Russian internet trolls appear to be shifting strategy in their efforts to disrupt the 2020 U.S. elections, promoting politically divisive messages through phony social media accounts instead of creating propaganda themselves, cybersecurity experts say.

The Kremlin-linked Internet Research Agency may be among those trying to circumvent protections put in place by companies including Facebook Inc. and Twitter Inc. to find and remove fake content that hackers created to sow division among the American electorate in the 2016 presidential campaign.

“Instead of creating content themselves, we see them amplifying content,” said John Hultquist, the director of intelligence analysis at FireEye Inc. “Then it’s not necessarily inauthentic, and that creates an opportunity for them to hide behind somebody else.”

Other hackers are breaking into computing devices and using them to open large numbers of social media accounts, according to Candid Wueest, a senior threat researcher at Symantec Corp. The hacked devices are used to create many legitimate-looking users as well as believable followers and likes for those fake users.

While covert efforts to amplify divisive content originated by others isn’t a new technique, hackers and trolls seem to be embracing it heavily in advance of the next U.S. presidential election.

Wueest said he observed a decrease in the creation of new content by fake accounts from 2017 to 2018 and a shift toward building massive followings that could be used as platforms for divisive messages in 2020.

FBI’s Concern

FBI Director Christopher Wray, speaking at the RSA Conference in San Francisco on Tuesday, said social media remains a primary avenue for foreign actors to influence U.S. elections, and the bureau is working with companies on the problem.

“What has continued virtually unabated and just intensifies during the election cycles is this malign foreign influence campaign, especially using social media,” Wray said. “That continues, and we’re gearing up for it to continue and grow again for 2020.”

Yet removing foreign influence campaigns remains a slippery task for social media companies.

Nathaniel Gleicher, the head of cybersecurity policy at Facebook, said policing those efforts is “an incredibly hard balance.”

Companies must “identify ways to impose more friction on the bad actors and the behaviors that they’re using without simultaneously imposing friction on the meaningful public discussion,” Gleicher said.

Contact us at letters@time.com.