Facebook takes down fake accounts boosting Russian disinformation in Ukraine

Facebook has taken down a network of fake accounts attempting to spread Russian disinformation in Ukraine. The company said it had removed about 40 accounts, pages and groups from Facebook and Instagram that were detected over the last 48 hours. The company has also worked to stop hacking attempts targeting Ukrainians military and government officials on recent days.

In a briefing Sunday night, Meta’s Director of Threat Disruption David Agranovich said the accounts in question hadn’t yet gained a large following when they were identified by the company’s security researchers. He said the accounts had about 4,000 followers and Facebook and about 500 on Instagram.

The fake personas, which were targeting people in Ukraine, were being used to prop up fake news websites that published claims aimed at “undermining the Ukrainian government and boosting the activities of Russian actors,” according to Nathaniel Gleicher, the company’s head of security policy. “They would publish claims about the West betraying Ukraine and about Ukraine being a failed state,” Agranovich said. “They also claimed to be based in Kyiv, and posed as news editors, as a former aviation engineer, as the author of a scientific publication.”

The company said in a statement that its investigation into these accounts is ongoing but that it has linked the people behind the fake accounts to a previous takedown of fake accounts in 2020. Facebook security researchers said the activity was traced to “individuals in Russia, the Donbass region in Ukraine and two media organizations in Crimea — NewsFront and SouthFront.”

Separately, Facebook researchers warned that a handful of Ukrainian journalists, military officials and other public figures have been targeted with hacking attempts in recent days. The activity, which Facebook is attributing to an entity known to security researchers as “Ghostwriter,” is also meant to spread disinformation. Facebook said Ghostwriter typically uses phishing attacks to take over email accounts and social media accounts in order to post disinformation while posing as public figures.

“We detected attempts to target people on Facebook, and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including a video claiming to show Ukrainian soldiers surrendering,” Agranovich said. Facebook isn’t speculating who is behind Ghostwriter but other researchers have linked the attacks.

The takedowns come as Facebook has tried to contain Russia’s ability to wield disinformation on its platform. Facebook said last week that it was forming a security operations center to monitor the situation in Ukraine and help it respond quickly to threats and misinformation. The social network has also encouraged people in Ukraine their accounts, and Gleicher said Sunday that Facebook would also be enabling its “lock profile” tool in Russia as well.

At the same time, Russia has said it plans to to Facebook in the country after the company declined to remove fact checks from Russian state media outlets. Gleicher for now the company hasn’t seen signs that its services are being blocked successfully. “We do believe that we’re still accessible in the country,” he said. He that Facebook is “fully blocking the ability of a number of Russian state media entities from broadcasting into Ukraine.”

When asked if Facebook was considering blocking Russian state media globally — following an on two prominent outlets — Gleicher didn’t rule out the possibility. “Given the situation and how quickly things are moving, we’re continuing to evaluate a full range of options.”