Meta published on April 7 a pilot report (pdf) on the state of threat “ detected on its network during the first quarter of 2022. This is an expansion of the scope of monthly reports on coordinated inauthentic behavior, “ an overview of the risks we observe around the world and across multiple policy violations”. Unsurprisingly, Russia and Belarus occupy a prominent place in this edition.
Belarus is obviously very active on Meta
From the first days of the conflict, on February 27, Meta issued a security update on the particular situation in Ukraine. The company highlighted the activity of one group in particular, Ghostwriter. The latter, named by the cybersecurity company Mandiant, also called UNC1151, is a cyber espionage and influence actor suspected of being linked to Belarus since November 2021.
Zuck Bucks: Meta has not abandoned digital currencies, on the contrary
In Ukraine, he began by taking over the Facebook accounts of dozens of Ukrainian servicemen, then, writes Meta, “ they [les pirates] posted videos calling on the military to surrender as if these posts were from the rightful owners of the accounts”. In one of the videos hosted by YouTube, you could see so-called Ukrainian soldiers coming out of a forest with a white flag.
The objective was transparent: Russia was counting at the time on a rapid intervention, based on the conviction that the Ukrainian army would sink from the first clashes. It was a classic propaganda operation to destabilize the adversary, adapted to contemporary times.
Russian expectations were disappointed and Facebook claims to have quickly blocked the sharing of these videos, to limit their harmfulness. Ghostwriter would still be active, however, warns Meta.
In a similar vein, another group affiliated with the Belarusian KGB has been detected by Meta and its accounts have been deleted. On February 24 he suddenly began to publish in Polish and English messages about the surrender of Ukrainian troops without a fight and the flight of the country’s leaders “Notes the social network. An account slipped through the cracks even tried to organize a demonstration in Poland, in Warsaw, on March 14, without success.
From Russia, the Troll Factory points the tip of its nose
Networks of fake accounts are not the prerogative of Belarusians. Meta points to the resurgence of a network already taken down in December 2020, controlled by the Internet Research Agency, a Russian company better known as the “troll factory”. Under cover of an NGO specializing in the defense of civil rights in the West, he blamed the invasion on NATO and accused Ukraine of targeting civilian populations. It has been deleted.
A larger network of some 200 accounts had set itself the task of mass reporting authentic profiles in Ukraine, Russia, Israel, the United States and Poland. The goal was to silence the targets of these reports. The activity of this network accelerated as the invasion approached. For the anecdote, Meta reports that its members coordinated from a group… in the kitchen.
A final network attempted to circumvent Meta’s vigilance by mobilizing Artificial Intelligence. Thanks in particular to the GAN technique (generative adversarial network), which makes it possible to perfectly imitate images, false profiles have been created using ” fictional characters and brands on the Internet – including on Facebook, Instagram, Twitter, YouTube, Telegram, Odnoklassniki and VK – to appear more authentic”.
If these revelations from Meta are not unexpected, Russia having distinguished itself for many years in this type of activity, they highlight the destabilization techniques used by the Kremlin and its Belarusian ally. Meta, meanwhile, will have more work than ever. Its ability to respond to these manipulations will be scrutinized and gauged from all sides. In an interview with the agency ReutersNick Clegg, sort of Minister of Foreign Affairs of Meta, assured that the company ” is studying additional measures to counter misinformation and hoaxes from Russian government pages”.