Meta|
Image: Meta, Pono Lopez

Meta takes down hundreds of fake accounts linked to China and Russia

Social media giant Meta removed disinformation networks consisting of hundreds of fake accounts linked to Russia and China that targeted users in Europe, Ukraine and the U.S., the company said Tuesday. 

The Chinese and Russian networks recently discovered by Meta were unrelated, but their narratives overlapped in their criticism of the West — focusing in particular on sanctions against Russia and support of Ukraine, the researchers said.

Meta didn’t find sufficient evidence to attribute these operations to specific groups in China or Russia, the company told The Record. Their impact is also hard to measure because they used different platforms and fake websites to spread their narratives, according to David Agranovich, Meta’s director of Global Threat Disruption. 

On Facebook and Instagram, both networks had limited reach and were shut down before they could grow their audience, Agranovich said during a press call on Monday. 

However, the same bad actors used other platforms, including Twitter, Telegram, and YouTube, where their reach was harder to measure. 

The Chinese influence campaign, according to the report, wasn't well thought-out — some fake accounts made little attempt to appear realistic. However, the Russian campaign was one of the largest and most complex operations Meta has disrupted since the start of the war in Ukraine. “It demanded both technical and linguistic investment,” the company said.

Meta has been tracking coordinated inauthentic behavior on Facebook and Instagram for five years, but the number of fake accounts on these platforms hasn't appeared to decrease. In fact, the operations are becoming more sophisticated and harder to detect, researchers say.

“The bad actors won’t stop trying — our goal is to make their job harder, more costly, and less effective,” Meta’s Global Threat Intelligence lead Ben Nimmo said on Monday.

Russian influence campaign

Since the start of the war in Ukraine, Russian trolls and bots have focused mainly on the war in Ukraine. The campaign recently blocked by Meta is no exception.

From May to September, Russian operators ran a sprawling network of fake accounts on Facebook, Instagram, YouTube, Telegram, and Twitter, as well as on the Russian social networking service LiveJournal and popular petition platforms such as Avaaz and Change.org.

One of the German-language petitions posted by the group demanded that the German government stop its “unacceptable generosity” toward Ukrainian refugees.

On Facebook and Instagram, Meta found more than 1,600 accounts and 703 pages linked to the network. They had over 4,000 followers, both fake and real.

These accounts posted comments, memes, and articles criticizing Ukraine and Ukrainian refugees, praising Russia, and arguing that Western sanctions on Russia would backfire, Meta said. 

The campaign also created over 60 websites impersonating popular news organizations such as The Guardian, Der Spiegel, and Italy's ANSA news agency.

The fake websites were built with particular care, according to Meta. Some of them mimicked the exact appearance of real news sites and even used their cookie acceptance page.

The content, however, was different. Fake websites published articles portraying the Ukrainian government and armed forces as criminal and corrupt, and Russia as the victim of Western aggression.

Знімок-екрана-2022-09-27-о-17.22.12-768x775.png

A genuine article and a version that appeared on a spoofed website. Image: Meta

In one article posted on a website impersonating The Guardian, the campaign operators used a photo of a real journalist and the same timestamp as that journalist's authentic article.

The original story was about Russia’s atrocities during the occupation of Bucha, a Ukrainian city in Kyiv Oblast known for the murders and tortures of Ukrainian civilians by Russian forces. In a fake article, the Russians accused Ukraine of staging the murder of civilians in Bucha. 

The operators of the Russian network also created their own media brands. In June, for example, they launched a media outlet called RRN, or Reliable Recent News, which operated in English, French, German, Spanish, Italian, Chinese, and Arabic.

According to Meta, Russia has made significant investments in publishing content in multiple languages and making fake websites look authentic.

Chinese influence campaign

The Chinese influence operation, running between the fall of 2021 and 2022, wasn’t particularly sophisticated and didn’t have a wide reach, according to Nimmo.

What set it apart from the Chinese campaigns previously disclosed by Meta is that it was aimed at U.S. domestic politics, rather than foreign relations with China, according to Nimmo.

Some fake accounts impersonated conservative Americans and posted memes in English that accused President Biden and other politicians of corruption and called for gun rights and restrictions on access to abortion. They also accused the U.S. government of running bioweapons labs in Ukraine.

Other fake accounts posed as liberal Americans and posted criticism of the Republican Party for its stance on abortion access and gun rights. 

In the Czech Republic, the network was focused on criticizing the state’s support of Ukraine, and its impact on the Czech economy. It also criticized the government’s approach to China. “A trade war with China will hurt more than with Russia,” one post said. 

The operation was not particularly sophisticated, researchers said — they often posted content during working hours in China when their targeted audience, Americans and Europeans, were sleeping. 

Many Chinese-language accounts had female English names while their profile pictures were of men in formal attire. Few of their posts received any engagement, according to Meta.

Get more insights with the
Recorded Future
Intelligence Cloud.
Learn more.
No previous article
No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.