Fake user farms are often created in low-regulated countries and managers generate thousands of accounts that try to influence the way information is shared on the social media, giving "likes" and following users who normally pay to receive such interactions. Other interests may include spreading fake news by trying to trick the platform's algorithms into achieving greater reach, as well as tricking users into providing their personal information and being extorted or blackmailed on the network.
In this case, as noam Rotem and Ran Locar detected, members of the security team of the firm vpnMentor, who discovered the farm, in addition to selling the activity of these fake ones were also intended to spread misinformation through a network of automated accounts, tens of thousands of them (without specifying an exact figure) and that were based in all countries of the world, not only in those areas with less protection for Internet security, which made it difficult to find them.
The farm was detected to be controlled by a non-Instagram company somewhere in Central Asia, possibly in Kazakhstan or Armenia. From there, an automated process had been developed to control tens of thousands of Instagram accounts. Each account had its own avatar, bio... and came from a different part of the world. That is, it pretended to be created by a real person with their own posts, their own followers, their reactions and interactions with other profiles.
Generally, these types of accounts have highly automated interactions that make Instagram security systems or security companies suspicious, but in this case the activity of each of them was so personalized that it was difficult to recognize that there was an organized process behind them, since proxy servers and different IP addresses were used to hide the activity and that it seemed that each user was located in a different part of the world.
If 10,000 users join Instagram in a short period of time from a small town in Armenia this is easy to detect by Instagram, but in this case the farm activity was adequately hid, even different languages were used when using the account and all in an automated way.
After receiving the notice, Facebook and Instagram took less than 24 hours to delete accounts from this farm. According to the researchers, it is not known that the personal information of other Instagram users that these accounts may have accessed for illicit purposes has been used.