Meta Shuts Down Ukraine Facebook, Instagram Hacks

Facebook parent Meta Platforms said it has shut down a Russian campaign to hack the accounts of Ukraine military officials and journalists and a separate effort to undermine trust in the Ukrainian government, amidst an ongoing invasion.

Both efforts were small in scale and were caught in the early stages, Meta said.

Nathaniel Gleicher, Meta’s head of security policy, said the efforts targeted public debate in the Ukraine.

“There’s been a lot of speculation and interest on whether there are covert influence operations targeting public debate in Ukraine and to what degree we’re seeing cyber hacking groups targeting individuals in Ukraine,” he said. “This is a case where we’re seeing both of those things.”

Accounts hacked

One of the efforts involved a network of about 40 accounts, pages and groups on Facebook and Instagram, operating in Russia and Ukraine.

The accounts used fake personas to appear as independent news outlets and post claims about Ukraine being a failed state, Meta said.

The posts, which also appeared across Twitter, YouTube, Telegram and Russian social networks VK and Odnoklassniki, aimed to drive traffic to third-party websites.

On Facebook and Instagram the effort gained fewer than 5,000 followers. Meta didn’t say how many people viewed or interacted with the posts.

Gleicher said Meta’s actions showed malicious actors were “getting caught sooner” than a few years ago.

Disinformation

The accounts in question have been removed and the associated websites blocked, Meta said.

It said it found links to another network of fake accounts it removed in 2020 that involved people in Russia and the Donbas region of Ukraine, as well as two Crimean media organisations now sanctioned by the US government.

Separately, Meta said it has seen a surge in hacking attempts of Ukrainians in recent days, with some tied to a Belarusian-connected effort known in the cybersecurity world as “Ghostwriter”, previousy blamed for cyberattacks in other European countries.

Ghostwriter has been trying to hack accounts belonging to high-profile Ukrainians, including military officials, journalists and public figures, Meta said, declining to name the targets.

The hackers break into email and social media accounts and post disinformation, the company said.

‘Censorship’

“We detected attempts to target people on Facebook and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including a video claiming to show Ukrainian soldiers surrendering,” said Meta director of threat disruption David Agranovich.

It said the “handful” of Ukrainians targeted have been alerted and the phishing domains used have been blocked.

Facebook and Google have both imposed restrictions on Russian state media in recent days, preventing them from making money from advertising on their platforms. Facebook said it has also blocked such media entirely in Ukraine at the request of the Ukrainian government.

Russia on Friday said it would limit access to Facebook within the country in response to these acts of “censorship”.

Twitter access has also been restricted in Russia, the company has confirmed.

On Thursday, the day the invasion began, a large number of Russian government websites went offline in a suspected hack.