The Facebook accounts of dozens of Ukrainian military personnel was hacked and posts calling for the army to surrender was uploaded.
In its first quarterly adversarial threat report, Meta – Facebook’s parent company – said government-linked actors from Russia and Belarus had engaged in cyber espionage and covert online influence operations.
This included an operation linked to the Belarusian KGB.
‘We’ve seen a further spike in compromise attempts aimed at members of the Ukrainian military by Ghostwriter, a threat actor tracked by the security community,’ said the report.
Ghostwriter (also known as UNC1151) is a hacker group allegedly originating from Belarus. It typically targets people through email compromise and then uses that to gain access to their social media accounts across the internet.
‘This group has attempted to hack into the Facebook accounts of dozens of Ukrainian military personnel. In a handful of cases, they posted videos calling on the Army to surrender as if these posts were coming from the legitimate account owners. We blocked these videos from being shared,’ said Meta’s report.
According to the report, Meta had also removed a network of about 200 accounts operated from Russia that coordinated to falsely report people, mostly in Ukraine and Russia, for violations like hate speech or bullying.
The mass reporting was primarily coordinated in a cooking-themed Facebook Group which had about 50 members when Meta took it down in March.
‘We detected and took down an attempt to come back by a network we removed in December 2020 and linked to individuals associated with past activity by the Russian Internet Research Agency (IRA),’ said Meta.
The network appeared to have begun last year and centered around a website, posing as an NGO, focused on civil rights in the West.
They unsuccessfully attempted to create Facebook accounts in late 2021 and January 2022. Throughout January and February of this year, the website published about police violence in the West, but since the invasion, their articles blamed Russia’s attack on NATO and the West, and accused Ukrainian forces of targeting civilians.
Meta said it had also removed tens of thousands of accounts, pages and groups trying to use the war in Ukraine to scam users and make money by driving people to ad-filled websites or selling them merchandise.
Spammers around the world were reportedly using tactics such as streaming live-gaming videos or reposting popular content including other people’s videos from Ukraine to pretend they were sharing live updates from the crisis.
The Facebook-owner has removed hacking campaigns, influence networks and scam operations amid the war in Ukraine, according to the report released on Thursday.
In March, Facebook said that it would try to continue to operate in Russia to offer a platform for ‘counter-speech’ to the propaganda coming from Russian-state controlled media.
Russia in turn has banned Western social media platforms like Facebook and Instagram, and slowed down Twitter’s service.
Meta detailed other takedowns of threats including multiple policy violations in Iran, Azerbaijan, Ukraine, Russia, South America and the Philippines.