Facebook said Thursday it disrupted several covert influence and espionage operations targeting Ukrainians, as the company has intensified its fight against campaigns seeking to influence public opinion about the war.
In its latest Adversarial Threat Report, the social media giant highlights several campaigns originating from government-linked groups in Russia and Belarus conducting cyber espionage operations directed at the Ukrainian telecom industry as well as the Ukrainian defense and energy sectors; tech platforms; and journalists and activists in Ukraine, Russia, and abroad, including efforts to falsely report Ukrainian users as breaking the rules and efforts to hack into the accounts of Ukrainian military personnel.
“We continue to see operations from Belarus and Russia-linked actors target platforms across the Internet,” Facebook Head of Security Policy Nathaniel Gleicher said during a call with reporters. “We know that determined adversaries like this will keep trying to come back.”
Facebook, which last year changed its name to Meta, said it has been fighting efforts by Russian authorities to promote propaganda about the war, including false claims about Ukrainian military aggression in the region or blaming Western nations’ complicity in the war. The company said it gave fact-checkers in the region more resources and launched a special operations center with Russian and Ukrainian speakers to monitor war-related issues on the platform.
Over the past few weeks, Facebook also started restricting access to Russian-state-controlled media and barred the outlets from placing advertisements on its networks. Russia announced that it was limiting access to Facebook to residents in the country. Traffic to two-dozen media channels backed by the Russian government on Facebook spiked in the early days of the invasion and then plummeted as the company instated a ban in Europe, a recent Washington Post analysis found.
More recently, Russian diplomats and state-backed media have been flooding Twitter with misinformation about Bucha, a suburb of Kyiv where world leaders have accused Russia of committing war crimes. Between Sunday and Wednesday, Russian propagandists have tweeted about Bucha at least 1,049 times with 612 of those coming from state officials, according to an analysis from the foreign-interference research group Alliance for Securing Democracy.
Facebook’s Thursday report outlines a laundry list of adversarial networks seeking to use the platforms to spread propaganda about the war.
The company disrupted an operation called Ghostwriter that has sought to hack into the Facebook accounts of dozens of Ukrainian military personnel. Typically, Ghostwriter targets people through phishing emails in an attempt to hack into social media accounts, according to the report. Then it posts disinformation as if it’s coming from an authentic person. In a few cases, the group posted videos calling on the army to surrender as if they were posting from authentic account owners.
Facebook removed a Russian-based network that sought to falsely report people in Ukraine and in Russia for various rule violations, including hate speech, to get their accounts and posts removed from the platform.
Facebook also disabled an operation linked to the Belarusian KGB that was posting false claims in Polish and English about Ukrainian troops surrendering and the nation’s leaders fleeing the country the same day Russia invaded.
The report also highlighted a range of bot activity, espionage, and coordinated attacks on Facebook and Instagram in a number of countries, including Azerbaijan, Brazil, Costa Rica, the Philippines, El Salvador, and Iran. Hackers in Iran were accused of targeting the Saudi military, dissidents and human rights activists from Israel and Iran, politicians in the US, and Iran-focused academics, activists, and journalists around the world with a range of malicious activity. The threat actors were mostly attempting to steal credentials.
The social media giant said it disrupted a complex network in Azerbaijan that was involved in cyber espionage and other activity that violated their platforms’ rules. The campaigns targeted democracy activists, opposition, journalists, and government critics in Azerbaijan.
Meta was able to confirm that the activity is tied to the Azeri Ministry of Internal Affairs and ranged from phishing, social engineering, and hacking to coordinated inauthentic behavior.