Facebook parent company Meta detailed Thursday an array of shady cyber tactics that it says groups linked to Russia and Belarus are using to target Ukrainian soldiers and civilians.
The tactics the groups are using include posing as journalists and independent news outlets online to push Russian talking points, attempting to hack dozens of Ukrainian soldiers’ Facebook accounts, and running coordinated campaigns to try to get posts by critics of Russia removed from social media, according to Meta.
A hacking group known as “Ghostwriter,” which cyber experts believe is linked to Belarus, attempted to hack into the Facebook accounts of dozens of Ukrainian military personnel, the company said.
The hackers were successful in “a handful of cases,” Meta said, and “they posted videos calling on the Army to surrender as if these posts were coming from the legitimate account owners. We blocked these videos from being shared.”
Meta also noted that actions by groups linked to the Russian and Belarusian government appeared to intensify shortly before the invasion, adding that it had observed that accounts linked to the Belarusian KGB “suddenly began posting in Polish and English about Ukrainian troops surrendering without a fight and the nation’s leaders fleeing the country on February 24, the day Russia began the war.”
Meta also said it had removed a network of about 200 accounts operated from Russia that repeatedly filed false reports about people in Ukraine and Russia in an attempt to get them and their posts removed from the platform. The accounts regularly falsely reported to Meta that people in Ukraine and Russia had broken the company’s rules on hate speech as well as other policies. This tactic, known as “mass-reporting,” is commonly used by people trying to have an opponent’s social media accounts shut down.
Russia’s invasion brought a “huge surge in attacks against social media accounts via mass reporting,” said Vadym Hudyma, co-founder at Digital Security Lab Ukraine, an organization that helps secure the online accounts of journalists and activists.
Many of the targeted Twitter and Facebook accounts were not verified, which made it harder to recover the accounts of organizations that were, for example, raising money and coordinating medical supplies in response to the Russian invasion, Hudyma told CNN. “Many social media pages were temporarily shut down. We’ve probably recovered most of them quite quickly. But that was a mess.”
Meta also said it continues to see the use of fake profile photos in disinformation campaigns.
In a previous announcement in February, Meta said it had had discovered and shut down a covert Russian influence operation that ran accounts posing as people in Kyiv, including news editors, and targeting Ukrainians.
“They claimed to be based in Kyiv and posed as news editors, a former aviation engineer, and an author of a scientific publication on hydrography — the science of mapping water,” Meta said in a blog post.
It tied the fake accounts to people previously sanctioned by the US government. The accounts and websites run by this influence operation do not appear to have been very successful in reaching a lot of people, according to data reviewed by CNN.
