Illustration by Alex Castro / The Verge
Facebook says it’s dismantled a misinformation network comprised of individuals and sites pushing fake news about the Russian invasion of Ukraine.
The social network’s parent company Meta said the network was “relatively small,” consisting of about 40 accounts, Pages, and Groups on Facebook and Instagram. It’s not clear how recently the group had started operating, but Meta says it had attracted fewer than 4,000 followers on Facebook and fewer than 500 followers on Instagram.
“It’s a sign that while these actors are trying to run these types of influence operations, they’re getting caught sooner and they’re not reaching the audiences that they would have reached even a few years ago,” Nathaniel Gleicher, Meta’s head of security policy, told NPR.
The network was operated by individuals in Russia and Ukraine who set-up fake profiles across multiple social networks (including YouTube, VK, and Telegram, as well as Meta’s own platforms) in order to appear real to investigators. They used AI-generated headshots as profile pictures and posed as “news editors, a former aviation engineer, and an author of a scientific publication on hydrography.”
According to Meta, the group “ran a handful of websites masquerading as independent news outlets, publishing claims about the West betraying Ukraine and Ukraine being a failed state.” The company says that it found links between this network and another operation that it removed in April 2020.
That earlier group shared and promoted articles from media organizations that are now sanctioned by the US. News stories on the sites currently claim that Ukrainian border guards welcomed Russian troops with open arms; that the Ukrainian army is using civilians as human shields; and deploying UN-banned phosphorus ammunition against the Russians. None of the substance of these stories is verified by news outlets outside of Russia.
In addition to the misinformation network, Meta says the accounts of Ukrainian military officials and public figures are being targeted. A threat actor known as Ghostwriter, which has been tracked by the security community and has ties to Russian-ally Belarus, has been trying to hack into accounts and post “YouTube videos portraying Ukrainian troops as weak and surrendering to Russia.”
Meta says it’s alerted users who are being targeted, blocked domains used in Ghostwriter’s phishing attacks (intended to steal password credentials), and taken other unknown steps to “secure accounts.”
“There’s been a lot of speculation and interest on whether there are covert influence operations targeting public debate in Ukraine and to what degree we’re seeing cyber hacking groups targeting individuals in Ukraine,” Meta’s Gleicher told NPR. “This is a case where we’re seeing both of those things.”
Twitter says it’s also been busy removing disinformation networks linked to the Russian invasion of Ukraine. The company told NBC News that it’s banned more than a dozen accounts sharing links to a propaganda site named Ukraine Today.
“On Feb. 27, we permanently suspended more than a dozen accounts and blocked sharing of several links in violation of our platform manipulation and spam policy. Our investigation is ongoing; however, our initial findings indicate that the accounts and links originated in Russia and were attempting to disrupt the public conversation around the ongoing conflict in Ukraine,” a Twitter spokesperson told NBC News.