Happy Nice Mall

WASHINGTON — Sitting in his office last month, Andriy Taranov, a board member of Ukrainian public broadcaster Suspilne, noticed a strange message running under his television screen. It was stated that Ukrainian President Volodymyr Zelensky announced his surrender.

Mr. Taranov was stunned because there was no talk of his surrender among the journalists covering the Russian invasion of the country. “There is no such thing in any journalistic circle,” he recalled thinking. “It certainly seems contradictory.”

He quickly realized that the message was fake. It was planted by hackers in the chyron of Media Group Ukraine’s live broadcast.

Since the invasion of Russia began in late February, hackers have repeatedly hacked into the social media accounts and broadcast systems of trusted information sources in Ukraine, such as government officials and leading media outlets. They have used their access to spread false messages that Ukraine has surrendered, sometimes using fake videos to support their claims.

While there is no evidence that the misinformation campaign had a noticeable effect on the conflict, experts say the hackers may not have actually intended to deceive anyone. Instead, the hackers are likely trying to erode trust in Ukrainian institutions and show the government and the news media that they can’t be trusted for information or to keep hackers out of their systems. The tactics mirror those used in other Russian disinformation campaigns focused on fueling divisions and cultural clashes.

“You can create uncertainty, confusion and distrust,” said Ben Read, director of cybersecurity firm Mandiant. “It doesn’t have to rely on close reading to have an impact on the population; it undermines trust in all messages.”

Facebook traced a hacking campaign targeting military officials to state-sponsored hackers in Belarus. Other cyberattacks, including those against media and telecommunications networks, have yet to be attributed to specific government actors.

But Ukrainian officials suspect Russia is behind the hacking and disinformation.

“Of course they are behind these attacks,” said Victor Zhora, deputy head of Ukraine’s cybersecurity agency, the State Private Communications and Information Protection Service.

“For the first time in history, we are dealing with both a conventional war and a cyber war,” Mr. Zhora said. “It completely changes our landscape for what is happening around Ukraine.”

Attempts to spread disinformation about Ukraine’s surrender began days after Russia’s invasion began. Hackers hacked into the Facebook accounts of high-profile Ukrainian military leaders and politicians and then used their access to send false messages announcing the surrender. They accompanied some posts with videos of soldiers waving white flags and falsely claimed that the images depicted Ukrainian soldiers.

Facebook’s parent company, Meta, said it quickly detected the attack and was, in some cases, able to prevent hackers from sending fake messages from compromised accounts. Meta said the hackers were linked to a group that security researchers call Ghostwriter, linked to Belarus.

Security researchers said Ghostwriter frequently targets prominent figures in Europe, using often compromised social media and email accounts to deliver messages aimed at dismantling support for NATO. According to researchers, the group has concentrated its efforts here since the war in Ukraine began.

“They are aligned with Russian goals,” Mr. Read said of the Ghostwriter.

In mid-March, Ukrainian authorities detected another hacking campaign trying to spread misinformation about the surrender. A hacker installed a relay system to help divert calls to the Russian military, according to the Ukraine Security Service, the country’s law enforcement and intelligence agency. Law enforcement said the system was also used to send text messages urging Ukrainian security forces and officers to surrender and support Russia.

Ukraine’s Security Service said it had arrested the person responsible for the messages it said it made thousands of calls on behalf of the Russian military every day.

A more visible attempt to spread disinformation about the surrender soon followed. On March 16, a “deep fake” video of Mr. Zelensky asking the Ukrainians to lay down their arms and surrender to Russia surfaced on social media.

The hackers targeted television stations and news outlets in Ukraine to disseminate the digitally manipulated video, broadcast it on Ukraine 24, a television station operated by Media Group Ukraine, and post it on the channel’s YouTube channel.

Media Group Ukraine said it believed Russian hackers were responsible. “Our systems were under constant attack for over two weeks before they were hacked,” said company spokesperson Olha Nosyk. “We have strengthened protection and implemented the necessary technical tools to prevent the recurrence of such incidents.”

Deep fraudsters like Mr. Zelensky’s use artificial intelligence to create seemingly realistic images of people doing and saying things they don’t actually say or do. The researchers warned the technology could be. exploited during elections and other high-profile political moments to spread lies about prominent politicians.

Oleksiy Makukhin, an expert on fighting misinformation in Ukraine, said it was the first time he had seen a digitally manipulated video of Mr. Zelensky circulating on messaging app Telegram. However, Mr. Makukhin said that most of the messages about the video emphasized the fact that the video was fake and made fun of him for being poorly made.

“I can’t think of a person in Ukraine who believes that,” he said. “People in Ukraine are already quite educated about the disinformation that Russia is spreading all the time.”

Still, Mr. Zelensky took to his official channel on Telegram to deny the video’s claims. We protect our land, our children, our families,” he said. “That’s why we don’t intend to lay down arms until our victory.”

On Friday, Ukraine’s Security Service said it discovered another text messaging campaign that sent more than 5,000 messages about surrender using a bot farm connected to Russia. “The outcome of events is predetermined!” He said text messages, according to the agency. “Be prudent and refuse to support the nationalism and leaders of the country who discredit themselves and have already fled the capital !!!”

Mr. Makukhin said he believes the disinformation is an effort to scare civilians and compares it to the bombing of neighborhoods.

“I think the only reason for this is to terrorize the people, put pressure on them, and finally try to surrender our government with that pressure,” he said. “There is still a general consensus in society that we cannot surrender. Otherwise, all this suffering and death was in vain.”