Facebook Says Hackers Infiltrated Multiple Ukrainian Accounts

Facebook and its parent company, Meta, said Monday that about 40 fake accounts have been suspended for violating rules against coordinated hacks and disinformation campaigns.

The accounts were removed in the past 48 hours, according to Meta. The group, known as Ghostwriter, allegedly gained access to several Facebook accounts registered in Ukraine. The website described how the group was able to get into accounts, while also outlining what has been done to prevent more hacks from occurring.

"Ghostwriter typically targets people through email compromise and then uses that to gain access to their social media accounts and post disinformation as if it's coming from the legitimate account owners," Meta said.

"We've taken steps to secure accounts that we believe were targeted by this threat actor and, when we can, to alert the users that they had been targeted. We also blocked phishing domains these hackers used to try to trick people in Ukraine into compromising their online accounts."

After gaining access to the accounts, the group was able to post alleged propaganda videos on these accounts, depicting Ukrainian soldiers as weak or surrendering to Russian troops.

"When we disrupted this network on our platform, it had fewer than 4,000 Facebook accounts following one of more of its Pages and fewer than 500 accounts following one or more of its Instagram accounts," the company wrote in a statement.

The company also outlined some steps that Ukrainian, Russian or other users around the world can take to protect their accounts, including locking your profile, managing your friends lists, and securing your Instagram account.

"We encourage people to use caution when accepting friend requests and opening links and files from people they don't know," wrote the company. "Please refrain from reusing the same passwords across different services to prevent malicious hackers from gaining access to your information. We also strongly recommend using two-factor authentication on all online accounts."

The company also claims that several pages claiming to be independent news outlets have been shut down due to unfounded accusations of Western betrayal of Ukraine.

Facebook is not the only social media platform to be experiencing increased reports of disinformation campaigns. Twitter announced that labels will now be added onto tweets linking back to state media sources.

"For years we've provided more context about state-affiliated media while not accepting ad [money] or amplifying accounts," the website explained. "With many looking for credible info due to the conflict in Ukraine, we're now adding labels on Tweets linking to state media & reducing the content's visibility."

Update 2/28/22, 1:45 p.m. ET: This story has been updated to include background information.

Facebook in Slovakia
Facebook's parent company, Meta, on Monday announced the deletion of about 40 accounts attributed to a Russian-Ukrainian hacking group. Photo by Zuzana Gogova/Getty Images