Two social media disinformation campaigns exploiting tensions in Russia and Ukraine were identified and deactivated on Facebook over the weekend, according to two senior executives at social network parent company Meta.
An operation thwarted by Meta’s security team involved about 40 accounts described as “inauthentic” with profile pictures believed to have been artificially generated, Threat Disruption Director David Agranovich said Sunday night. The fictional characters operated across the internet, Meta employees said, including Twitter, YouTube, Telegram and two Russian social networks.
The campaign also included bogus websites resembling news outlets that claimed to be based in Kyiv, with the people behind the sites posing as editors and expert sources.
The operation was linked to a campaign previously detected and removed by Facebook in April 2020. At the time, the activity originated from Russia, the Donbass region and two media outlets in Crimea.
“The campaign had very limited following through its online presence,” Agranovich said.
When Meta took action against the accounts, they had fewer than 4,000 followers on Facebook and less than 500 on Instagram, Agranovich said. The security team did not specify the total number of impressions or views received by inauthentic posts.
Another operation involved the specific targeting of Facebook accounts belonging to members of the Ukrainian military, as well as politicians and a journalist. The profiles were used to share YouTube videos portraying Ukrainians as weak and surrendering to Russia, which Facebook says was done by compromising the accounts likely via personal email. A video showed Ukrainian soldiers coming out of a forest waving a white flag.
Meta employees did not disclose the total number of compromised accounts, calling them only “a handful”. They also did not reveal the names behind the accounts, citing privacy concerns.
While Facebook described the number of affected accounts as minimal, the phishing operation that led to the compromise was reportedly widespread and attributed by cybersecurity researchers to a previously known disinformation campaign called “Ghostwriter”.
“Ghostwriter has previously targeted the NATO alliance, seeking to erode support for the organization,” said Ben Read, director of cyber espionage analysis at cybersecurity firm Mandiant. “I wouldn’t be surprised if similar operations occur in the near future.”
Mandiant has linked the “Ghostwriter” campaign to the Belarusian military, and concerns remain about the exploitation of Ukrainians’ personal data.
“Leaks of misleading or fabricated documents from Ukrainian entities could be exploited to promote narratives favorable to Russia and Belarus,” Read said.
ABC News has tracked the spread of misinformation related to Ukraine and Russia on online forums and social media.
In one example, a video that appeared to show a man with his leg blown off was shared by a Russian separatist militia on Telegram last week. The stump of the man’s leg was blurry.
“Ukrainian punishers continue the genocide of the civilian population of Donbass,” reads the caption of the video.
But other unblurred videos from the scene show the man was actually an amputee. There is no blood and the attachment for a prosthetic leg is clearly visible.
At Meta, Facebook increased its fact-checking capacity in Russia and Ukraine and added new features to protect Ukrainians and help them lock down their accounts and verify privacy settings. Meta will now also extend some of these features to Russia in an effort to protect against increased targeting of Russian protesters, the company said.
Earlier this week, Russian state media was banned from running ads or monetizing the platform.
Responding to calls for Meta to shut down Facebook and Instagram in Russia, vice president of global affairs Nick Clegg said the company does not want to restrict services for Russians protesting and organizing against the war.
“The Russian government is already limiting our platform to prevent these activities,” Clegg said in Tweet on Sunday. “We believe that disabling our services would silence an important expression at a crucial time.”
ABC News’ Jack Date and Alice Chambers contributed to this report.