Meta Platforms Inc. Report Hacker Group Targeting Public Figures In Ukraine

JAKARTA – A surprising announcement from Meta Platforms Inc. The parent company of Facebook said the hacker group had used their social media platform to target public figures in Ukraine.

Those targeted included prominent military officials, politicians and journalists. This came as the social media company announced measures against covert influence and hacking amid Russia's ongoing invasion of Ukraine.

Meta said in the past 48 hours it had separately removed a network of about 40 fake accounts, groups and pages on Facebook and Instagram operating from Russia and Ukraine. These fake accounts target people in Ukraine, and violate Facebook's rules against coordinated inauthentic behavior.

A Twitter spokesperson also said the microblogging company had also suspended more than a dozen accounts and blocked the sharing of some links for violating its rules against platform manipulation and spam.

Twitter said its ongoing investigation indicated that the accounts were from Russia. They seek to disrupt public conversation around the conflict in Ukraine.

A YouTube spokesperson for Alphabet Inc also said it had suspended several YouTube channels. The account has fewer than 90 subscribers in total, as part of its investigation into coordinated influence operations linked to Russia.

In a blog post on Monday, Meta linked the hacking attempt to a group known as Ghostwriters. The group is said to have managed to gain access to the social media accounts of the targets.

Meta said the hackers attempted to post YouTube videos of accounts depicting Ukrainian troops weakening. This includes a video purported to show Ukrainian soldiers coming out of the jungle and waving a white flag in surrender.

Ukrainian cybersecurity officials said Friday, February 26, that hackers from neighboring Belarus also targeted the personal email addresses of Ukrainian military personnel "and related individuals." They blamed the group, codenamed UNC1151, for the action.

US cybersecurity firm FireEye has previously linked the group to Ghostwriter activity.

The Meta security team said it had taken steps to secure the targeted accounts and had blocked the hackers' phishing domains. They declined to name the target but said they had warned users where possible.

Meta says the separate influence campaign, which uses a number of fictional personas, claims to be based in Kyiv and runs a small number of websites masquerading as independent news outlets. This outlet publishes claims about the West having betrayed Ukraine and Ukraine is now a failed state.

Meta also said it had found links between this influence network and the operation it removed in April 2020, which had connected individuals in Russia, the Donbass region of Ukraine and two Crimea-based media outlets: NewsFront and SouthFront.

SouthFront said they had previously been banned by Facebook at least four times. They stated that the team was not in Crimea and that the coverage was objective. While NewsFront did not respond to a request for comment from Reuters on the case.

At a press briefing, Meta declined to give specific figures but said that influence campaign content has had "very low engagement rates" from either sharing, posting or reactions.

According to Meta, the campaign had fewer than 4,000 Facebook accounts that followed one or more of its pages and fewer than 500 accounts that followed its Instagram accounts. It is not stated how long the campaign has been active on the platform.

Meta said the campaign also used Twitter, YouTube, Telegram, and Russian social media sites Odnoklassniki and VK. Telegram and VK, which also owns Odnoklassniki, did not respond to requests for comment.

The crisis in Ukraine has led to escalating clashes between Moscow and big tech companies. On Friday, February 26, Russia said it would partially restrict access to Facebook.

According to Meta, Russia's move came after they rejected a request by the Russian government to stop independent fact-checking from several Russian state media. On Saturday, February 27, Twitter also said its service was restricted to some Russian users.

Ukraine itself has been exposed to digital intrusions and acts of denial of service both ahead of and during the Russian invasion, which Moscow calls "special operations". Several major technology companies have announced measures to improve the security and privacy of their users in the country.

Meta, which in recent days made changes, such as disabling search and viewing Facebook account friends lists in Ukraine, said on Monday it was also making these changes in Russia in response to public reports about civil society and protesters being targeted.