Meta says a hacking group has used the Facebook platform to target a range of public figures in Ukraine, including prominent military officials, politicians and a journalist, amid Russia’s ongoing invasion of the country.
Meta said it had separately removed over the past 48 hours a network of about 40 fake Facebook and Instagram accounts, groups and pages operating from Russia and Ukraine targeting people in Ukraine, for violating its rules against coordinated, inauthentic behavior.
A Twitter spokesperson said it had also suspended more than a dozen accounts and banned many links from sharing for violating its rules against platform manipulation and spam. She said her ongoing investigations indicate that the novels originated in Russia and were trying to disrupt the public conversation about the conflict in Ukraine.
Meta attributed the hacking efforts to a group known as Ghostwriter, which said it had succeeded in gaining access to the targets’ social media accounts.
Meta said the hackers attempted to post YouTube videos from accounts depicting Ukrainian forces as weak, including a video that purported to show Ukrainian soldiers emerging from a forest and raising a white flag of surrender.
Ukrainian cybersecurity officials said hackers from neighboring Belarus were targeting the private email addresses of Ukrainian military and associated personnel, and they blamed a group called UNC1151.
Cybersecurity firm FireEye previously linked UNC1151 to Ghostwriter’s activities.
The Meta security team said it took steps to secure the targeted accounts and blocked phishing domains used by hackers.
She declined to reveal the names of any of the targets. But it said it alerted users where possible.
Meta provides updates on user protection in Ukraine
Meta said a separate influence campaign that used a number of fictional characters claimed to be based in Kyiv. It ran a small number of websites masquerading as independent news outlets. These outlets published allegations about the West’s betrayal of Ukraine, and that Ukraine is a failed state.
The company said it had found links between this influence network and an operation it removed in April 2020. That operation linked individuals in Russia, the Donbass region of Ukraine and two Crimea-based media outlets NewsFront and SouthFront.
Meta declined to give the number of impressions or views of the influence campaign’s content. But she said she has seen a very low level of posts, posts or reactions.
It also did not mention the duration of the campaigns’ activity across its platforms. But she added that the campaign also used YouTube Telegram and Russian social networking sites Odnoklassniki and VK.
The crisis in Ukraine has seen an escalation of clashes between Moscow and major technology companies. Russia said it was partially restricting access to Facebook. Mita said the move came after she rejected a government request to stop independent fact-checking in several Russian state media outlets. Twitter also said its service is restricted for some Russian users.
Ukraine experienced a number of digital intrusions and denial of service measures in the lead-up to and during the Russian invasion. Several major technology companies have announced measures to enhance the security and privacy of their users in the country.
Meta, which removed the ability to view and search friend lists for Facebook accounts in Ukraine, said it’s also making the change in Russia in response to public reports of civil society and protesters being targeted.
