Facebook-Parent Meta Says Ukraine's Military, Politicians Targeted in Hacking Campaign

Meta attributed the hacking efforts to a group known as Ghostwriter.

By Reuters | Updated: 28 February 2022 15:05 IST

Meta said hackers attempted to post YouTube videos from accounts portraying Ukrainian troops as weakened

Highlights

Hackers from neighboring Belarus were targeting the private email address
FireEye has previously connected the group with Ghostwriter activities
Meta said the separate influence campaign claimed to be based in Kyiv

Meta Platforms said a hacking group used Facebook to target a handful of public figures in Ukraine, including prominent military officials, politicians and a journalist, amid Russia's ongoing invasion of the country.

Meta said in the last 48 hours it had also separately removed a network of about 40 fake accounts, groups and pages across Facebook and Instagram that operated from Russia and Ukraine targeting people in Ukraine, for violating its rules against coordinated inauthentic behaviour.

A Twitter spokesperson said it had also suspended more than a dozen accounts and blocked the sharing of several links for violating its rules against platform manipulation and spam. It said its ongoing investigation indicated the accounts originated in Russia and were attempting to disrupt the public conversation around the conflict in Ukraine.

Russia to Restrict Facebook Access for 'Censoring' Its Media Over Ukraine Invasion

In a blog post on Monday, Meta attributed the hacking efforts to a group known as Ghostwriter, which it said successfully gained access to the targets' social media accounts. Meta said the hackers attempted to post YouTube videos from the accounts portraying Ukrainian troops as weakened, including one video which claimed to show Ukrainian soldiers coming out of a forest and flying a white flag of surrender.

Ukrainian cybersecurity officials said on Friday that hackers from neighboring Belarus were targeting the private email addresses of Ukrainian military personnel "and related individuals," blaming a group code-named "UNC1151." The US cybersecurity firm FireEye has previously connected the group with Ghostwriter activities.

Meta's security team said it had taken steps to secure targeted accounts and had blocked the phishing domains used by the hackers. It declined to give the names of any of the targets but said it had alerted users where possible.

Meta to Bar Russian State Media From Running Ads, Monetising on Platform

Meta said the separate influence campaign, which used a number of fictitious personas, claimed to be based in Kyiv and ran a small number of websites masquerading as independent news outlets. These outlets published claims about the West betraying Ukraine and Ukraine being a failed state.

The company said it had found links between this influence network and an operation it removed in April 2020, which it had connected to individuals in Russia, the Donbass region in Ukraine and two media outlets based in Crimea - NewsFront and SouthFront, which are now sanctioned by the US government. Neither NewsFront or SouthFront immediately responded to requests for comment.

Meta declined to give a number of impressions or views for the influence campaign's content but said it had seen a "very low level" of shares, posts or reactions. It said the campaign had fewer than 4,000 Facebook accounts following one of more of its pages and fewer than 500 accounts following one or more of its Instagram accounts. It did not say how long the campaigns had been active on its platforms.

It said the campaign had also used Alphabet's YouTube, Telegram, and Russian social media sites Odnoklassniki and VK. YouTube, Telegram, and VK , which also owns Odnoklassniki, did not immediately respond to requests for comment.

The crisis in Ukraine has seen escalating clashes between Moscow and major tech companies. On Friday, Russia said it would partially restrict access to Facebook, a move Meta said came after it refused a government request to stop the independent fact-checking of several Russian state media outlets. On Saturday, Twitter also said its service was being restricted for some Russian users.

Ukraine's health ministry said on Sunday that more than 300 children, had been killed since the beginning of the invasion.

Russia calls its actions in Ukraine a "special operation."

Ukraine has been buffeted by digital intrusions and denial-of-service actions both in the run-up to and during the Russian invasion. Several big tech companies have announced measures to bolster the security and privacy of their users in the country.

Meta, which has in recent days made changes like removing the ability to view and search the friends lists of Facebook accounts in Ukraine, said on Monday it was also making this change in Russia in response to public reports of civil society and protesters being targeted.

Gaana CEO and Spotify's India chief join us on Orbital, the Gadgets 360 podcast, to discuss India's unique music streaming landscape. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.