Cyber Front Z, a Russian troll operation ousted from Facebook, was clumsy, ineffective, according to Meta
Cyber Front Z, a pro-Russian troll operation exposed in the days after the Russian invasion of Ukraine, “was clumsy and largely ineffective — definitely not ‘A team’ work,” security officials with Meta said Thursday.
In an analysis included in the company’s quarterly adversarial threat report, Meta officials described the group as a “poorly executed attempt, publicly coordinated via a Telegram channel, to create a perception of grassroots online support for Russia’s invasion by using fake accounts to post pro-Russia comments on content by influencers and media.”
The company detected the group’s activities on its platform in March after the St. Petersburg-based Fontanka media outlet exposed the group just 10 days after it was soliciting recruits online. Altogether, Meta officials said, the company took down 45 Facebook accounts and 1,037 Instagram accounts associated with Cyber Front Z.
The quarterly report also detailed the company’s efforts at disrupting various nontraditional networks, such as mass-reporting networks and brigading networks (groups of accounts harnessed to harass or abuse a target). It also highlighted the recent disruption of about tens of thousands of accounts spread across multiple clusters around the recent Philippine presidential elections, and the fact that the groups behind this kind of activity are increasingly relying on publicly available tools, making it both easier and harder to attribute.
Cyber Front Z remains active on Telegram, with 110,692 subscribers as of Aug. 4. Among the many posts Thursday was a note praising an Amnesty International report that criticizes Ukrainian military tactics, along with “memes from the Ministry of Defense for distribution,” according to a Google translation. Group administrators have said it’s simply a vehicle to counter Ukrainian and western narratives as part of any good Russian citizen’s patriotic duty, Vice reported in April.
Ben Nimmo, Meta’s Global Threat Intelligence Lead, told reporters Thursday that the original Fontanka story on the group did not include Meta accounts, such as Facebook or Instagram. But once the company began investigating its investigators found the Cyber Front Z accounts on Instagram and links to people who’d been associated with the Internet Research Agency, a Russian organization frequently tied to inauthentic social media accounts in the past.
The accounts were “low in sophistication, represented no distinct personas and were essentially fungible,” the company wrote in its analysis. “A large portion of them were detected and disabled by automation even before we found their link to this activity.”
The company took them down in early April, Nimmo said, and “we’ve continued to detect and disable their attempts to come back.” The time to detection and removal is key, he said, noting that prior IRA coordinated trolling efforts stretched back to 2013 and were not removed until 2017.
“The time span has shrunk from years to weeks,” he said.
The group’s tactics had evolved beyond other previous IRA-linked operations, the company said. Whereas in the past the idea was to create legions of phony accounts, this operation created a smaller number of credible fake accounts that existed across multiple platforms, “and tried to co-opt unwitting journalists by recruiting them to work for non-existent NGOs or news outlets.”
In some cases, the accounts copied and pasted pro-Ukraine comments “from the very groups [Cyber Front Z] explicitly opposed,” the report reads. “This might be a case of individual operators undermining this fictitious movement from within.”
Ultimately the group seemingly isn’t that successful, the report concludes, noting that it appeared to fake engagement on the back end, perhaps to convince their funders or employers.
“Some influence operations try to capitalize on public fear of influence operations by falsely claiming they were successful,” Nimmo said Thursday. “Taking them at face value would mean they’re believing they’re effective when they’re not.”
This story was featured in CyberScoop Special Report: War in Ukraine
