Meta (former Facebook) has announced it blocked accounts used by a Belarusian-linked hacking group known as UNC1151 or Ghostwriter.
The malicious network used fake accounts and fictitious personas and brands across the internet, including on Facebook, Instagram, Twitter, YouTube, Telegram, Odnoklassniki and VK, to spread disinformation.
Fake personas used profile pictures likely generated using artificial intelligence techniques and claimed to be news editors, aviation engineers, and scientists from Kyiv. This operation ran a number of websites disguised as independent news outlets, publishing claims about the West betraying Ukraine and Ukraine being a failed state.
“We detected attempts to target people on Facebook to post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including one video claiming to show Ukrainian soldiers coming out of a forest while flying a white flag of surrender,” Meta said.
In its report the company noted that the Ghostwriter operation intensified efforts over the past several days.
“Ghostwriter targets users through email compromise and then uses that to gain access to their social media accounts and post disinformation as if it’s coming from the legitimate account owners,” Meta said adding that it also blocked phishing domains used in the malicious campaign.