Make haters your waiters when you read the semi-annual adversarial threat report of disappointment

Welcome to Memetic Warfare.

Well, it’s slowly happening. Meta has now moved to semiannual adversarial threat reports.

In the past I’d have dropped whatever baby I was holding and immediately covered a Meta adversarial threat report, but I’ve become more and more jaded with what was once the crown jewel of the counter-IO scene.

Instead of more frequent and detailed reporting, we get far less reporting, far less primary-source data and much more AI nonsense. The scams section is fine but not particularly interesting to me.

Just going to put it out there guys - no one cares. The last Llama release was in April of 2025, which may as well be last century. Additionally, everyone usese AI for all types of purposes, we know. Not interesting.

Meta essentially uses these to pat itself on the back while providing less and less reason to do so. I used to defend Meta as one of the few companies that actually invested significantly in the space, and at this point I’m over it for reasons that you will see soon. The main point is below:

While I’m sure that Meta does cooperate with governments, law enforcement (though from what I hear from those in the know, this is severely lacking) and other industry peers, they absolutely do not work “across the defender community”.

I’ve shared information with multiple Meta teams on a number of occasions in the past years on serious, criminal offenses, not “disinformation”. While they were happy to take it and in a few cases action, in every single situation (with one minor information-sharing exception) it was entirely a one-way street, even in cases in which that was detrimental. Nor was every case handled effectively, and in no way did Meta work cooperatively with me on any cases.

I may not love their policies in general but I don’t particularly care when companies keep things quiet internally, but I can’t stand it when an organization prides itself on something it not only doesn’t do, but actively chooses to not do.

This isn’t in any way criticism of individuals at Meta, many of whom do fine work, but rather the choices made.

This specifically becomes relevant when the report covers “Endless Mayfly”, or the IUVM or whatever term one prefers.

I wrote about this with Max Lesser back when, when we pivoted off of initial findings from Microsoft to later find 19 domains - available here:

Meta then added to this some new findings of their own, such as new domains:

So far all well and good if a bit light on detail. They even add context on fingerprinting the domains based on “consistent elements” such as tags, plugins and more - great stuff, even finding a specific web designer that they don’t mention.

What drives me crazy here is that they refer to findings from my past report and the FDD which OpenAI happily referred to with a link, but they (Meta) refused to refer to, instead solely crediting Microsoft and OpenAI.

Good luck developing and contributing to the “community” with such practices, and also - publish some more detail next time. A few pages and some screenshots isn’t enough.

What makes me sad here isn’t the annoying practice of refusing to credit third party researchers, and not just myself. It’s more the decline of Meta’s adversarial threat team, publishing less frequently, with less detail all the while ignoring the broader community.

Now that my diatribe is over, let’s discuss some other findings. One that caught my eye was the use of “authentic operators”, meaning recruiting freelancers and influencers to run IO in Africa:

This was done via UpWork and targeted multiple countries, such as Nigeria, Mali, Burkina Faso, Senegal and more:

RT apparently also ran a similar type of operation by running a Cameroon-based freelancer:

The AI section was uninspired and not worth covering, so we’ll stop here with Meta and take a break for the rest of the week.