA also attempted to interfere in the 2018 mid-term elections. In October 2019, the U.S. Treasury Department imposed a new round of sanctions on a close ally of Russian President Vladimir Putin, Yevgeniy Prigozhin, who the U.S. alleges provided financing for the IRA, as well as six employees, for their roles in trying to interfere in U.S. elections (see: Russian Troll Farm Targeted With Fresh US Sanctions).


About the Author

Scott Ferguson

Scott Ferguson

Former Managing Editor, GovInfoSecurity, ISMG

Ferguson was the managing editor for the GovInfoSecurity.com media website at Information Security Media Group. Before joining ISMG, he was editor-in-chief at eWEEK and director of audience development for InformationWeek. He's also written and edited for Light Reading, Security Now, Enterprise Cloud News, TU-Automotive, Dice Insights and DevOps.com.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.