Google TAG removes fraudulent 'influence' operations linked to Belarus, Moldova, Ukraine

Google's Threat Analysis Group (TAG) has taken down a "coordinated influence operation" connected to Belarus, Moldova, and Ukraine.

On February 28, TAG member Shane Huntley published a bulletin sharing some of the unit's latest efforts to tackle the spread of misinformation, including the removal of a coordinated campaign involving these countries – a topical issue considering the current Russia-Ukraine conflict. 

The influence operation was terminated in January, prior to the start of the conflict, but at a time when tensions between Russia and Ukraine was rising due to the presence of Russian troops at Ukraine's border.

According to Google TAG, four YouTube channels, two AdSense accounts – used to generate revenue by displaying advertisements – and one Blogger blog were wiped out in connection to this network. In addition, six domains were added to a denylist to stop them appearing on Google News surfaces and Discover.

Google says that the campaign "was sharing content in English that was about a variety of topics including US and European current events," and while the tech giant did not reveal further details, did say that the network was "financially motivated."

Google TAG also tackled a relatively large "influence operation linked to China." In total, 4361 YouTube channels were destroyed in January. The majority of these channels were spreading Chinese spam content, but some uploaded content in both English and Chinese languages concerning China and US foreign events. 

Furthermore, TAG has taken down YouTube channels, AdSense accounts, and Play developer accounts belonging to influence campaigns linked to Iraq, Turkey, and Libya's politics and current affairs. 

As the Russian-Ukraine conflict continues, Google has increased account protection for those in the region considered to be at higher risk of cyberattacks or attempted account compromise. This includes enabling two-factor authentication (2FA) and promoting the Advanced Protection Program. 

Google said on Twitter that its "threat intel teams continue to look out for and disrupt disinfo campaigns, hacking, and financially motivated abuse, and are working with other companies and relevant government bodies to address these threats."

In related news, Meta – formerly known as Facebook – is also attempting to combat misinformation. A number of accounts belonging to Russian state-media organizations have been blocked, and access to Russia Today (RT) and Sputnik across the European Union has been restricted. 

Previous and related coverage

• Major telcos including o2, Orange, Vodafone waive charges for Ukraine calls, data
  
• Ukraine calls for volunteer hackers to protect critical infrastructure
  
• Ukraine security agencies warn of Ghostwriter threat activity, phishing campaigns
  

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0