Hackers affiliated with the governments of Russia and Belarus have turned their attention to Ukraine since the Russian invasion began in February, attempting to use Facebook for cyberespionage and disinformation campaigns, the social network’s parent company, Meta, said on Thursday.
Some of the hackers, who had been focused on disinformation campaigns in Poland and the West, suddenly pivoted their attention to Ukraine, where they began trying to spread false messages about a Ukrainian military surrender, Meta executives said. Others blamed Russia’s invasion on NATO and accused Ukrainian forces of killing civilians, while amateur hackers tried to spread disinformation, remove Facebook accounts that criticized the invasion and profit off the crisis through scams.
“Since Russia’s invasion of Ukraine, we’ve seen attacks on internet freedom and access to information intensifying sharply,” said Nick Clegg, Meta’s president for global affairs. The company has scrambled in recent weeks to moderate conversations about the conflict on its platform, while also fending off hackers.
Ghostwriter, a hacking group affiliated with Belarus, has continued its efforts to break into dozens of Ukrainian military officials’ Facebook accounts and post false messages about a surrender, Meta said in a broader quarterly report about cyberattacks and disinformation on its platform. The company, which disclosed similar efforts by Ghostwriter last month, blocked the group from posting videos purporting to show surrendering soldiers, said Ben Nimmo, Meta’s global threat intelligence lead for influence operations.
Another group linked to the Belarusian K.G.B., which had focused on spreading disinformation in Poland, switched its focus to Ukraine as the conflict began and also tried to spread false surrender messages, Meta said in its report.
Russia’s Internet Research Agency, which has been known for creating misleading social media profiles and using them to spread disinformation, set up a website last year to spread messages about police violence in the West and tried to set up Facebook accounts in January and February to boost content from the website, Meta executives said. Meta blocked the profiles but noticed that, upon the invasion, the group suddenly began creating articles blaming NATO for the war in Ukraine and accusing the Ukrainian military of targeting civilians.
Civilians also jumped into the online conflict, Meta said. In the Luhansk region of Ukraine, websites and social media accounts that had promoted pro-Russian commentary were taken over by hackers, who directed their audiences to Telegram channels that showed images of Russian casualties. And in Russia, users established a Facebook group that purported to be for sharing cooking tips but was then used to mass-report profiles that criticized the invasion in an effort to get Facebook to remove them.
