Facebook on Thursday revealed that it has taken down more pages linked to Iran and Russia “for coordinated inauthentic behavior on Facebook and Instagram.”
Most of the examples Facebook offers originate from Iran, but some campaigns come from Russian actors. However, these were distinct campaigns, and while it’s easy to associate Iran with Russia, Facebook did not identify any correlation between the two.
“However, they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing,” Facebook explains in a detailed blog post.
The company also elaborated on the kind of action it takes and how it decides to remove bad actors. Rather than banning them immediately, Facebook studies the adversaries, looking into the complexity of their attacks to understand how to mitigate the problem and avoid future occurrences. That’s why Facebook may spend months investigating some of the suspect pages and accounts before removing them.
Facebook said it’s working with other tech companies, academic researchers, and law enforcement when dealing with cyber threats.
Facebook removed 652 pages, groups and accounts “for coordinated inauthentic behavior that originated in Iran and targeted people across multiple internet services in the Middle East, Latin America, UK, and US.” Here’s an example:
In addition to spreading fake news, some of these Facebook properties engaged in “traditional cybersecurity attacks,” including hacking attempts and spreading malware.
The company also removed an unspecified number of pages, groups, and accounts “that can be linked to sources the US government has previously identified as Russian military intelligence services.” These campaigns are unrelated to the Iranian efforts to disseminate fake news, Facebook says.
Furthermore, Facebook says that we’re looking at some of the same bad actors it removed before the 2016 election. The recent activity focuses on politics in Syria and Ukraine.
