The company detailed a new wave of “cyber espionage” and disinformation campaigns.
Facebook says it is looking into new ways to limit the influence of official Russian government accounts, citing an increase in cyber espionage and “covert influence operations” involving “government-linked actors” from Russia and Belarus.
The update was shared by Facebook’s security researchers as part of the company’s first quarterly threat report, which detailed the company’s latest efforts to prevent its platform from being exploited in the midst of Russia’s invasion of Ukraine.
During a conference call with reporters, Meta’s President of Public Policy, Nick Clegg, stated that the company has seen an increase in state-backed disinformation and other misinformation efforts. “Since Russia’s invasion of Ukraine, we’ve seen an increase in attacks on internet freedom and access to information,” Clegg said. “It manifests itself in two ways: one is pushing state propaganda through state-run media, influence operations, and espionage campaigns.” The other aimed to stifle the flow of credible information.”
Clegg added that the company is considering new steps to prevent official government accounts from spreading disinformation, but didn’t elaborate. Though Facebook has been demoting Russian state media outlets since March, the company hasn’t had a clear strategy for addressing misinformation and lies about the war from official government accounts. Up to know, it’s taken one-off actions against specific posts, like when an account belonging to Russia’s UK embassy falsely claimed a photo of a hospital bombing was staged.
Now Facebook is apparently considering how it can better prevent these accounts from spreading misinformation, said Clegg, who has previously been a vocal defender of Facebook’s policy against fact-checking politicians. “We are actively now reviewing additional steps to address misinformation and hoaxes coming from Russian government pages,” Clegg said.
Official pages are just one area of concern for Facebook though. In its report, Facebook security researchers detailed several influence operations and other campaigns to manipulate its platform in favor of pro-Russian interests and disinformation.
“For example, we detected and disrupted recidivist CIB [coordinated inauthentic behavior] activity linked to the Belarusian KGB who suddenly began posting in Polish and English about Ukrainian troops surrendering without a fight and the nation’s leaders fleeing the country on February 24, the day Russia began the war,” they wrote in the report. “On March 14, they pivoted back to Poland and created an event in Warsaw calling for a protest against the Polish government. We disabled the account and event that same day.”
The company also said it saw renewed activity from Ghostwriter, an entity that uses phishing attacks on email accounts to take over its targets’ social media accounts. Facebook previously said Ghostwriter targeted a handful of Ukrainian journalists, military officials and other public figures at the start of the war. This time, Ghostwriter “attempted to hack into the Facebook accounts of dozens of Ukrainian military personnel,” Facebook wrote. “In a handful of cases, they posted videos calling on the Army to surrender as if these posts were coming from the legitimate account owners. We blocked these videos from being shared.”
Facebook also spotted renewed activity from Russia’s Internet Research Agency, the troll farm behind Russia’s 2016 election interference campaign that’s made repeated attempts to get back on Facebook in recent years. Facebook said their attempts to make new accounts on the platform were “unsuccessful” and appeared to be trying to drive traffic to a separate website that “blamed Russia’s attack on NATO and the West and accused Ukrainian forces of targeting civilians.”
Finally, Facebook also said it has removed “tens of thousands’ ‘ of accounts, pages and groups for using spammy and misleading tactics in an attempt to profit off the war in Ukraine. These efforts included meme pages posing as on-the-ground reports from Ukraine as well as spammers trying to sell merch or lure people to outside websites for ad revenue.
