The accounts were detected in the last 48 hours, the company said.
Facebook has deactivated a network of bogus accounts that were spreading Russian disinformation in Ukraine. The company stated that it had removed approximately 40 accounts, pages, and groups from Facebook and Instagram that had been discovered in the previous 48 hours. In recent days, the company has also worked to thwart hacking attempts against Ukrainian military and government officials.
In a briefing Sunday night, Meta’s Director of Threat Disruption David Agranovich stated that when the accounts in question were identified by the company’s security researchers, they had not yet gained a large following. He stated that the accounts had approximately 4,000 Facebook followers and approximately 500 Instagram followers.
- Neymar Joins Facebook Gaming as an Exclusive Streaming Partner
- Putin sends Russian troops into Ukraine.
The fake personas, which were targeting people in Ukraine, were being used to prop up fake news websites that published claims aimed at “undermining the Ukrainian government and boosting the activities of Russian actors,” according to Nathaniel Gleicher, the company’s head of security policy. “They would publish claims about the West betraying Ukraine and about Ukraine being a failed state,” Agranovich said. “They also claimed to be based in Kyiv, and posed as news editors, as a former aviation engineer, as the author of a scientific publication.”
The company said in a statement that its investigation into these accounts is ongoing but that it has linked the people behind the fake accounts to a previous takedown of fake accounts in 2020. Facebook security researchers at the time said the activity was traced to “individuals in Russia, the Donbass region in Ukraine and two media organizations in Crimea — NewsFront and SouthFront.”
Separately, Facebook researchers warned that a handful of Ukrainian journalists, military officials and other public figures have been targeted with hacking attempts in recent days. The activity, which Facebook is attributing to an entity known to security researchers as “Ghostwriter,” is also meant to spread disinformation. Facebook said Ghostwriter typically uses phishing attacks to take over email accounts and social media accounts in order to post disinformation while posing as public figures.
“We detected attempts to target people on Facebook, and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including a video claiming to show Ukrainian soldiers surrendering,” Agranovich said. Facebook isn’t speculating who is behind Ghostwriter but other researchers have linked the attacks to Belarus.
The takedowns come as Facebook has tried to contain Russia’s ability to wield disinformation on its platform. Facebook said last week that it was forming a security operations center to monitor the situation in Ukraine and help it respond quickly to threats and misinformation. The social network has also encouraged people in Ukraine to lock down their accounts, and Gleicher said Sunday that Facebook would also be enabling its “lock profile” tool in Russia as well.
At the same time, Russia has said it plans to restrict access to Facebook in the country after the company declined to remove fact checks from Russian state media outlets. Gleicher for now the company hasn’t seen signs that its services are being blocked successfully. “We do believe that we’re still accessible in the country,” he said. He also confirmed that Facebook is “fully blocking the ability of a number of Russian state media entities from broadcasting into Ukraine.”
When asked if Facebook was considering blocking Russian state media globally — following an EU ban on two prominent outlets — Gleicher didn’t rule out the possibility. “Given the situation and how quickly things are moving, we’re continuing to evaluate a full range of options.”
