Facebook this week decided to remove more than 30 pages and accounts from its main platform as well as from Instagram for what the company termed “coordinated inauthentic behavior”. Some of the accounts and pages seemed to be involved in promoting political protests and other related activity, and while Facebook didn’t directly attribute the campaign to Russian groups, company officials said some of the actions were closely related to what the Russian Internet Research Agency did on Facebook in 2016.

“It’s clear that whoever set up these accounts went to much greater lengths to obscure their true identities than the Russian-based Internet Research Agency (IRA) has in the past. We believe this could be partly due to changes we’ve made over the last year to make this kind of abuse much harder. But security is not something that’s ever done. We face determined, well-funded adversaries who will never give up and are constantly changing tactics,” Facebook officials said.

Since the aftermath of the 2016 presidential election and the revelations of concerted efforts from Russian groups to influence the election through Facebook and other avenues, the company has been working on ways to detect not just outright malicious activity, but patterns of behavior across accounts and pages that indicate coordinated influence campaigns. Some of the accounts Facebook disabled recently were being used to promote a supposed anti-fascist rally in Washington, D.C., next week and joined with apparently legitimate pages to organize the event. Facebook disabled the event on its platform and has begun informing people who signed up to attend it and also sent information to law enforcement agencies.

Although Facebook has a tremendous amount of resources at its disposal for investigating this kind of activity, the company stopped short of attributing this most-recent campaign to any specific group or country. Attribution remains one of the more difficult and thorny problems in security and Facebook is treading carefully. And with good reason. Organized attack groups, especially those affiliated with or sponsored by governments, often have distributed teams with diverse skill sets and frequently use false indicators and infrastructure in other countries in order to disguise their activities. Facebook officials said the group responsible for the current campaign may have learned some lessons from what happened before the 2016 election.