‘Smash and grab’: Meta uncovers Russia's ‘largest and most complex’ info op since the war began

Russia set up a sprawling and sophisticated network of websites impersonating mainstream media outlets, which it used to spread anti-Ukrainian messaging that was amplified via fake social media accounts, Meta has found. In a new report published Tuesday, Meta called it Russia’s “largest and most complex” influence operation since the war in Ukraine began.

According to the report, between June and September, Russian agents set up more than 60 websites that spoofed actual news sites, including those of The Guardian and German publishers Der Spiegel and Bild. (Disclosure: Bild and Protocol are both owned by Axel Springer.) The sites, which primarily targeted users in Germany, France, Italy, Ukraine, and the U.K., were meticulous imitations of the real thing, borrowing not just the format and design of the actual news sites, but in some cases also the photos and bylines of real reporters.

The Russian actors used these sites and fake online petitions to push false narratives — including that Ukraine had staged the murder of civilians in Bucha — and then promoted their work on Facebook, Instagram, YouTube, Telegram, Twitter, Change.org, Avaaz, “and even LiveJournal,” the report reads. All told, Facebook and Instagram removed nearly 2,000 accounts, more than 700 pages, and one group, and detected some $105,000 in advertising. As Facebook and Instagram worked to shut the network down, more websites continued popping up.

“This suggests a persistence and a continued investment in the cross-internet activity,” David Agranovich, Meta’s director of global threat disruption, said on a call with reporters. In some cases, the posts were boosted by official Russian diplomatic pages.

But while the network of websites was developed with care, the fake accounts were more of a "smash-and-grab," the report said. Many of them were detected by the company’s automated systems, before Meta even began its investigation. “It presents as a really unusual combination of sophistication and brute force,” Agranovich said.

In addition to the Russian network, Meta also detected a Chinese influence operation targeting the U.S. and Czechia. While less expansive than the Russian network, the Chinese operation was noteworthy, Meta executives said, for the way it tried to stake out both sides of contentious topics, like gun rights and abortion access. “While it failed, it’s important, because it’s a new direction for Chinese influence operations,” said Ben Nimmo, Meta’s global information operations threat intelligence lead.

Meta has shared its findings with other companies that were targeted by these information networks, as well as with governments and law enforcement. The company is also making the list of fake domains public “to enable further research,” Agranovich said.

Meta’s report comes one day after Google researchers said pro-Russian hackers are coordinating with the Russian military to carry out cyberattacks in connection with the war in Ukraine. “We have never previously observed such a volume of cyberattacks, variety of threat actors, and coordination of effort within the same several months,” the Google report read, according to The Wall Street Journal.

In some ways, the Russian playbook now mirrors the one it used in the run-up to the 2016 election, when Russia's Internet Research Agency created phony news sites that focused on race relations and other heated topics in the U.S., then pushed them on U.S. social media. But the intricate impersonations of actual news sites demonstrates a new level of investment by the Russians.

And yet, Agranovich said one encouraging sign was the relative lack of traction Russia’s information operation got on Facebook and Instagram this time. “They were kind of throwing everything at the wall and not a lot of it’s sticking,” he said. But he cautioned, “That doesn’t mean we can say mission accomplished.”