In its latest Adversarial Threat Report for Q1 2025, Meta has announced the takedown of three coordinated influence operations originating from Iran, China, and Romania. These campaigns were dismantled before they gained traction among authentic users on Meta’s platforms and beyond.
Romanian Election
One of the largest networks uncovered during the quarter was linked to Romania-focused activity. Meta took down a coordinated set of 658 Facebook accounts, 14 Pages, and two Instagram accounts. The campaign extended its reach across other platforms as well, including TikTok, X (formerly Twitter), and YouTube.
The actors behind this network used fake personas and posing as local Romanian residents to post content related to travel, sports, and local news. These accounts managed Facebook Pages, commented on content from politicians and media outlets, and redirected users to external websites. One such Page amassed over 18,000 followers before removal.
While the campaign failed to get significant traction from real users, it maintained a consistent presence across platforms to simulate credibility. According to Meta, the operation exhibited strong operational security (OpSec)measures to mask its origin, including the use of proxy IP infrastructure. Much of the activity was centered on current affairs and upcoming elections in Romania, with posts written in Romanian.
Iranian Network Targeted Azerbaijan and Turkey
Meta also shut down an Iranian operation targeting Azeri-speaking audiences in Azerbaijan and Turkey. This influence campaign comprised 17 Facebook accounts, 22 Pages, and 21 Instagram accounts.
Many of the accounts masqueraded as female journalists and pro-Palestine activists, engaging in self-amplification tactics by commenting on their own content within Groups and Pages to boost visibility. The posts often leveraged trending hashtags such as #palestine, #gaza, #starbucks, and #instagram in an attempt to insert themselves into relevant conversations.
The content pushed by this network included narratives around the Paris Olympics, Israel’s 2024 military actions, calls to boycott U.S. brands, and criticism of U.S. foreign policy, President Joe Biden, and Israeli operations in Gaza.
Meta attributed this campaign to Storm-2035, a known threat actor previously identified by Microsoft in August 2024. Storm-2035 has been linked to politically divisive messaging aimed at U.S. voters, covering themes such as the 2024 presidential race, LGBTQ+ rights, and the Israel-Hamas conflict. In a related move, OpenAI confirmed it had banned ChatGPT accounts used by the group to generate social media content.
China-Origin Campaign in Asia
The third operation Meta disrupted involved a network originating from China, targeting audiences in Myanmar, Taiwan, and Japan. The campaign used AI-generated profile photos and operated an extensive “account farm” to churn out fake accounts across Meta platforms.
Meta removed 157 Facebook accounts, 19 Pages, one Group, and 17 Instagram accounts tied to the campaign. The actors posted in English, Mandarin, Burmese, and Japanese, sharing content related to local and regional current events.
In Myanmar, posts called for an end to the ongoing conflict while supporting the country’s military junta and discrediting civil resistance movements. In Japan, the network criticized the Japanese government and its military ties with the United States. Meanwhile, the campaign in Taiwan centered on allegations of corruption among political and military leaders. Some Pages claimed to share anonymous user submissions, attempting to mimic organic grassroots discourse.
Conclusion
Meta’s Q1 2025 disclosures highlight the increasingly sophisticated and multi-platform nature of influence operations, as threat actors continue to blend localized narratives, fake personas, and AI-powered amplification techniques to manipulate online discourse.
These takedowns underscore the critical need for cross-platform collaboration, public-private partnerships, and proactive detection technologies to combat the information warfare in a hyperconnected world.
Source: https://transparency.meta.com/en-gb/integrity-reports-q1-2025/
Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
