HFT market makers are often responding to an IOI (Indication of Interest) which an exchange will broadcast when they have orders on the book. A responder that's interested in the trade will typically respond with an IOC (Immediate or Cancel) order. The order book is handled on FIFO (First-in, First-out) fulfillment method. If the IOC order isn't filled/partially filled, it is immediately cancelled. This is standard practice and encouraged by exchanges of their market makers.

Spoofing can be done many ways, but it's usually something like submitting a day order at an unreasonable price, then cancelling, say 10ms later.

Of course, reality is a bit more nuanced than that.

Source: I've worked in IT in Finance my entire career and have often dealt with SEC/FINRA/FBI requests for order history, and identifying which of our client(s) made the orders. Typically for specific tickers on specific dates, but sometimes for all tickers on specific dates, or for specific tickers for several years. Last I had to run these reports, it was for a small dark pool (like an exchange with unpublished prices). We typically had 10s of millions of orders a day. Quite a bit smaller than an HFT firm will be handling, but still quite a bit of data to work with and have to hand over on DVDs.

HFTs quote in a given symbol, often derivative e.g. “AMZN 2000 strike call option” based on market in another symbol, often outright e.g. “AMZN stock“. They are willing and happy to trade at prices quoted while market in AMZN remains what it is. Once it moves, they re-price their quotes in option(s). Their quote sizes are usually pretty small.

Spoofers put out orders without intention to trade. In fact, usually they would be horrified if their entire order trades. Their order price is not based on another market; their only intention is to impact prices in the book where they put the spoofing order. To achieve that, they often use disproportionately large order sizes, such as posting quantity 1000 where most other orders are between 1 and 20. Often they keep “applying the pressure” on the market by modifying the large spoofing order multiple times towards the market - moving the sell order lower and buy order higher - not as a response to changing market conditions in some other instrument but with the sole intention of impacting the price in the book in question.

Leaving aside "flooding the order book"; the primary difference is that the HFT orders are made in good faith with intent to trade at the order price based on the current market.

Layering and spoofing are not done in good faith: there is never any intent to trade, just to convey a false appearance of market demand.

What 'HF'T teams do is high frequency trading, or rather low latency trading. You put offers in the book you feel comfortable trading at, and you are happy if you trade at that price. If the market price stays static they pick up the spread on average. However, the reason they are so tight in the order book, is because if the market moves they're very quick to pull their offers and bids and move to a new price. HFT companies are providing liquidity in that situation. As long as you place a single order, it will get fulfilled.

So to be clear, the HFT firm that places orders in the market want to trade those offers. They're comfortable placing those orders more competitively than your average punter because they can respond to market moving events quicker.

Layering and spoofing is something different - you're placing orders in order to make people think you want to trade, but you don't.

It's like asking me what's the difference between Al Gore offering you money to tackle climate change and a climate change denier offering you money to tackle climate change? Well one of them is clearly lying.

HFTs scale their operation across a huge population of securities. These Ukranians apparently targeted just a handful.

That's a grey area, I believe, because such a pattern might occur legitimately though would also arise from calculated manipulation.

Perhaps they were unable to find otherwise legitimate trades from the traders ?