Facebook has taken down 32 fake pages and accounts that it says were involved in coordinated campaigns on both Facebook and Instagram. Though the company has not yet attributed the accounts to any group, it says the campaign does bear some resemblance to the propaganda campaign run by Russia’s Internet Research Agency in the run-up to the 2016 presidential election. Facebook is now working with law enforcement to determine where the campaign originated.

“We’re still in the very early stages of the investigation, and we don’t know all the facts, including who might be behind it,” Facebook’s chief operating officer said on a call with reporters Tuesday.

According to Facebook, some 290,000 Facebook users followed at least one of these pages. The most popular ones were called Aztlan Warriors, Black Elevation, Mindful Being, and Resisters. Across the phony accounts and pages, Facebook found politically divisive content about, among other things, Immigrations and Customs Enforcement, President Trump, and the Unite the Right rally scheduled for Washington DC in August. These pages also organized about 30 events over the past year.

One event, a protest against Unite the Right in Washington called “No Unite the Right 2 – DC,” was scheduled for August 10th. It was co-hosted by other legitimate pages, and more than 3,000 people indicated they were interested in or planned on attending. The desire to get out ahead of this event, Facebook says, hastened its announcement. The company says it disabled the event on Tuesday and alerted the administrators of those pages. It will also notify those users who were interested in attending the event, but a spokesperson told WIRED it’s “premature” to alert all 290,000 people impacted by the campaign.

Shortly after the announcement, other organizers of the protest took to Twitter to object to Facebook’s suspension of the event. “I cannot believe I have to say this: the unite the right counter protest is not being organized by Russians,” wrote one user, Dylan Petrohilos. “We have permits in DC, We have numerous local orgs like BLM, Resist This, and Antifascist groups working on this protest. fb deleted the event because 1 page was sketch.” Petrohilos also tweeted that the event was founded by another group, not the Resisters page.

The news, which was first reported by The New York Times, is the first indication by Facebook that it’s detected this kind of activity in advance of the midterm elections in the United States. Just one week ago, in a call with members of the press, Facebook executives evaded several questions on the matter, saying only that the company would report any such activity to law enforcement. The company began looking into this particular network two weeks ago.

But Facebook has previously acknowledged that fake news sites originating in Macedonia popped up during the Alabama special elections last year. And in April, Facebook shut down hundreds more phony Russian pages linked to the IRA, which were targeting people in Russia, Azerbaijan, Uzbekistan and Ukraine.

Since late last year, Facebook has been using artificially intelligent tools to root out what it calls “coordinated inauthentic activity,” which is to say, phony accounts working together to spread a message. It’s also expanded its security team to 15,000 people, up from 10,000 last year when Facebook first identified the Russian trolls’ work.

And yet, Facebook says it’s harder to assign blame in this case than it was last year when the company discovered the IRA-linked accounts. While the IRA got sloppy with their work, paying for ads in rubles and revealing their Russian IP addresses, the actors behind this campaign used VPNs to hide their locations and paid third parties to purchase ads on their behalf. All in, the newly discovered pages and accounts bought 150 ads for approximately $11,000, the most recent of which was purchased in June 2018.

“We’re still investigating what happened, but whoever created this network of accounts took a lot of effort to hide their real identity so we don’t yet know for certain who is responsible,” Facebook CEO Mark Zuckerberg wrote in a separate post. “That said, some of this activity is similar to what the Internet Research Agency in Russia did before and after the 2016 US Presidential elections.”

There are also some loose ties to the IRA. One known IRA account, for example, was briefly a co-administrator on one of the suspended pages. “We think that is interesting, but not determinative, which is why we wanted to publish our findings while not relying upon that to do attribution,” said Facebook’s chief security officer, Alex Stamos.

The newly discovered network seems to have picked up right about the time the known IRA network fell silent. According to the ads published by the House Intelligence Committee earlier this year, the IRA pages that targeted the 2016 election began to taper off their advertising efforts in the spring of 2017. In this new network, the oldest page Facebook identified dates back to March 2017.

Facebook detected this activity relatively early compared to the IRA’s interference, the evidence of which wasn’t publicly announced until almost a year after the 2016 election. Now, the company says it is following thousands of leads, some of which stem from that investigation and some of which have been instigated by law enforcement. Facebook also says it has shared some of its information with other tech companies.

In a statement, senator Mark Warner, the Democratic vice chairman of the Senate Intelligence Committee, commended Facebook for proactively seeking out these accounts. “Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation, and I am glad that Facebook is taking some steps to pinpoint and address this activity,” Warner said. “I also expect Facebook, along with other platform companies, will continue to identify Russian troll activity and to work with Congress on updating our laws to better protect our democracy in the future.”

Facebook is not the first tech company to come forward with evidence of midterm meddling. Earlier this month, Microsoft disclosed that it has already spotted phishing attempts on three US political campaigns. The Daily Beast reported that hackers sent emails to senator Claire McCaskill’s staff, urging them to change their passwords, thereby leading staffers to a fake but convincing domain. Microsoft thwarted that particular attack, but the fight is hardly over.

“Russia continues to engage in cyber warfare against our democracy,” McCaskill said in a statement last week. “While this attack was not successful, it is outrageous that they think they can get away with this.”

The Department of Justice recently issued indictments on 12 Russian actors who were involved in hacking into the Democratic National Committee’s servers and the email account of Hillary Clinton’s campaign chairman John Podesta. Earlier this year, special counsel Robert Mueller indicted individuals associated with the Internet Research Agency. In both cases, investigators laid out in detail the extent of the Russian operations, down to the date and time of certain activities.

Now, Facebook says it is up to law enforcement to do the forensic analysis. “We believe law enforcement and the intelligence community will have a lot more information upon which they can draw,” Stamos said. He acknowledged, however, that there’s no telling if or when the company will be able to determine who exactly was behind this information blitz.

More Great WIRED Stories