Facebook uncovers disinformation and hacking campaigns targeting Ukraine

Shannon Bond

February 27, 2022 / 9:00 pm

caption: Meta said it has removed the accounts and blocked the websites being used to masquerade as independent news outlets and posted claims about Ukraine being a failed state.

Facebook parent company Meta says it has uncovered Russian efforts to undermine trust in the Ukrainian government and a separate attempt to hack Ukrainian military officials and journalists using its platform.

The two campaigns were both small in scale and caught in the early stages, the company said.

"There's been a lot of speculation and interest on whether there are covert influence operations targeting public debate in Ukraine and to what degree we're seeing cyber hacking groups targeting individuals in Ukraine," said Nathaniel Gleicher, Meta's head of security policy. "This is a case where we're seeing both of those things."

The first campaign involved a network of about 40 accounts, pages and groups on Facebook and Instagram, operated in Russia and Ukraine. They used fake personas, including computer-generated profile pictures to masquerade as independent news outlets and posted claims about Ukraine being a failed state.

The focus of the efforts appeared to be driving traffic to the network's own websites, Meta said, and the network posted across social media, including on Twitter, YouTube, Telegram and Russian social networks VK and Odnoklassniki. On Facebook and Instagram, it accumulated fewer than 5,000 followers across Facebook and Instagram. The company did not say how many people interacted with or saw its posts.

"It's a sign that while these actors are trying to run these types of influence operations, they're getting caught sooner and they're not reaching the audiences that they would have reached even a few years ago," Gleicher said.

Meta said it has removed the accounts and blocked the associated websites. The company says it found links to another network of fake accounts it removed in 2020 that involved people in Russia and the Donbas region of Ukraine as well as two Crimean media organizations now sanctioned by the U.S. government.

Separately, Meta said it has seen a surge in hacking attempts of Ukrainians in recent days. It tied some to a Belarusian-connected effort known in cybersecurity circles as "Ghostwriter," which has previously been blamed for cyberattacks in other European countries.

Meta says Ghostwriter has been trying to hack the accounts of high-profile Ukrainians, including military officials, journalists and public figures, although it didn't identify any individuals.

The hackers try to break into targets' email and social media accounts and post disinformation. "We detected attempts to target people on Facebook and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including a video claiming to show Ukrainian soldiers surrendering," said David Agranovich, Meta's director of threat disruption.

Gleicher said the company has alerted the "handful" of Ukrainians who have been targeted recently and is blocking the domains the hackers use in their phishing attempts.

Russia has long used fake accounts and bots to spread disinformation on social media, including during its 2014 campaign to annex Crimea and in the 2016 U.S. presidential election.

Since then, Facebook and other tech companies have been quicker to root out this kind of inauthentic behavior, says Nina Jankowicz, a fellow at the Wilson Center who studies disinformation.

At the same time, Russia's efforts to spread disinformation have become more overt, she said, through official government communications and pro-Kremlin state media coverage that gets "repackaged on platforms like TikTok and Instagram and YouTube."

"It's less about fake identities, even ones that are convincing, and more about completely staged events that are supposed to create the pretext to justify this war," she said.

Facebook, along with Google, has taken some steps in recent days to restrict Russian state media. Both companies are barring those outlets from making money from advertising on their platform and have blocked them entirely in Ukraine, at the request of the Ukrainian government. Those moves have angered the Russian government, which has accused the companies of censorship and said it would limit access to Facebook in the country.

Jankowicz says that shows how the challenge for social media companies is evolving.

"Takedowns [of fake accounts] only go so far," she said. "We also need to think about the broader picture: How do we get information to Ukrainians who need it right now? How do we make sure that Russians are hearing the truth? How do we make sure that this conflict is being covered and discussed in a way that is reflective of reality?"