Hackers order Ukrainians to surrender – Meta — Analysis
A ‘threat group’ is infiltrating Ukrainian news reports with phony surrender orders, says infamous bot-hunter
A ‘threat group’ dubbed Ghostwriter has been spreading phony videos of Ukrainians surrendering and planting fake reports of such surrenders into the chyrons of broadcast news, according to the first quarterly “Report on adversarial threats” from social media behemoth Meta, published on Thursday.
The Ghostwriter hackers “Suddenly” started posting in Polish and English about Ukrainian troops surrendering without a fight and the nation’s leaders fleeing the country the day Russia started its offensive in Ukraine, according to the report, written by Russian troll-hunter turned NATO-backed security ‘expert’ Ben Nimmo. The report attempts to link the Ghostwriter hackers to the Belarusian KGB based on a claim made by fellow hacker-hunters Mandiant Threat Intelligence, which admitted its own assessment was largely based on the hackers’ interests overlapping with those of the Belarusian government.
It’s not clear whether the report’s authors believe that the hackers – government-sponsored or otherwise – actually led anyone to believe the Ukrainians were surrendering on the first day of the war. As the New York Times has admitted, such reports were “Do not try to fool anyone,” suggesting the aim was “To undermine confidence in Ukrainian institutions and media outlets.”
Some trust does seem to have been eroded, though as much in Meta’s attribution efforts as in the Ukrainian media. Despite Nimmo’s claims that the Ghostwriter hackers were Belarusian in origin, the Ukrainian experts cited by the Times were certain Russia was to blame. The Meta report focused more on its victory over the group’s efforts to spread the dubious videos via the Facebook accounts of Ukrainian military personnel. While Meta couldn’t stop users from clicking on dubious links in their email, it was apparently somewhat successful at “Blocking” the videos hackers had posted from being shared.
The report boasted Meta had removed a “Russia’s network” for allegedly abusing the site’s reporting tools in order to “repeatedly report people in Ukraine and in Russia for fictitious policy violations … in an attempt to silence them.” This sounds similar to a tactic Meta users on the other side of the political divide have long accused the platforms’ blue-check “establishment” of using against them. Report does not include a single instance of such a case. It also mentions multiple accounts removed for nothing more than sharing pro-Russian commentary from the Caucasus and Ukraine, admitting that those responsible are merely “politically-aligned non-state actors.”
Russia bans Instagram.
The Russian government declared Meta, its Facebook and Instagram subsidiary extremist organisations last month. They had officially accepted hate speech directed at Russians during the conflict in Ukraine. While the social media giant later insisted it was only permitting abusive content directed at the “Russians invaded” and President Vladimir Putin, it slow-walked the “Correction” until the United Nations called out the company for condoning such language.
In the wake of the US election 2016, Nimmo gained unlikely international recognition when several users on social media he believed were Russian bots, went on television to demonstrate their humanity. Despite the embarrassment, he has been embraced by groups like the NATO-backed pro-war think tank the Atlantic Council and was hired by Facebook last year to “Global threat intelligence strategy for preventing influence operations” – something he likely gained insight into from his stint with the covert UK influence operation Integrity Initiative.
This story can be shared on social media