Graphika Report
Monday August 21, 2023
Summit Old, Summit New
Léa Ronzaud, Joseph A. Carter, and Tyler Williams
DownloadRussia-Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations About NATO Summit
- Russia-linked actors engaged in a multi-pronged effort to influence online conversations around the July 2023 NATO Vilnius summit, using deceptive practices to advance narratives almost certainly intended to denigrate NATO and host nation Lithuania. These included disseminating documents purportedly hacked from the Lithuanian government, and seeding false claims about NATO’s spending and involvement in French domestic affairs.
- The actors conducted two distinct influence operations, employing a range of inauthentic behaviors almost certainly intended to deceive online audiences. These tactics, techniques, and procedures (TTPs) included creating and disseminating bogus NATO press releases and operating fake personas across multiple online platforms.
- Based on behavioral indicators, we attribute the first operation with medium confidence to Doppelganger, a sprawling campaign that has impersonated media outlets and government agencies since at least May 2022 to disseminate pro-Russia messaging. Based on behavioral indicators, we attribute the second operation with medium confidence to Secondary Infektion, a Russia-linked campaign active since at least 2014 that uses fake personas to seed falsified and hacked documents online.
- The exact nature of the relationship between these two sets of activity is unclear, but the near-simultaneous targeting of online conversations about the NATO summit using new and old TTPs speaks to the persistence and multi-faceted nature of Russian influence operations. This threat landscape comprises multiple actors operating concurrently, but not always in direct collaboration, to pursue the same strategic objectives, employing a range of both tried-and-tested and newly developed capabilities.
- Despite this persistence, the operations appear to have had a limited impact on the online conversation about the Vilnius summit. Their content received minimal shares from authentic users, and what online traction they did generate was largely in existing pro-Kremlin communities. Graphika also observed social media users, including influential pro-Kremlin figures, calling out the activity as fake, suggesting the actors often failed in their efforts to deceive online audiences.