Main Highlights:
- Facebook asserts that it has dismantled a misinformation network comprised of individuals and websites propagating misleading information regarding Russia’s invasion of Ukraine.
- Meta, the social network’s parent company, indicated that the network was “tiny,” consisting of around 40 accounts, Pages, and Groups on Facebook and Instagram.
- According to Meta, the gang established websites masquerading as independent news organizations, propagating lies about the West betraying Ukraine and Ukraine being a collapsing state.
- The security community has identified a threat actor known as Ghostwriter with ties to Russia’s partner Belarus.
- The threat actor has attempted to hack into accounts and upload YouTube videos depicting the Ukrainian military as weak and willing to surrender to Russia.
Facebook claims it has taken down a disinformation network made up of individuals and websites spreading false information about Russia’s invasion of Ukraine. Meta, the leading social network firm, stated that the network was “quite tiny,” with around 40 profiles, Pages, and Groups on Facebook and Instagram. It’s unclear how the organization began functioning recently, but Meta reports that it had less than 4,000 Facebook followers and fewer than 500 Instagram followers.
According to Nathaniel Gleicher, Meta’s head of security policy, this is a hint that while these actors are attempting to conduct these influence operations, they are being detected earlier and are not reaching the audiences they would have gone even a few years ago.
Individuals in Russia and Ukraine controlled the network, creating fictitious identities across numerous social media platforms (including YouTube, VK, Telegram, and Meta’s platforms) to look legitimate to investigators. They posed as “news editors, a former aviation engineer, and the author of a scholarly article on hydrography” using AI-generated headshots as profile photographs.
According to Meta, the gang operated several websites posing as independent news organizations, spreading falsehoods like the West betraying Ukraine and Ukraine is a failing state. The business discovered connections between this network and another organization that it shut down in April 2020.
That previous group disseminated and promoted items from media outlets that the United States has since sanctioned. According to news reports on the locations, Ukrainian border guards have greeted Russian forces with open arms; the Ukrainian army employs people as human shields. The Ukrainian army is using UN-prohibited phosphorous munitions against the Russians. None of the content of these stories has been independently verified by news organizations outside of Russia.
Accounts targeted by Facebook:
Meta claims that Ukrainian military leaders and prominent personalities’ accounts are being targeted in addition to the disinformation network. The security community traced a threat actor known as Ghostwriter and has links to Russia’s ally Belarus. The threat actor has attempted to break into accounts and publish YouTube videos portraying the Ukrainian military as weak and surrendering to Russia.
Meta claims to have notified affected users, banned sites used in Ghostwriter’s phishing efforts (designed to obtain login information), and taken other unspecified actions to “protect accounts.”
According to Gleicher, there has been much conjecture and curiosity about whether covert influence operations target public discourse in Ukraine and to what extent cyber hacking groups are targeting people in Ukraine. They perceive both of those things in this instance.
The company said that Twitter has also started eliminating misinformation networks associated with Russia’s invasion of Ukraine. According to NBC News, the corporation has suspended more than a dozen accounts that shared links to a propaganda website called Ukraine Today.
According to a Twitter spokeswoman, the company permanently terminated more than a dozen accounts and restricted posting many links on Feb. 27 for violating its platform manipulation and spam policy. Their research is ongoing; however, their first results indicate that the accounts and linkages originated in Russia and were used to undermine public discourse surrounding Ukraine’s current crisis.