FYI.

This story is over 5 years old.

Tech

These Hackers Are Pretending to Be Journalists, And Failing Miserably

Politically-motivated hackers are trying to get people to pay attention with fake news accounts, but it's not really working.

This week, an account named "Ukraine.info" started spreading the news on Twitter of secret, biological tests in the country. Then, the account "W-News" joined in, tweeting apparently sensitive documents.

Except these accounts, which are seemingly trying to pass off as journalists or legitimate sources of information, are sloppily-put-together sock puppets of one or more politically-motivated hackers. They've been trying desperately to get their fake "news" out to actual journalists, or anyone who will listen really, and are failing miserably.

Advertisement

It started at the beginning of this month, when a hacker or group of hackers using the handle "pravysektor" released internal files from Netia, a Polish telecommunications and internet service provider. Linda Marcinkowska, a spokesperson for Netia, confirmed that the hack was real in an email to me at the time.

The hackers tweeted a steady stream of highly dubious "hacked" documents

Shortly after, the hackers tweeted a steady stream of other highly dubious hacked documents at me and other Twitter users who follow data breaches. Those documents included alleged records relating to Polish citizens and the NSA's surveillance program PRISM, and were interspersed with snippets of political resentment. At one point, the hackers even posted apparent credentials for a Ukranian government site.

Then on Thursday, the tweets about "bacteriological tests" in Ukraine started, and more accounts popped up.

"Ukraine.info," which uses an image of Mikheil Saakashvili, a Ukrainian politician, as its profile picture, started sending details of the supposed biological tests to a bizarre selection of different people and organisations: a Polish journalist, a UK asset company, a NASA account, the financial editor of The Times, and even Barclays bank.

W-News, another account that tweeted for the first time just a few hours ago, uses a photo of reporter and comedian Katherine Timpf, who has appeared regularly on Fox. It has also been trying to spread news of the tests. The accounts are clearly linked to pravysektor: all of their tweets either reference or link to the hackers' own tweets.

A sample of tweets from "Ukraine.Info", archived by Motherboard.

On Friday, both accounts started blasting a link to files supposedly hacked from an Armenian embassy. The recipients of this info included the Culture Service of Polish Embassy in Belgium, a Polish husband-and-wife cooking duo, and a columnist from the Guardian.

Some hackers know how to game the media, and a few know how to do it exceptionally well. But pravysektor, whoever they might be, have got a way to go yet.