Facebook/Meta claims that a hacking campaign is targeting 24 public figures in Ukraine. This includes politicians, military officials, and at least one journalist all involved in defending the country from the ongoing Russian invasion.  

 Mykhailo Fedorov, the Minister of Digital Transformation of Ukraine called on Big Tech for help. Hours later Elon Musk had the Starlink satellite internet activated. And 24 hours later a truck of Starlink terminals arrived. 

Friday,several Ukrainian cyber security specialists said that hackers from bordering country Belarus were targeting the private email addresses of Ukrainian military personnel “and related individuals.” They identified the group as code-named “UNC1151.” The U.S. cybersecurity firm FireEye has named the group, which has been active on other hacking campaigns, as Ghostwriter.

Meta attributes the hack attacks to a group known as Ghostwriter. Meta said the hackers attempted to post YouTube videos from the accounts portraying Ukrainian troops as weakened, including one video which claimed to show Ukrainian soldiers coming out of a forest and flying a white flag of surrender.

https://twitter.com/FedorovMykhailo/status/1498392515262746630?s=20&t=jczIjtrlziWWAeODhVFpJg

Meta repelling hacking campaign

 In the meantime, Nick Clegg of Facebook/ Meta answered the call. The Meta platforms developed a strategy to help Ukraine.  Company executives said Sunday, they would be taking measures to combat the regional hacking efforts.

The team included Meta’s director of threat disruption, David Agranovich, and Meta head of security policy Nathaniel Gleicher. 

 The operation targeted people in Ukraine and had less than 4,000 followers on Facebook and less than 500 followers on Instagram. 

Facebook began taking down fake accounts which were spreading false about the Russian-led military invasion in Ukraine. The hacking campaign was spread by a small network of 48 pages accounts and groups operating in Russia and Ukraine. 

The security team said it had taken steps to secure targeted accounts. And it is blocking the phishing domains used by the hackers. It did not identify the Ukrainians targeted. But is alerting them, wherever possible.

Fake accounts are operating across Facebook and Instagram. But they are also on other platforms including Twitter, YouTube, and Telegram. 

Meta has changed the platform by removing the ability to view and search the friend's lists of Facebook accounts in Ukraine. It also made this change in Russia to protect protestors who speak out.

The crisis in Ukraine has seen escalating clashes between Moscow and major tech companies. On Friday, Russia said it would restrict access to Facebook in the country. This move came after Meta said it refused the request to stop the independent fact-checking of several Russian state media outlets. 

A Twitter spokesperson claims that it also suspended more than a dozen accounts. And was blocking sharing of several links. All due to the accounts violating its rules against spam and platform manipulation and spam. It said its ongoing investigation indicates the accounts originate in Russia. 

Ukraine’s health ministry said on Sunday that more than 352 civilians, 14 of them children, have been killed since the start of the invasion. Russia in another bit of misinformation calls the invasion a “special operation.