On Thursday, the company reported it was pulling off compromised pages and accounts that ‘manipulate public debate’ and were linked to Ukrainian politician parties and politicians.

“We removed 105 Facebook accounts, 24 Pages, and five Instagram accounts   that originated in and targeted Ukraine. We began looking into this activity after   reviewing public reporting by Bukvy, a news media organization in Ukraine. Our   investigation found links to individuals associated with Sluha Narodu, a political party in   Ukraine.”

According to the company’s  findings, “the people behind this network used a combination of authentic and fake accounts — some of   which had already been detected and disabled by our automated systems — to post, manage   Pages posing as independent news Pages, and drive people to off-platform websites   masquerading as news entities. Some of these accounts went through significant name changes   over time.”

“They frequently shared posts from legitimate news organizations in Ukraine, in   addition to posting their own content. This network unpublished and deleted many of its Pages   and accounts in February 2021 when some of this activity was reported on by Bukvy.”

The ‘Bukvy’ investigation earlier found that these groups and accounts shared content on politics, corruption, Covid-19 that planted manipulative narratives promoting the ruling ‘Servant of the People’ party and targeting  Zelensky’s political rivals Petro Poroshenko and Vitaliy Klitchko

The exposed network reportedly paid over $210,000 running coordinated influence campaigns and targeted Facebook ads.

 

The Facebook team also exposed another network of 477 Facebook accounts, 363 Pages, 35 Groups and 29 Instagram accounts that   ‘originated in and targeted Ukraine’.

According to the investigation,  the Ukraine-focused activity was attributed to entities and   individuals sanctioned by the US Treasury Department — Andriy Derkach, Petro   Zhuravel, also political consultants associated   with Volodymyr Groysman and Oleg Kulinich.

The assessment found that the network was run by  three separate   teams of operators — each connected to a different politician: Derkach, Groysman and Kulinich.

“The individuals behind this activity managed a long-running deceptive influence operation (IO)   across multiple social media platforms and their own websites, primarily copying and pasting news   content from other Ukrainian news media. They built a ready-made network of seemingly   independent media websites and social media assets that worked to promote content favorable to   the three politicians and their political groups,” says the company report.

The promotional campaign on Facebook reportedly cost  these politicians and their political consultants about $500,000  paid in the US dollars and Russian roubles.

Facebook called their coordinated activities a “network of networks” given the scope and sophistication of its operations that extended  across multiple internet platforms and their own  websites.

“We saw corresponding activity on YouTube, Telegram and the Russian network   VKontakte. We also saw at least a dozen branded websites, some of which changed their   domains repeatedly,” stated the report.

The assessment also highlighted  the tricks network operatives used to conceal their identity and   coordination.

“The records for their more recent websites are privacy-protected and obscure the   owners’ names. Their fake accounts were set up one by one or in small batches over a period of   months, likely to evade automated detection. Some of the accounts had detailed biographies to   appear more authentic, while some of their Groups and Pages appeared to have been purchased.   When it comes to their profile photos, we noticed a number of patterns [..] Some appeared to be   photos of other people taken from across the internet. Others used female photos likely   generated using machine learning techniques like generative adversarial networks (GAN). In an   unusual technique, some of the accounts had profile photos that looked like they were created   by scanning old-style printed passport photos.”

The network was found out to use similar patterns to boost engagement.

‘The fake accounts’ activity on some posts was perfunctory, and consisted of short comments —   only two or three words or memes and GIFs without text [..] The network used its fake accounts to boost its own content and comments about it. For   example, the first fake account would post a favorable article about a politician. Others would   then make supportive comments, more fakes would like the post, and still more would like the  comments.”

According to the Facebook assessment, ‘some of this network’s content supported the politicians and parties with whom the operators   were directly associated — Derkach’s Nash Krai Party, Groysman’s Ukrainian Strategy Party, and   Kulinich’s Trust (Dovira) group.’

The findings showed that ‘his network  posted supportive content and comments about a wide range of political actors in   Ukraine, across the entire political spectrum, seemingly without much ideological preference’. Among the political actors promoted by the network activities were  Viktor Bondar and the Revival Party   and the ruling ‘Servant of the People’ party.