Facebook banned an Albanian troll farm supporting exiled Iranian militants

Facebook took down more than 1,000 fake accounts in March, including a few hundred that were tied to a troll farm in Albania. The company shared the takedowns as part of its monthly report on coordinated inauthentic behavior on the platform.

In its report, Facebook named 14 different networks of fake accounts that were removed during the month of March. The fake accounts originated in a number of countries, including Iran, Spain, Mexico, Argentina, Egypt, Israel, Benin, Georgia, Comoros and El Salvador.

The company notes that most of these weren’t particularly successful, and many of the accounts were removed before they could amass a large following. “This is an ongoing pattern we have seen where we see threat actors continuing to try to use these techniques to manipulate public debates on our platforms, and off our platform more broadly on the internet,” Facebook’s Head of Security Policy Nathaniel Gleicher said during a call with reporters. “But because of the defensive efforts of teams, not just at Facebook, but around industry, in civil society and in government, we're seeing them get less and less traction.”

Facebook also detailed its investigation into a troll farm in Albania, which ran 128 Facebook accounts and 146 Instagram pages. The company said it tied the troll farm to an exiled Iranian militant group that’s now based in Albania. The fake accounts “targeted primarily Iran and also global audiences with content related to Iran,” and “put particular effort” into luring its followers to websites tied to the militant groups.

The accounts had gained about 9,000 followers on Facebook and 112,000 on Instagram. Facebook says the accounts were “most active” in 2017, but that it saw an uptick in activity during the second half of last year. The company notes that its investigation turned up several “hallmarks” of a troll farm that indicated the activity was all coming from a single location. Ben Nimmo, Facebook’s Global IO Threat Intelligence Lead, said that the accounts all posted regularly on the same schedule, with spikes in the morning and evening, with what appeared to be a lunch break in the middle of the day. “When you combine the daily posting pattern with the way the accounts are connected technically, it really looks like a team of trolls that are hot desking,” Nimmo said.