Meta Platforms said a group of hackers has used Facebook to target various Ukrainian public figures, including prominent military, politicians, and a journalist, as Russia’s invasion of the country unfolds.
Meta said that in the past 48 hours it had also separately removed a network made up of about 40 fake accounts, groups, and pages on Facebook and Instagram operating from Russia and Ukraine that targeted people from Ukraine, for violating their rules against what is known as coordinated inauthentic behavior.
A Twitter spokesman said it had also suspended more than a dozen accounts and blocked the sharing of several links for violating its rules against platform manipulation and spam. He said his ongoing investigation indicated that the accounts originated in Russia and were intended to disrupt the public conversation around the Ukraine conflict.
In a blog post-Monday, Meta attributed the hacking attempts to a group known as Ghostwriter, which it said gained access to the social media accounts of those affected. Meta said the hackers tried to post videos on YouTube from accounts that presented Ukrainian troops as weakened, including a video claiming to show Ukrainian soldiers emerging from a forest and waving a white flag of surrender.
Ukrainian cybersecurity authorities said Friday that hackers from neighboring Belarus targeted the private email addresses of Ukrainian military personnel “and related persons,” and blamed a group codenamed “UNC1151.” The American cybersecurity company FireEye has previously linked this group to Ghostwriter’s activities.
Meta’s security team said it had taken steps to secure the affected accounts and blocked phishing domains used by hackers. He declined to give the names of the targets but said he had alerted users as much as possible.
Meta said the separate influence campaign, which used a number of fictional characters, claimed to be based in Kyiv and ran a small number of websites posing as independent media outlets. These media outlets published claims about the West’s betrayal of Ukraine and about the fact that Ukraine is a failed state.
The company said it had found links between this influence network and an operation it eliminated in April 2020, which had connected with individuals in Russia, Ukraine’s Donbas region, and two Crimean-based media outlets — NewsFront and SouthFront, which are now sanctioned by the U.S. government. Neither NewsFront nor SouthFront immediately responded to requests for comment.
Meta declined to give a number of impressions or views of the influencer campaign’s content but said it had seen a “very low level” of actions, posts or reactions. He said the campaign had fewer than 4,000 Facebook accounts that followed one or more of his pages and fewer than 500 accounts that followed one or more of his Instagram accounts. It has not said how long the campaigns have been active on its platforms.
He said the campaign had also used Alphabet Inc’s YouTube, Telegram, and Russian social media Odnoklassniki and VK. YouTube, Telegram, and VK, which also owns Odnoklassniki, did not immediately respond to requests for comment.
The crisis in Ukraine has seen an escalation of clashes between Moscow and major tech companies. On Friday, Russia said it would partially restrict access to Facebook, a move Meta said came after it rejected a government request to halt independent fact-checking by several Russian state media outlets. On Saturday, Twitter also said its service was being restricted for some Russian users.
Ukraine has been rocked by digital intrusions and denial-of-service actions both in the run-up to and during the Russian invasion. Several large technology companies have announced measures to strengthen the security and privacy of their users in the country.
Meta, which in recent days has introduced changes such as removing the ability to view and search friends lists of Facebook accounts in Ukraine, said on Monday it was also making the change in Russia in response to public reports that civil society and protesters were being targeted.
News Source: Reuters
