GHOSTBUSTERS

Facebook Blocks ‘Ghostwriter’ Hackers Targeting Ukraine’s Army

The hacking group linked to the Belarusian government is known for breaking into real news sites to plant fake stories.

Facebook says it has cracked down on a shadow hacking group that’s been ramping up its efforts to hack Ukrainian military officials and a number of other targets as Kyiv fends off a Russian invasion.

In an announcement early Monday morning, security officials at Meta, Facebook’s parent company, said they’ve “seen increased targeting” of Ukrainian social media users by a hacking group that researchers refer to as “Ghostwriter.” After uncovering a group of phishing websites used by the group, Meta says it blocked the domains across its social media platforms in order to protect users.

The cybersecurity firm Mandiant first identified Ghostwriter in 2020 and late last year linked its hacking sprees to the Belarusian government. Since March 2017, Ghostwriter operatives have broken into legitimate news websites to plant fake stories with conspiracy theories about NATO and COVID-19. Hackers from the group have also impersonated prominent political figures, military officials, and journalists in an attempt to spread the fake stories via email.

Separately, Meta officials say they removed a “small” troll network of 40 accounts “operated from Russia and Ukraine” that the company found targeting Ukrainian audiences with disinformation about Ukraine.

The sock puppet accounts used AI-generated avatars and pretended to be “news editors, a former aviation engineer,” and a scientist working on hydrography operating fake news sites and accounts across Facebook, Telegram, YouTube, VK, and other social media platforms. The network they belonged to leveraged fake news outlets to publish stories that hyped talking points about “the West betraying Ukraine and Ukraine being a failed state” and similar narratives, according to Meta.

Since Russia’s invasion of Ukraine began, Meta has rolled out a series of new security features for users in Ukraine that allow accounts to quickly lock down their privacy settings and prevent others from viewing their avatars and posts. On Monday, the company said it would also begin rolling out the features to users in Russia, where the government has been cracking down on Russians’ ability to access the social media platform.

See more of our coverage in your search results.

ADD THE DAILY BEAST ON GOOGLE

Adam RawnsleyFormer Senior Researcher

Got a tip? Send it to The Daily Beast here.