Meta confirms U.S. military involvement in sprawling phony social media operation

Facebook's parent company provides additional evidence blaming the U.S. military for a long-running influence operation.

People associated with the U.S. military were behind dozens of phony Facebook accounts, more than a dozen pages, a pair of groups and 26 Instagram accounts that pushed pro-U.S. messaging while attempting to hide their real identities, Facebook’s parent company Meta said in a report published Tuesday.

After researchers first exposed the decade-long operation in August, the Pentagon ordered “a sweeping audit of how it conducts clandestine information warfare,” The Washington Post reported in September. Citing unnamed U.S. officials, the paper reported that U.S. Central Command was among the entities under scrutiny as part of their potential role in the operation.

A spokesperson for U.S. Central Command declined to comment Tuesday.

Tuesday’s report is the latest evidence pointing the finger at the U.S. military for its role in an operation that targeted audiences in the Middle East and Central Asia. The operation was first revealed in August when researchers with the Stanford Internet Observatory and social media intelligence company Graphika published findings on what they called “the most extensive case of covert pro-Western [information operations] on social media to be reviewed and analyzed by open-source researchers to date.”

Meta confirmed to CyberScoop at the time that the network originated in the U.S., while Twitter listed the presumptive “countries of origin” as the U.S. and Great Britain.

“Although the people behind this operation attempted to conceal their identities and coordination, our investigation found links to individuals associated with the U.S. military,” Meta wrote in its latest Quarterly Adversarial Threat Report, which the company publishes regularly to disclose its efforts in combating what it calls “coordinated inauthentic behavior.”

The activity in question included “several clusters” of activity focused on Iran, the Gulf, Central Asia, and the Middle East and North Africa, Meta said in Tuesday’s report. “Typically, each cluster posted about particular themes, including sports and culture in a particular country; cooperation with the United States, including military cooperation; and criticism of Iran, China, or Russia.”

The people behind the network posed as locals in the countries they targeted, Meta said, some of which used profile photos likely generated using machine learning techniques.

The operation does not appear to have been successful in spreading U.S. messaging. “The majority of this operation’s posts had little to no engagement from authentic communities,” Meta noted.

The August report from the Stanford Internet Observatory and Graphika, which was based on data provided by Meta and Twitter, described an “interconnected web of accounts on Twitter, Facebook, Instagram, and five other social media platforms that used deceptive tactics” that “appear to cover a series of covert campaigns over a period of almost five years rather than one homogeneous operation.”

The Twitter activity included nearly 300,000 tweets by 146 accounts between March 2012 and February 2022, the researchers noted. The Facebook activity included 39 profiles, 16 pages, two groups, and 26 Instagram accounts active from 2017 to July 2022.

Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute

The superseding indictment adds defendants and allegations against the Iranian firm accused of a massive cybertheft campaign against foreign universities and others.

Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn

Former NSA chiefs worry American offensive edge in cybersecurity is slipping

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure