Facebook and Twitter removed two anti-Ukrainian “covert influence operations” over the weekend, one tied to Russia and another with connections to Belarus, the companies said.
One of the operations, a propaganda campaign featuring a website pushing anti-Ukraine talking points, was an offshoot of a known Russian disinformation operation. A Facebook spokesperson said it used computer-generated faces to bolster the credibility of fake columnists across several platforms, including Instagram.
The other campaign used hacked accounts to push similar anti-Ukraine propaganda and was tied to a known Belarusian hacking group.
Disinformation experts warned that Russia is expected to continue to try to manipulate narratives about Ukraine — most notably around the claims made by Russian President Vladimir Putin.
The networks that were removed by Facebook and Twitter pushed narratives that Putin himself mentioned in his speech announcing a military operation, which has since turned into a large-scale invasion.
The announcement also demonstrates that Russia continues to use disinformation strategies first identified years ago around the 2016 election, albeit with some advancements — most notably the use of software that can create realistic and original human faces.
The larger of the two disinformation groups operated in Russia, as well as the Russian-dominated Donbas and Crimea regions of Ukraine, said Nathaniel Gleicher, Meta’s head of security policy, and it is tied to the websites News Front and South Front, which the U.S. government has designated as part of a broader disinformation effort that had connections to Russian intelligence. (Meta is the parent company of Facebook.)
‘These actors are trying to undermine trust in the Ukrainian government’
Gleicher said in an interview that the propaganda campaign was able to “seed stories across the internet that Ukraine isn’t doing well” by “pretending to be journalists based in Kyiv.”
“The good news is that neither of these campaigns have been that effective, but we do see these actors trying to target Ukraine at this point,” he said.
“These actors are trying to undermine trust in the Ukrainian government, suggest that it’s a failed state, suggest that the war is going very poorly in Ukraine or trying to praise Russia.”
Facebook removed profiles related to News Front and South Front in 2020, and the company confirmed to NBC News that the new group shared connections to the accounts that were previously banned. Both websites have pushed misleading articles, questioning the results of the 2020 presidential election and the efficacy of Covid-19 vaccines. The State Department identified the websites as Russian disinformation outlets in a 2020 report.
The websites featured articles pushing Russian talking points like “Zelensky is building a neo-Nazi dictatorship in Ukraine” and “Why Ukraine will only get worse.” As of Sunday night, the sites still featured the biographies and computer-generated faces of the columnists and linked out to their accounts on VKontakte, Russia’s Facebook competitor.
Facebook said it took down 40 profiles tied to the disinformation operation, saying the profiles were a small part of a larger persona-building operation that spread across Twitter, Instagram, Telegram and Russian social networks.
Accounts tied to the websites were still active on Telegram, the Russian social networks and YouTube on Sunday night. YouTube declined to comment.
Twitter said it banned more than a dozen accounts tied to the News Front and South Front Russian operation, which were pushing links to a new propaganda site called Ukraine Today.
“On Feb. 27, we permanently suspended more than a dozen accounts and blocked sharing of several links in violation of our platform manipulation and spam policy. Our investigation is ongoing; however, our initial findings indicate that the accounts and links originated in Russia and were attempting to disrupt the public conversation around the ongoing conflict in Ukraine,” a Twitter spokesperson said in a statement.
Hackers target journalists, military personnel and local public officials in Ukraine
Facebook said it took down a separate multipronged disinformation operation by a known hacking group based out of Belarus that targeted Ukrainians. The company said it hacked social media accounts to use them to spread pro-Russian propaganda.
The hackers targeted journalists, military personnel and local public officials in Ukraine, using compromised email accounts and passwords to log into their Facebook profiles. The hacked accounts would then post a video of what they said was a Ukrainian waving a white flag of surrender.
Facebook attributed the efforts to the hacking group Ghostwriter, which previously used hacked accounts to push disinformation that favored the Belarus government. The Ghostwriter hacking group works for the Belarus government, according to the cybersecurity firm Mandiant.
As for who will be targeted next, Renée DiResta, the research manager at the Stanford Internet Observatory, said it is “unlikely” to be U.S. users.
“What you would see would most likely be coming out of either existing real influencers who are part of that sphere of influence that Russia has established already or media properties,” she said. “It does take some time to spin up a network of fake accounts.”
