Meta disrupts social media misinformation campaigns targeting Ukrainians

A pair of social media misinformation campaigns exploiting tensions in Russia and Ukraine were identified and disabled on Facebook over the weekend, according to two senior leaders at the social network’s parent company Meta.

One operation thwarted by Meta’s security team involved about 40 accounts described as “inauthentic” with some profile pictures suspected to have been generated artificially, Threat Disruption Director David Agranovich said Sunday night. The fictitious personas operated across the internet, the Meta employees said, including on Twitter, YouTube, Telegram and two Russian social media networks.

A silhouette of a hacker on the background with binary code is pictured in this undated stock photo.The campaign also included fake websites resembling news outlets that claimed to be based in Kyiv with the people behind the sites posing as news editors and expert sources.

The operation was connected to a campaign previously detected and taken down by Facebook in April 2020. At the time, the activity was found to have come from Russia, the Donbas region and two media organizations in Crimea.

“The campaign had a very limited following across its presence online,” Agranovich said.

When Meta took action against the accounts, they had fewer than 4,000 followers on Facebook and fewer than 500 on Instagram, Agranovich said. The security team did not say how many total impressions or views the inauthentic posts received.

Another operation involved the specific targeting of Facebook accounts belonging to members of the Ukrainian military, as well as politicians and a journalist. The profiles were used to share YouTube videos portraying Ukrainians as weak and surrendering to Russia, which Facebook said was done by compromising the accounts likely through personal email. One video appeared to show Ukrainian soldiers coming out of a forest waving a white flag.

The Meta employees did not disclose the total number of compromised accounts, only referring to them as “a handful.” They also did not reveal the names behind the accounts, citing privacy concerns.

While Facebook described the number of accounts affected as minimal, the phishing operation that led to the compromise was reportedly widespread and attributed by cybersecurity researchers to a previously known misinformation campaign called “Ghostwriter.”

“Ghostwriter has previously targeted the NATO alliance, seeking to erode support for the organization,” said Ben Read, director of Cyber Espionage Analysis at the cybersecurity firm Mandiant. “I wouldn’t be surprised if similar operations were seen in the near future.”

Mandiant has linked the “Ghostwriter” campaign to the Belarusian military, and concerns remain over the exploitation of Ukrainians’ personal data.

“Leaking misleading, or fabricated documents taken from Ukrainian entities could be leveraged to promote Russia- and Belarus-friendly narratives,” Read said.

In one example, a video that appeared to show a man with his leg blown off was shared by a Russian separatist militia on Telegram last week. The stump of the man’s leg was blurred.ABC News has tracked the spread of disinformation related to Ukraine and Russia across online forums and social media networks.

“Ukrainian punishers continue the genocide of the civilian population of Donbass,” the video’s caption read.

But other, unblurred videos of the scene show the man was, in fact, an amputee. There is no blood and the attachment for a prosthetic leg is clearly visible.

Facebook and Meta logos.At Meta, Facebook has increased its fact-checking capacity in Russia and Ukraine and added new features to protect Ukrainians and help them lock down their accounts and check privacy settings. Meta will now also extend some of those features to Russia in an effort to protect the increased targeting of Russian protesters, the company announced.

Earlier this week, Russian state media was barred from running ads or monetizing the platform.

“The Russian Government is already throttling our platform to prevent these activities,” Clegg said in a Tweet Sunday. “We believe turning off our services would silence important expression at a crucial time.”In response to calls for Meta to shut down Facebook and Instagram in Russia, Vice President of Global Affairs Nick Clegg said the company does not want to restrict services for Russians who are protesting and organizing against the war.