Russian agent accused of interfering in US elections is back meddling online, Facebook says

Andriy Derkach is tied to a new influence campaign.

A man the U.S. intelligence community has assessed is an active Russian agent who interfered in U.S. elections is back stirring the pot on Facebook, the company announced Thursday.

But this time, Andriy Derkach and associates appear to have been running influence operations targeted at Ukraine, not the U.S., Facebook said. The Treasury Department previously sanctioned Derkach, whom Treasury identified as being an “active Russian agent for over a decade,” for his alleged interference in U.S. elections.

Facebook said it removed the Ukraine-targeted campaign, which used fake accounts and its own websites to amplify its messaging, for violating its coordinated inauthentic behavior policy last month.

The campaign, which Facebook first caught onto following a tip from the FBI, focused on Ukraine politics and anti-Russia content. It’s not clear why a reputed Russian agent would circulate anti-Russia materials. The operators used multiple social media platforms and seemingly independent media websites and social media accounts to circulate content.

The takedown comes amid heightened tensions between Ukraine and Russia, which has been surging troops along its border with Ukraine in recent weeks.

The accounts associated with the network also shared positive content about Derkach and two other Ukrainian politicians, Volodymyr Groysman and Oleg Kulinich, Facebook said.

The Ukrainian-focused campaign appears to be separate from the efforts to interfere in U.S. politics, Facebook’s head of security policy, Nathanial Gleicher, clarified on a call with reporters Thursday.

To further boost its reach, the accounts associated with the network would share content and also comment on it to amplify its messaging, Facebook’s global influence operations threat intelligence lead Ben Nimmo told reporters on the call.

“It’s like a circle of fake support boosting the posts at every step,” Nimmo said.

Facebook suspects the accounts, which originated in and targeted Ukraine, are linked with three separate teams that work for Derkach, Groysman or Kulinich.

In total Facebook removed 477 Facebook accounts, 363 Pages, 35 Groups and 29 Instagram accounts linked with the network.

Facebook’s announcement comes amid a flurry of attention directed at Facebook and how it makes decisions about content allowed on its platform. Earlier this week the firm’s Oversight Board refused to make a final determination on Facebook’s decision to bar former President Donald Trump from Facebook earlier this year, in what some are saying is a “punt” back to Facebook to take ownership of its decisions on content moderation.

Facebook also removed other deceptive accounts originating and targeting Ukraine in April. Facebook ran another takedown of accounts targeting Ukraine due to apparent links with individuals associated with the Ukrainian political party of Sluha Narody. These pages shared a blend of content from legitimate news entities in Ukraine as well as their own content about corruption, politics, the coronavirus and criticism of opposition parties and politicians.

The group made efforts to conceal its activity. After Ukrainian journalists exposed some of their activity, they unpublished or deleted some of their pages and accounts in February.

Other accounts and groups Facebook removed from its platform included those with links to ANA, a nongovernmental organization in the Central African Republic; Peruvian political parties that were amplifying inauthentic messages related to Peru’s election; and two distinct and separate campaigns with links to Mexican politicians spreading information about Mexico’s elections from fake accounts. The company also conducted a takedown of fake accounts linked with Fatah, a political party in Palestine.

Facebook previously announced it took action against networks in Palestine that were using Facebook to distribute malware and hack people’s accounts. Those accounts, which Gleicher said do not appear to be linked with the campaign subject to the takedown in April, went after those that were perceived to be a threat to the Fatah-led government, such as dissidents and human rights activists.

Facebook also removed accounts and pages linked with the Defense Ministry of Azerbaijan that targeted Azerbaijan and Armenia.

In all, Facebook removed 1,656 Facebook accounts, 141 Instagram accounts, 724 pages and 63 groups in April.

Microsoft: Iran makes late play to meddle in U.S. elections

The effort from four separate groups includes both hacking attempts and fake news campaigns, according to the company.

Israeli influence operation highlights global disinformation industry

Russian information operation uses US celebrity Cameos to attack Zelensky

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems