A troll operation attributed to the Internet Research Agency or “troll factory” in Russia ran over 100 accounts on Instagram and Facebook, and posted divisive content from all political angles, right up to the eve of the U.S. midterm elections, according to traces of this activity left online.

Facebook took the accounts offline on November 5, 2018, the eve of the U.S. midterm elections, after a tip-off from U.S. law enforcement. Initial suspicions were that the accounts were run by the Internet Research Agency or “troll factory” in St. Petersburg, which targeted American social media users throughout 2014 through 2018 with divisive, inflammatory and election-related content. A website which claimed to be affiliated to the troll factory said it ran them, although any such claim should be viewed with caution.

On November 13, Facebook confirmed it had taken down 99 Instagram, 36 Facebook accounts, and six Facebook pages for “coordinated inauthentic behavior.” Around 1.25 million other users followed at least one of them. Facebook said that the inauthentic accounts “may have been connected” to the troll factory, but stopped short of attribution.

Ahead of the November 13 announcement, Facebook shared the Instagram account names with @DFRLab. Enough traces have survived online to illustrate the way this operation worked, posing as online interest groups, building an audience, and progressively inserting more polarizing and political content into the mix.

The overall strategy of promoting divisive political content matched those of earlier Russian operations. The latest operation stood out for its greater focus on celebrity groups, rather than single-issue political ones. This appears likely to have been an attempt to build audience appeal, while allowing the flexibility to switch from one hot political topic to another.

Troll Factory Resemblances

All the accounts which Facebook named were blocked before @DFRLab could review them. This analysis is based on residual posts, either from online caches or from shares. It therefore provides a snapshot of the accounts’ behavior, not a full catalog of their output.

Within that subset of residual posts, some of the suspect accounts shared content directly from the original troll factory. One account which focused on African American communities, @not_your_negro, shared a meme which was watermarked by known Russian troll account @woke_blacks_, and had also been posted by Russian troll account @afrokingdom_ .