The network of around 40 fake pages and groups tried to promote fake news articles about Ukraine and the west, Meta said.
ADVERTISEMENTA network of social media groups and pages spreading disinformation in Ukraine has been taken down, Facebook owner Meta announced on Sunday.
In the days immediately following Russia's invasion of Ukraine, Meta said it had uncovered a "relatively small" network of around 40 accounts, pages and groups posing as news outlets and using fake identities on Facebook and Instagram.
The network, run by people based in Russia and Ukraine, created profiles on YouTube, Telegram, Russian Facebook equivalent VKontakte and Meta's own platforms in order to promote websites that published "claims about the West betraying Ukraine and Ukraine being a failed state," Meta said.
"It mainly posted links to long-form articles on its websites, without much luck making them engaging. It got very few reactions, and under 4,000 followers," Meta's threat intelligence lead Ben Nimmo said on Twitter.
The network also created fake Ukrainian user accounts using AI-generated profile pictures which posed as residents of the Ukrainian capital, Kyiv.
The fake personas included news editors, an aviation engineer and even "an author of a scientific publication on hydrography - the science of mapping water," Meta said.
"This was a complex but unsuccessful operation: relatively detailed personas, lengthy articles, spread across multiple platforms, trying to fly under the radar," Nimmo said.
"But it traded stealth for engagement: most posts got barely any likes or shares," he added.
Hacking risk in Ukraine
In its statement on cybersecurity in Ukraine, Meta said that it had also detected a rise in hacking attempts by the threat actor Ghostwriter since Russia began its attack on February 24.
"We detected attempts to target people on Facebook to post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia, including one video claiming to show Ukrainian soldiers coming out of a forest while flying a white flag of surrender," Meta said.
Last year, the cybersecurity analyst Mandiant said it had "high confidence" that Ghostwriter - also known as UNC1151 - had ties to the government of Belarus, led by Putin ally Alexander Lukashenko.
"UNC1151 has targeted a wide variety of governmental and private sector entities, with a focus in Ukraine, Lithuania, Latvia, Poland, and Germany. The targeting also includes Belarusian dissidents, media entities, and journalists," the company said.
Meta said it had alerted users whose accounts it believed had been targeted by Ghostwriter and blocked the phishing domains used to compromise accounts in Ukraine.
The social media giant also said it had rolled out additional security features to users in Russia, in response to "public reports of targeting of civil society and protesters". The extra features, which were offered to Ukrainian Facebook users last week, include the ability to lock profiles and hide friend lists by default.
