The second, posted by Resisters on June 16, shared the same meme as confirmed troll Instagram account @feminism.tag.

Left: Post by known Russian troll account “feminism.tag”, preserved by @UsHadrons. Right: Post by inauthentic Facebook account Resisters. (Source: Medium / UsHadrons / Facebook / @DFRLab)

The third, posted by Aztlan Warriors on June 28, 2018, shared the same meme as a post made by known troll farm Instagram account native_americans_united on July 1, 2017.

Left: Post by known Russian troll account “Black Matters”, preserved by @UsHadrons. Right: Post by inauthentic Facebook account Aztlan Warriors. (Source: Medium / UsHadrons / Facebook / @DFRLab)

In other words, three of the accounts which Facebook found to have been inauthentic posted images identical to those of accounts which were known to have been run by the troll farm in 2014–2017.

There are a number of possible explanations for this. It could be a coincidence. It could be the result of an external actor seeking to copy the troll farm — although in that case, such an actor might have been expected to reproduce its content more often.

It could also indicate that the three accounts were run by the same team in the troll farm as the earlier, known accounts, and that its members recycled some of their earlier content.

Language Clues

A further point, which @DFRLab previously reported, is the suspect accounts’ non-native use of English. A number of basic grammatical errors, especially from the Resisters page, were characteristic of native-Russian speakers.

These included an inability to use the words “the” and “a” appropriately, and an inability to match singular and plural nouns and verbs, as in this post, which argued that “a regular women need clothes too.”

Post by @resisters on June 11, 2018. (Source: Facebook / @resisterz)

This post began, “Since the beginning of the times,” and claimed that “finally the society realized that.”

Post by @resisterz on June 1. (Source: Facebook / @resisterz)

Another account, Progressive Nation, made similar gramatical errors, and also struggled with the possessive genitive. This post deriding U.S. President Donald Trump, for example, began, “Whomever said he’s the people president need a reality check.”

This post praised migrant workers as “a needed and important humans.”

Post by Progressive Nation on December 14, 2017. (Source: Facebook / Progressive Nation)

Relatively few of these accounts’ posts contained original text; most consisted of memes, or copied content from elsewhere. The number of grammatical errors to creep into so few posts was therefore all the more striking.

Conclusion

The importance of these various features is their cumulative effect. Taken individually, none would be conclusive. Taken together, they build a consistent picture, and each reinforces the others.

Facebook found that the Resisters page was, for a very brief period, administered by an account known to have been run from the troll farm in Russia. The same page made basic grammatical errors which are particularly characteristic of Russian speakers.

The Resisters and Aztlan Warriors pages on Facebook closely resembled Twitter accounts which were traced back to the troll farm, and which were created around the same time.

The Resisters, Aztlan Warriors, and Ancestral Wisdom pages all shared content which earlier troll accounts had posted. More broadly, they posted messaging which was closely aligned with the troll farm’s earlier productions, and which targeted discontent and division in social groups which the troll farm also targeted.

Facebook’s then-head of security, Alex Stamos, wrote that some of the tools, techniques and procedures of the latest accounts were “consistent with those we saw from the IRA in 2016 and 2017,” but that those practices “have been widely discussed and disseminated, including by Facebook, and it’s possible that a separate actor could be copying their techniques.”

While true, this did not explain the overlap with the Twitter accounts, which were created with very similar names, on very similar dates, and with very similar areas of focus, and were traced back to the troll farm.

In summary, the accounts which Facebook closed had connections with earlier troll farm accounts, shared content also posted by earlier troll farm accounts, made linguistic errors characteristic of earlier troll farm accounts, and appeared related to earlier troll farm accounts on Twitter.

We therefore conclude that the balance of probability — although not yet a certainty — is that these latest accounts were run by the troll farm, or a related or successor organization, and represented a continued attempt from within Russia to polarize political debate in the United States.