Meta says Russians targeting Ukrainians with misinformation and hacking attempts on Facebook
Facebook parent company Meta said Sunday night that it has taken down a coordinated Russian influence operation that was targeting Ukrainians across Facebook and Instagram. The company said the misinformation campaign has ties to another Russian network in the Donbas region that was previously banned from Facebook in April 2020.
In addition to the influence operation, Meta said it also took down a coordinated hacking group attempting to target and compromise accounts within Ukraine.
"We took this operation down, we've blocked their domains from being shared on our platform, and we've shared information about the operations with other tech platforms with researchers and with governments," David Agranovich, director of threat disruption for Meta, told reporters.
Agranovich said the coordinated campaign used fake accounts to target high-profile Ukrainians including journalists, members of the military and public thinkers. Those behind the campaign operated fictitious personas and were also active on YouTube, Twitter, Telegram, and two Russian social media sites "to appear more authentic" and "avoid scrutiny," Agranovich said.
The operation also ran a handful of websites, Meta said, which would publish claims about the West betraying Ukraine and Ukraine being a failed state. Agranovich said the content created by the influence operators was "primarily off of our platform."
"The idea was they would write an article, posting that article onto their website as if they were a reporter or a commentator and then the accounts were really just designed to post links to their own websites and direct people off platform," Agranovich said.
While Meta described the influence operation as a "relatively small network" consisting of approximately 40 accounts, pages, and groups across Facebook — with fewer than 4,000 followers on Facebook and not even 500 on Instagram — the company would not say how many users interacted with the misinformation or how many times the posts were shared with others.
"What we've generally found is that the best proxy for the size of these operations ends up being the number of people who follow them," Agranovich said. "In general, what we saw here was a very low level of shares, posts or reactions across any of the content that the network was posting."
Agranovich said Meta also detected attempts to "target people on Facebook and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including a video claiming to show Ukrainian soldiers surrendering."
Meta's head of security policy, Nathaniel Gleicher, said a handful of prominent Ukrainian journalists, military and other public figures were also targeted on Facebook by a hacking group known as Ghostwriter. Ghostwriter typically targets individuals through email, and then uses the compromised information to gain access to social media accounts.
"We do have a sense that Ghostwriter did successfully compromise some accounts on the Facebook platform," Gleicher said/
Meta said it is encouraging users in Ukraine and Russia to take extra measures with their online security. Gleicher noted that deterring hackers like Ghostwriter will require users to protect all of their devices and accounts on the internet.
Earlier this week, Meta rolled out a "Lock Your Profile" feature that allows users to lock their Facebook profile with one click. The feature prevents people who aren't friends with a user from downloading, enlarging or sharing the person's profile photo. Meta said it expects to roll out this tool for users in Russia, as it has noticed "increased targeting of protestors" in the country.
And while Meta has blocked monetization and ads from Russian state media entities — including in both Ukraine and the United States — it has yet to shut down accounts like RT and Sputnik that actively push Kremlin-backed disinformation.
Gleicher said Meta has taken steps to "demote the content" shared on its platforms "to make sure that the organic content as well isn't getting necessarily the level of reach that it might have been getting otherwise."
On Friday, Meta's vice president of global affairs Nick Clegg said Russian authorities ordered the company to stop fact-checking and labeling posts on Facebook by four Russian state-owned media organizations. "We refused," Clegg said, "as a result, they have announced that they will be restricting the use of our services."
Gleicher and Agranovich did not offer further details about Russia's threats to restrict Facebook's services, but Gleicher noted, "we've seen an indication that they will throttle us." He added that Meta believes its platforms are still accessible in Russia, despite a lack of access to other social platforms like Twitter.
Clegg also said the Ukrainians have suggested that Meta remove access to Facebook and Instagram in Russia. But he said "people in Russia are using FB and IG to protest and organize against the war and as a source of independent information."