In an ongoing effort to safeguard the digital landscape and foster transparency, a notable disruption of coordinated inauthentic behavior (CIB) targeting Moldova has been reported. This initiative, part of broader threat disruption efforts, reveals significant findings that aim to bolster the security community’s ability to detect and counter malicious activity online. The following analysis offers an in-depth look at this operation, highlighting key details and broader implications.
Understanding Coordinated Inauthentic Behavior (CIB)
Coordinated inauthentic behavior refers to organized attempts to manipulate public discourse for strategic objectives. Central to such operations are fake accounts that collaborate to deceive others about their identities and activities. The focus of investigations into CIB is on behavior rather than content, meaning the origin, content, or intent—foreign or domestic—does not impact the investigation outcome. The primary concern is the deceptive nature of these operations.
Key Findings from the Investigation
The investigation led to the removal of several digital entities across platforms: seven Facebook accounts, 23 Pages, one Group, and 20 Instagram accounts. These were primarily based in the Transnistria region of Moldova and targeted Russian-speaking audiences. The operation was dismantled before it could establish significant followings on these platforms.
The CIB operation involved roughly a dozen fictitious Russian-language news brands, masquerading as independent outlets. They maintained a presence on platforms such as Telegram, OK (Odnoklassniki), and TikTok, in addition to more mainstream social media platforms. Notable brands included Tresh Kich, Moldovan Mole, Insider Moldova, and Gagauzia on Air.
The operators behind these activities used fake accounts to control Pages that posed as independent news entities. They posted content and directed users to off-platform channels, mainly on Telegram. Many accounts underwent name changes and used profile images likely generated by artificial intelligence techniques such as Generative Adversarial Networks (GAN).
Content and Engagement Tactics
The operation’s content strategy included original posts, such as cartoons, focusing on Moldovan news and geopolitical events. The content was often critical of President Sandu and pro-European Union politicians, promoting closer ties with Russia instead. Some posts offered incentives like money, food, and concert tickets to encourage Moldovans to follow them or engage with their brand through graffiti.
The operation also repurposed summaries from legitimate news outlets, like point[.]md, but with an added pro-Russia, anti-EU bias. They amplified content from a Moldovan political satire show critical of pro-European candidates. A particular Telegram channel linked to this operation had ties to a previously dismantled Russia-origin CIB network.
Investigative Insights
Through comprehensive internal investigations, links were uncovered between the operators and individuals from Russia and Moldova, particularly in the Transnistria region. Connections were also found to a fake engagement service offering artificial likes and followers across platforms like Facebook, Instagram, YouTube, OK, VKontakte, and Change.org. Additionally, limited connections to a previously removed network from Ukraine’s Luhansk region were identified.
Detailed Network Presence
- Facebook and Instagram: Seven Facebook accounts, 23 Pages, one Group, and 20 Instagram accounts.
- Followers: Approximately 4,200 accounts followed these Pages, and about 335,000 accounts followed the Instagram accounts. Most followers were outside Moldova, suggesting inauthentic engagement to inflate apparent popularity.
- Ad Spend: Around $4,000 spent on ads, mostly in US dollars.
Threat Indicators
Key threat indicators associated with this network were identified, although the sharing of links or engagement with them alone is insufficient to attribute accounts to this campaign without corroborating evidence. These indicators are organized using the Online Operations Kill Chain framework, which outlines the stages threat actors undertake to establish, disguise, engage, and respond to takedowns across the internet.
Phase: Acquiring Assets
- Facebook and Instagram: Acquisition of accounts, Pages, and Groups.
- TikTok: Accounts like tiktok[.]com/@trech_kich6 and tiktok[.]com/@moldova_acum.
- Telegram Channels: Acquisition of channels for broader communication.
- Other Social Media: Engagement on platforms such as OK.
Phase: Disguising Assets
- Fictitious News Outlets: Creation of outlets like Trech Kich, Moldova Online, Moldovan Mole, and others.
- Visual Disguise: Use of GAN-generated profile images to mask identities.
Phase: Evading Detection
- Camouflaging Content: Altering legitimate news content with pro-Russia, anti-EU bias.
Phase: Targeted Engagement
- Ads: Significant ad spend, mainly in US dollars.
- User Engagement: High follower counts, primarily outside Moldova, indicating inauthentic engagement.
- Audience Targeting: Focus on Russian-speaking Moldovans.
- Online Traffic Direction: Use of fake accounts to drive users to off-platform channels.
- Specific Content: Criticism of Moldovan President Sandu and pro-EU politicians, with support for pro-Russia parties.
Conclusion
This report underscores the ongoing battle to maintain the integrity of online platforms against coordinated inauthentic behavior. By dismantling this operation, the security community can better understand and counter such threats, safeguarding public discourse and fostering a transparent digital environment. As these findings are integrated into broader threat indicators, they will contribute to ongoing efforts to protect users across various internet services. For further details, refer to the original source here.
For more Information, Refer to this article.
