Meta removed two disinformation campaigns targeting Ukraine

• Facebook said it removed and blocked both operations, and shared information about both campaigns with government agencies and other tech platforms.

The first influence operation was uncovered in the last 48 hours, and included a relatively small network of what Facebook calls "coordinated inauthentic behavior" consisting of about 40 accounts, pages and groups across Facebook and Instagram.

• The campaign operated from Russia and Ukraine and targeted people across multiple social platforms, as well as through its own websites, said David Agranovich, director of threat disruption at Meta.
• It used fake accounts to operate fake personas not just on Facebook and Instagram, but also on Twitter, YouTube, Telegram and two Russian social media networks. The operation also ran a handful of websites that masqueraded as independent news websites and claimed to be based in Kiev.
• Agranovich said Meta found links between this operation and another operation it removed in 2020, which at the time Meta connected to individuals in Russia, the Donbas region in Ukraine and Crimea in particular — as well as to two news firms in Crimea called NewsFront and SouthFront, which are both now sanctioned by the U.S. government.

The second influence operation, uncovered in the past several days, was identified by Meta as the work of a coordinated hacking group tracked by the security community. The group, known to security researchers as Ghostwriter, has been linked to Russia.

• The operation targeted people in Ukraine, including the Ukrainian military, public figures and at least one journalist.
• Ghostwriter typically targets people through compromised email accounts, gaining access to their social media accounts and posting disinformation as if it's coming from the account owners.
• They found efforts to target people on Facebook and post YouTube videos portraying Ukrainian troops as weak and surrendering to Russia.

• Meta blocked the phishing domains the actors were using to try to trick people in Ukraine into compromising their accounts.

By the numbers: Both campaigns were caught by Meta before they were able to reach a wide group of people, said Nathaniel Gleicher, Meta's head of security policy.

• The first campaign had under 4,000 Facebook accounts following any of their pages and fewer than 500 Instagram followers to their accounts. Gleicher called it a "quite small" operation.

The big picture: The campaigns show that pro-Russia actors are still relying on coordinated inauthentic behavior campaigns across social media, in some cases similar to those they employed during the 2020 U.S. election.

Yes, but: The impacts of these campaigns seem to be dwindling.

• Gleicher noted that actors trying to run such influence campaigns are being caught sooner every time, and not reaching as many people as they'd like.

What to watch: Meta also detailed new measures it has taken to protect Ukrainians from account hacks and disinformation campaigns, like reminding users to use two-factor authentication.