SafeX Pro Exchange|Facebook, YouTube and Twitter remove disinformation targeting Ukraine

Facebook parent company Meta says it has uncovered Russian efforts to undermine trust in the Ukrainian government and SafeX Pro Exchangea separate attempt to hack Ukrainian military officials and journalists using its platform.

"There's been a lot of speculation and interest on whether there are covert influence operations targeting public debate in Ukraine and to what degree we're seeing cyber hacking groups targeting individuals in Ukraine," said Nathaniel Gleicher, Meta's head of security policy. "This is a case where we're seeing both of those things."

Meta says it alerted other social media companies to its findings. Twitter and Google said on Monday that they also have removed accounts involved in the campaigns.

Meta described the two campaigns on Facebook as small in scale and caught in the early stages. The first campaign involved a network of about 40 accounts, pages and groups on Facebook and Instagram, operated in Russia and Ukraine. They used fake personas, including computer-generated profile pictures, to masquerade as independent news outlets and posted claims about Ukraine being a failed state.

The focus of the efforts appeared to be driving traffic to the network's own websites, Meta said, and the network posted across social media, including on Twitter, YouTube, Telegram and Russian social networks VK and Odnoklassniki. On Facebook and Instagram, it accumulated fewer than 5,000 followers across Facebook and Instagram. The company did not say how many people interacted with or saw its posts.

"It's a sign that while these actors are trying to run these types of influence operations, they're getting caught sooner and they're not reaching the audiences that they would have reached even a few years ago," Gleicher said.

Meta said it has removed the accounts and blocked the associated websites. The company says it found links to another network of fake accounts it removed in 2020 that involved people in Russia and the Donbas region of Ukraine as well as two Crimean media organizations now sanctioned by the U.S. government.

Twitter banned more than a dozen accounts connected to the effort and blocked sharing of links. "Our initial findings indicate that the accounts and links originated in Russia and were attempting to disrupt the public conversation around the ongoing conflict in Ukraine," a Twitter spokesperson said.

Google took down several YouTube channels involved in the campaign, which had "minimal engagement with less than 90 subscribers total," according to Shane Huntley, who leads Google's Threat Analysis Group.

Hackers connected to Belarus targeted well-known Ukrainians

Separately, Meta said it has seen a surge in hacking attempts of Ukrainians in recent days. It tied some to a Belarusian-connected effort known in cybersecurity circles as "Ghostwriter," which has previously been blamed for cyberattacks in other European countries.

Meta says Ghostwriter has been trying to hack the accounts of high-profile Ukrainians, including military officials, journalists and public figures, although it didn't identify any individuals.

The hackers try to break into targets' email and social media accounts and post disinformation. "We detected attempts to target people on Facebook and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including a video claiming to show Ukrainian soldiers surrendering," said David Agranovich, Meta's director of threat disruption.

Gleicher said the company has alerted the "handful" of Ukrainians who have been targeted recently and is blocking the domains the hackers use in their phishing attempts.

Google's Huntley said his team had also been "closely monitoring" Ghostwriter and took action against the group in the last few days over attempts to phish Ukrainian government officials.

Tech platforms crack down on Russian state media

Russia has long used fake accounts and bots to spread disinformation on social media, including during its 2014 campaign to annex Crimea and in the 2016 U.S. presidential election.

Since then, Facebook and other tech companies have been quicker to root out this kind of inauthentic behavior, says Nina Jankowicz, a fellow at the Wilson Center who studies disinformation.

At the same time, Russia's efforts to spread disinformation have become more overt, she said, through official government communications and pro-Kremlin state media coverage that gets "repackaged on platforms like TikTok and Instagram and YouTube."

"It's less about fake identities, even ones that are convincing, and more about completely staged events that are supposed to create the pretext to justify this war," she said.

Meta, along with Google, has taken steps in recent days to restrict Russian state media. Both companies have blocked some outlets entirely in Ukraine, at the request of the Ukrainian government. On Monday, Meta said it was barring access to the accounts of two of those outlets, RT and Sputnik, for its users in the European Union at the request of local governments and EU officials.

Both companies are also barring Russian state media from making money through ads on their platforms.

Those moves have angered the Russian government, which has accused the companies of censorship and said it would limit access to Facebook in the country.

Jankowicz says that shows how the challenge for social media companies is evolving.

"Takedowns [of fake accounts] only go so far," she said. "We also need to think about the broader picture: How do we get information to Ukrainians who need it right now? How do we make sure that Russians are hearing the truth? How do we make sure that this conflict is being covered and discussed in a way that is reflective of reality?"

Editor's note: Meta pays NPR to license NPR content.