Meta disrupted a Russia-based Coordinated Inauthentic Behavior (CIB) network targeting Eastern Europe. This file contains Indicators of Compromise (IOCs) from Meta’s Adversarial Threat Report H1 2026.
We disrupted a network originating in Russia that targeted audiences in approximately 20 countries, including Ukraine, Moldova, Armenia, and several nations across Africa and the Middle East. We actioned 52 Facebook accounts, 134 Pages, and 35 Instagram accounts for violating our policy against Coordinated Inauthentic Behavior. About 238,000 accounts followed one or more of these Pages, and about 36,000 accounts followed one or more of these Instagram accounts. We attribute this activity with high confidence to Ruposters, a news aggregator based in Moscow with a public history of servicing government-related contracts and which we previously reported on in August 2024. The network engaged in around $49,000 in spending for ads on Facebook and Instagram, paid for mostly in US Dollars, to amplify narratives designed to expand Russian influence while undermining geopolitical rivals.
This operation, which began in early 2025, was notable for its focus on short-form video content and significant organic reach across social media platforms. The network impersonated diplomatic entities like the UN, and created localized media outlets to disseminate pro-Russian messaging. To maintain persistence and evade detection, operators relied heavily on proxy IPs for location spoofing.
Note: URLs have been defanged for safety. Replace [.] with . to resolve.
No IOCs associated with this report.