Meta disrupted a Poland-based Coordinated Inauthentic Behavior (CIB) network targeting Poland. This file contains Indicators of Compromise (IOCs) from Meta’s Adversarial Threat Report H2 2025.
We disrupted a coordinated inauthentic behavior network originating in and targeting Poland. We actioned 55 Facebook accounts, 36 Pages, 23 Groups, and 1 Instagram account for violating our policy against Coordinated Inauthentic Behavior. About 49,000 accounts followed one or more of these Pages, about 1,100 accounts followed one or more of these Groups, and about 2,900 accounts followed one or more of these Instagram accounts. The network did not engage in paid advertising, instead relying on organic content amplification strategies to reach target audiences. Our investigation found direct links to an individual based in Poland, indicating a domestic operation seeking to influence local political conversations. We found this network following an internal investigation that identified sophisticated deceptive tactics designed to manipulate domestic political discourse.
We observed that network operators consistently amplified narratives critical of Warsaw Mayor Rafal Trzaskowski and the current Polish government while promoting content favorable to the Polish Law and Justice (PiS) Party. The network employed sophisticated persona development tactics, creating fake accounts with carefully crafted political identities spanning the ideological spectrum, including both left-wing and right-wing personas as well as accounts focused on historical interests. Operators strategically deployed culturally symbolic profile imagery to enhance the authenticity of their deceptive personas. These carefully constructed identities were then used to infiltrate and post content within civic groups that aligned with each persona’s stated political orientation in an attempt to simultaneously influence multiple users across the political spectrum. Beyond targeting Poland’s governing coalition through divisive messaging, the operation also demonstrated personal motivations, with operators attempting to boost their own authentic social media profiles alongside the coordinated inauthentic campaign.
Note: URLs have been defanged for safety. Replace [.] with . to resolve.
No IOCs associated with this report.