Meta disrupted a Russia-based Coordinated Inauthentic Behavior (CIB) network targeting Europe, the Middle East, and Africa. This file contains indicators of compromise and a network summary from Meta’s Adversarial Threat Report H2 2026.
We disrupted a Coordinated Inauthentic Behavior network originating in Russia and targeting audiences in Europe (Ukraine, Moldova), the Middle East (the United Arab Emirates and Syria), and Africa (Libya and the Central African Republic). The operation maintained a cross-platform presence, including on Telegram, and we removed 16 Facebook accounts, 24 Pages, and 1 Group for violating our policy against Coordinated Inauthentic Behavior. About 64,600 accounts followed one or more of these Pages. We determined through these enforcement actions that the network engaged in around $27,600 in spending for ads on Facebook, paid for mostly in US Dollars. Although the actors behind this network took sophisticated measures to conceal their identities and location, Meta’s investigation attributed this activity to Russian individuals. Some of these individuals were previously suspected of ties to the Internet Research Agency, which was shuttered in 2023. We also observed overlaps with a Russian network that we previously linked to false flag real-world stunts in Germany and France, which we reported on in August 2024.
The operators behind this network engaged in complex deception by masquerading as legitimate local entities and creating fictitious opinion research pages, utilizing fake and compromised accounts to administer Pages and developing localized fictitious personas. To obfuscate their location, the network registered with phone numbers aligned with their target personas locations and utilized proxy IP infrastructure. The network also operated Telegram channels that impersonated prominent Ukrainian politicians. This network criticized the governments of Moldova and Ukraine and advanced narratives supporting the governments of Azerbaijan and the UAE. It also produced original video content designed to influence judicial proceedings related to an Interpol extradition request in the UAE and Azerbaijan. The network promoted the incumbent government in the Central African Republic. In Libya, the network posed as local news agencies, which shared narratives that were critical of Italy and the International Criminal Court.
Note: URLs have been defanged for safety. Replace [.] with . to resolve.
| Indicator Type | Indicator Value |
|---|---|
| Social Media Account | t[.]me/klichkovv |
| Social Media Account | t[.]me/rstefanchuk |