Meta disrupts influence ops targeting Romania, Azerbaijan, and Taiwan

In its quarterly Adversarial Threat Report, Meta said it had successfully disrupted three covert influence operations leveraging fake accounts and originating from Iran, China, and Romania.

“We detected and removed these campaigns before they were able to build authentic audiences on our apps,” the social media giant said.

A network originating in China targeted Myanmar, Taiwan, and Japan, for instance. Fake accounts – many of which detected quickly by Meta’s automated systems – were used to post content, manage Pages, and reach out to others.

The operation included three separate clusters of accounts where each targeted a particular country while posing as locals. Some of these accounts used profile photos likely created using AI.

Spreading a specific message on social media seems to have been the aim of the campaign. In Myanmar, for instance, the posts criticized the civil resistance movements and shared supportive commentary about the ruling junta.

In Japan, the campaign criticized Japan’s government and its military ties with the US, and in Taiwan, it posted claims that Taiwanese politicians and military leaders are corrupt, and ran Pages claiming to display posts submitted anonymously – in a likely attempt to create the impression of an authentic discourse.

According to Meta, people behind the campaign attempted to conceal their identity but the firm’s investigation found (PDF) links to two past China-based influence operations they had removed and reported back in 2022 and 2024.

Another campaign, originating in Iran, was aimed at Azeri-speaking audiences in Azerbaijan and Turkey across Meta platforms, X, and YouTube.

The counterfeit accounts created by the operation were used to post content, including in Groups, manage Pages, and comment on the network's own content so as to artificially inflate its popularity. Many of these accounts posed as female journalists and pro-Palestine activists.

“The operation also used popular hashtags like #palestine, #gaza, #starbucks, #instagram in their posts, as part of its spammy tactics in an attempt to insert themselves in the existing public discourse,” said Meta.

The operators posted in Azeri about news and current events, including the Paris Olympics, Israel’s 2024 pager attacks, boycott of American brands, and criticisms of the former US President Joe Biden’s and Israel’s actions in Gaza.

Meta took action against a network of 658 accounts on Facebook, 14 Pages, and two accounts on Instagram originating in Romania.

Meta attributes these activities to a known threat cluster dubbed Storm-2035, which Microsoft described in August 2024 as an Iranian network targeting American voters with “polarizing messaging” on presidential candidates, LGBTQ rights, and the Israel-Hamas conflict.

Finally, Meta took action against a network of 658 accounts on Facebook, 14 Pages, and two accounts on Instagram originating in Romania.

These accounts posed as locals in Romania posting about sports, travel, or local news and had a corresponding presence on YouTube, X, and TikTok, likely to backstop their fictitious personas and entities across the internet in an attempt to make them appear more credible, said Meta.

Even though the majority of these posts and comments received no engagement from authentic audiences, the campaign showed consistent operational security to conceal its origin and coordination, including by relying on proxy IP infrastructure.