Facebook published its very first Threat Report Wednesday, revealing over 150 covert influence operations globally that the platform says it ultimately removed. The social media site reported on instances of coordinated inauthentic behavior and their retributions from 2017 thru 2020. In 2021, Facebook discovered dozens more.

The United States was the number one country most frequently targeted by these influence operations. It was also the fourth highest operator of coordinated inauthentic behavior globally. Ukraine was the second most-targeted country, and also fifth highest perpetrator globally.

Russia was the number one source of influence operations, or IOs, with 27 coordinated inauthentic behavior or CIB networks found and removed by Facebook. Yevgeny Prigozhin’s Internet Research Agency was associated with most networks in Russia. Prigozhin has a reportedly close relationship with Russian President Vladamir Putin. Next, came Iran with 23 networks. Nine of these networks had associations with the Iranian government, according to the report. However, almost half of all covert operations actually focused on domestic targets.

Behnam Ben Taleblu is a senior fellow with the Foundation for the Defense of Democracies. His expertise lies in Iranian political issues. He says that Iran is making a transition in its stratagem. “Iran’s main focus in cyberspace remains domestic,” Taleblu told this reporter. “But as evident with hacks of critical infrastructure of US partners in the Middle East as well an increasing use of social media to spread propaganda, this is a space to watch for US policymakers.”

When it came to the American presidential election in 2020, there was a three-way tie between the U.S., Russia and Iran for the top sources of CIB networks. In Russia, some of the same operations from 2016 reappeared in 2020 to target the U.S. leading up to the election. Two of Iran’s five networks had links to the Iranian government and the Islamic Republic of Iran Broadcasting. Facebook also discovered an email campaign, where Iranian IO actors posed as the Proud Boys.

“Iran-based hackers have shown an ability to follow and inject themselves into US domestic debates,” Taleblu said. Since many of these platform are banned for most Iranians, they see social media “more generally as a tool to be weaponized against their adversaries,” Taleblu went on.

Daniel Hoffman, Fox News contributor and former CIA station chief, said in an interview with this reporter that publishing a report of this nature is a step in the right direction. “We want our citizens to know what the risks are,” Hoffman said. “You don’t want to keep it a secret. The answer isn’t to shut things down, but educate the public.”

But, more cyber attacks are expected. In the Threat Report, Facebook says they also anticipate more operations in the future. Hoffman agreed, saying it’s a “dynamic process.”

“Bad guys are always trying to stay one step ahead,” Hoffman said.

You can follow Jenny Goldsberry on Twitter @jennyjournalism