WASHINGTON — Andriy Taranov, board member of Ukrainian public broadcaster Suspilne, was sitting in his office last month when he noticed a strange message appearing at the bottom of the television screen. It said Volodymyr Zelensky, the president of Ukraine, had announced a surrender.
mr. Taranov was stunned because there had been no rumors of a surrender about the Russian invasion of the country among reporters. “There’s no such thing in any journalist circle,” he recalled thinking. “It looks absolutely contradictory.”
The message was fake, he quickly realized. It was planted on the chyron of the live broadcast of Media Group Ukraine by hackers.
Since the Russian invasion began in late February, hackers have repeatedly broken into the social media accounts and broadcasting systems of trusted sources of information in Ukraine, such as government officials and prominent media outlets. They used their access to spread false reports that Ukraine was surrendering, sometimes using fake videos to back up their claims.
And while there’s no evidence that the disinformation campaign has had any noticeable effect on the conflict, experts say the hackers don’t intend to actually mislead anyone. Instead, the hackers are most likely trying to undermine trust in Ukrainian institutions and show that the government and the news media cannot be trusted for information or to keep hackers out of their systems. The tactics mirror those used in other Russian disinformation campaigns aimed at fueling divisions and cultural conflict.
“You can create uncertainty, confusion and mistrust,” said Ben Read, director at cybersecurity firm Mandiant. “It doesn’t have to withstand close reading to have any effect on the population; it erodes trust in all messages.”
Facebook traced a hacking campaign targeting military officials to state-sponsored hackers in Belarus. Other cyber attacks, including those against media outlets and telecommunications networks, have not yet been attributed to specific state actors.
But Ukrainian officials suspect Russia is behind the hacking and disinformation.
“Of course they are behind these attacks,” said Victor Zhora, deputy head of Ukraine’s cybersecurity agency, the State Agency for Special Communications and Information Protection.
“This is the first time in history that we are dealing with a conventional war and a cyber war at the same time,” said Mr. Zhora. “It completely changes our landscape for what is happening around Ukraine.”
Efforts to spread disinformation about a Ukrainian surrender began days after the Russian invasion began. Hackers broke into the Facebook accounts of high-profile Ukrainian military leaders and politicians and used their access to post fake messages announcing a surrender. They accompanied some of the posts with videos of soldiers waving a white flag, falsely claiming that the footage depicted Ukrainian soldiers.
Facebook’s parent company Meta said it quickly detected the attack and in some cases was able to prevent the hackers from posting fake messages from the compromised accounts. The hackers were affiliated with a group security researchers call Ghostwriter, said Meta, which is linked to Belarus.
Ghostwriter often targets public figures in Europe, security researchers said, often using compromised social media and email accounts to push messages intended to take away support for NATO. Since the war began in Ukraine, the group has focused its efforts there, researchers said.
“They are aligned with the Russian targets,” said Mr. Read about Ghostwriter.
In mid-March, Ukrainian officials discovered another hacking campaign trying to spread false information about a surrender. According to Ukraine’s security agency, the country’s law enforcement and intelligence agency, a hacker has set up a relay system to help route calls for the Russian military. The system was also used to send text messages to Ukrainian security forces and officials, asking them to surrender and support Russia, the law enforcement agency said.
Ukraine’s security service said it had arrested the person responsible for the messages, who it said had made thousands of calls a day on behalf of the Russian military.
Another more visible attempt to spread disinformation about a surrender soon followed. On March 16, a “deepfake” video appeared on social media of Mr Zelensky asking Ukrainians to lay down their weapons and surrender to Russia.
Hackers targeted television stations and news outlets in Ukraine to distribute the digitally manipulated video, broadcast it on Ukraine 24, a television station operated by Media Group Ukraine, and post it on the retailer’s YouTube channel.
Media Group Ukraine said it believes Russian hackers were responsible. “Our systems had been under constant attack for more than two weeks before they were hacked,” said Olha Nosyk, a company spokeswoman. “We have strengthened security and deployed the necessary technical resources to prevent a recurrence of such incidents.”
War between Russia and Ukraine: important developments
Russia is preparing a renewed offensive. Ukraine braces itself for a Russian attack along the eastern front, where Ukrainian officials have warned civilians still living in the region that time is running out to escape. But the road to safety is fraught with danger, with reports of Ukrainian civilians being killed while trying to flee.
Deepfakes like Mr. Zelensky use artificial intelligence to create seemingly realistic images of people doing and saying things they didn’t actually say or do. Researchers have warned that the technology could be misused during elections and other high-profile political moments to spread lies about prominent politicians.
Oleksiy Makukhin, an expert who has worked to fight misinformation in Ukraine, said he first saw Mr Zelensky’s digitally manipulated video circulating on the Telegram messaging app. But many of the posts about the video emphasized the fact that it was fake and made fun of it because it was poorly made, Mr. Makukhin.
“I can hardly think of anyone in Ukraine who believed in it,” he said. “People in Ukraine are already quite knowledgeable about disinformation, which Russia spreads all the time.”
Still, Mr. Zelensky took to his official channel on Telegram to deny the video’s claims. “We defend our country, our children, our families,” he said. “So we’re not going to lay down our arms until our victory.”
On Friday, Ukraine’s security agency said it had discovered another texting campaign that pushed more than 5,000 surrender messages using a bot farm linked to Russia. “The outcome of events is predetermined!” according to the text messages, the agency said. “Be careful and refuse to support the nationalism and the leaders of the country who have discredited themselves and have already fled the capital!!!”
Mr Makukhin said he believed the disinformation was an attempt to scare civilians, comparing it to shelling neighborhoods.
“I think the only reason for that is to terrorize the population, to exert pressure and ultimately try to use this pressure to force our government to surrender,” he said. “There is still a general consensus in society that we cannot surrender. Otherwise all this pain and death would have been for nothing.”
