Facebook’s parent company, Meta, detailed on Thursday a series of shadowy cyber tactics it says Russian- and Belarus-linked groups are using to target Ukrainian soldiers and civilians.
Tactics the groups use include posing as independent online journalists and media outlets to push Russian talking points, attempting to hack into the Facebook accounts of dozens of Ukrainian soldiers, and conducting coordinated campaigns to try to remove posts by critics. of Russia from social networks. according to goal.
A hacking group known as “Ghostwriter”, which cyber experts believe is linked to Belarus, attempted to hack into the Facebook accounts of dozens of Ukrainian servicemen, the company said.
The hackers were successful in “a handful of cases,” Meta said, “posting videos asking the Army to surrender as if these posts came from the rightful owners of the accounts. We blocked these videos from being shared.”
Meta also noted that actions by Russian and Belarusian government-linked groups seemed to intensify shortly before the invasion, adding that he had observed that accounts linked to the Belarusian KGB “suddenly started posting in Polish and English about Ukrainian troops surrendering without a fight and the nation’s leaders fleeing the country on February 24, the day Russia started the war.”
Meta also said it had removed a network of around 200 Russian-operated accounts that repeatedly submitted false reports about people in Ukraine and Russia in an attempt to remove them and their posts from the platform. The accounts regularly falsely reported to Meta that people in Ukraine and Russia had violated the company’s rules on hate speech, as well as other policies. This tactic, known as “mass reporting,” is commonly used by people trying to shut down an opponent’s social media accounts.
Russia’s invasion led to a “huge increase in attacks on social media accounts through mass reporting,” said Vadym Hudyma, co-founder of Digital Security Lab Ukraine, an organization that helps protect the online accounts of journalists and activists.
Many of the selected Twitter and Facebook accounts were not verified, which made it difficult to recover the accounts of organizations that, for example, were raising money and coordinating medical supplies in response to the Russian invasion, Hudyma told CNN. “A lot of social media pages were temporarily closed. We probably got most of them back pretty quickly. But that was a disaster.”
Meta also said it continues to see fake profile photos used in disinformation campaigns.
In an earlier announcement in February, Meta said it had uncovered and shut down a Russian-influenced sting operation running accounts posing as people in kyiv, including news publishers, and targeting Ukrainians.
“They claimed to be based in kyiv and posed as news editors, a former aviation engineer and the author of a scientific publication on hydrography, the science of mapping water,” Meta said in a blog post.
It linked the fake accounts to people previously sanctioned by the US government. The accounts and websites run by this influence operation don’t appear to have been very successful in reaching many people, according to data reviewed by CNN.