02‌ ‌ IN‌‌DEPTH‌‌ANALYSIS‌ ‌ INFLUENCE‌‌THE‌‌INFLUENCERS:‌‌COVID‌‌VACCINE‌‌OPERATION‌‌FROM‌‌RUSSIA‌ ‌ By‌‌Ben‌‌Nimmo,‌‌Global‌‌IO‌‌Threat‌‌Intelligence‌‌Lead,‌‌and‌‌the‌‌IO‌‌Threat‌‌Intelligence‌‌Team‌‌ ‌ EXECUTIVE‌‌SUMMARY:‌ ‌ We‌‌removed‌‌65‌‌Facebook‌‌accounts‌‌and‌‌243‌‌Instagram‌‌accounts‌‌for‌‌violating‌‌our‌‌policy‌‌against‌‌ foreign‌‌interference‌,‌‌which‌‌is‌‌c ‌ oordinated‌‌inauthentic‌‌behavior‌‌‌on‌‌behalf‌‌of‌‌a‌‌foreign‌‌entity.‌‌This‌‌ network‌‌operated‌‌across‌‌over‌‌a‌‌dozen‌‌platforms‌‌and‌‌forums‌‌but‌‌failed‌‌to‌‌build‌‌an‌‌audience.‌‌It‌‌ originated‌‌in‌‌Russia‌‌and‌‌targeted‌‌audiences‌‌primarily‌‌in‌‌India,‌‌Latin‌‌America‌‌and,‌‌to‌‌a‌‌much‌‌lesser‌‌ extent,‌‌the‌‌United‌‌States.‌‌Our‌‌investigation‌‌found‌‌links‌‌between‌‌this‌‌campaign‌‌and‌‌Fazze,‌‌a‌‌ subsidiary‌‌of‌‌a‌‌UK-registered‌‌marketing‌‌firm,‌‌whose‌‌operations‌‌were‌‌primarily‌‌conducted‌‌from‌‌ Russia.‌‌Fazze‌‌is‌‌now‌‌banned‌‌from‌‌our‌‌platform.‌ ‌ This‌‌campaign‌‌came‌‌in‌‌two‌‌distinct‌‌waves,‌‌separated‌‌by‌‌five‌‌months‌‌of‌‌inactivity.‌‌First,‌‌in‌‌ November‌‌and‌‌December‌‌2020,‌‌the‌‌network‌‌posted‌‌memes‌‌and‌‌comments‌‌claiming‌‌that‌‌the‌‌ AstraZeneca‌‌COVID-19‌‌vaccine‌‌would‌‌turn‌‌people‌‌into‌‌chimpanzees.‌‌Five‌‌months‌‌later,‌‌in‌‌May‌‌ 2021,‌‌it‌‌questioned‌‌the‌‌safety‌‌of‌‌the‌‌Pfizer‌‌vaccine‌‌by‌‌posting‌‌an‌‌allegedly‌‌hacked‌‌and‌‌leaked‌ AstraZeneca‌‌document.‌‌It‌‌is‌‌noteworthy‌‌that‌‌both‌‌phases‌‌coincided‌‌with‌‌periods‌‌when‌‌a‌‌number‌‌ of‌‌governments,‌‌including‌‌in‌‌Latin‌‌America,‌‌India‌‌and‌‌the‌‌United‌‌States,‌‌were‌‌reportedly‌‌ discussing‌‌the‌‌emergency‌‌authorizations‌‌for‌‌these‌‌respective‌‌vaccines.‌ ‌ This‌‌campaign‌‌functioned‌‌as‌‌a‌‌disinformation‌‌laundromat.‌‌It‌‌created‌‌misleading‌‌articles‌‌and‌‌ petitions‌‌on‌‌multiple‌‌forums‌‌including‌‌Reddit,‌‌Medium,‌‌Change[.]org,‌‌and‌‌Medapply[.]co[.]uk.‌‌It‌‌ then‌‌used‌‌fake‌‌accounts‌‌on‌‌social‌‌media,‌‌including‌‌Facebook‌‌and‌‌Instagram,‌‌to‌‌seed‌‌and‌‌amplify‌‌ this‌‌off-platform‌‌content,‌‌using‌‌crude‌‌spammy‌‌tactics.‌‌The‌‌crux‌‌of‌‌the‌‌campaign,‌‌though,‌‌ appeared‌‌to‌‌be‌‌engaging‌‌influencers‌‌with‌‌pre-existing‌‌audiences‌‌on‌‌Instagram,‌‌YouTube‌‌and‌‌ TikTok‌‌to‌‌post‌‌content‌‌and‌‌use‌‌particular‌‌hashtags‌‌without‌‌disclosing‌‌the‌‌origin‌‌of‌‌the‌‌posts.‌‌This‌‌ use‌‌of‌‌influencers‌‌appeared‌‌to‌‌be‌‌in‌‌line‌‌with‌‌the‌‌firm’s‌‌advertised‌‌services,‌‌which‌‌included‌‌access‌‌ to‌“‌ a‌‌large‌‌list‌‌of‌‌bloggers‌‌from‌‌Youtube,‌‌Instagram,‌‌and‌‌Facebook...‌‌[where]‌‌Accounts‌‌are‌‌ready‌‌to‌‌ post‌‌your‌‌ads‌‌for‌‌reasonable‌‌pricing.‌‌Work‌‌with‌‌bloggers‌‌directly‌‌without‌‌any‌‌3rd‌‌party.”‌ ‌ JULY‌‌2021‌‌COORDINATED‌‌INAUTHENTIC‌‌BEHAVIOR‌‌REPORT‌ 7‌ ‌