From Moscow, Beijing or Tehran, 1001 aspects of information warfare
The scale of efforts by pro-Russian groups to spread disinformation about the war in Ukraine is revealed in a report by cyber security company Mandiant consulted by France 24. But the conflict has also been hijacked by Chinese and Iranian cyber agents.
A fake Zelenskiy claiming Ukraine surrendered in a video, spreading rumors that Poles are harvesting organs from Ukrainian refugees to resell, or a fictitious Russian journalist claiming on Twitter that Israel always supports Ukraine to harm Russia.
The scale and variety of online disinformation and influence campaigns surrounding the war in Ukraine were described in a report by Mandiant, one of the main American cyber security companies, which France 24 was able to consult on May 19. While the efforts of pro-Kyiv hackers have already been widely commented on, observers are only beginning to understand the scale of the operations carried out by the pro-Moscow camp.
Fake suicides and fake organ trafficking
Disinformation operations have proliferated since the start of the war and the famous fake video of Volodymyr Zelensky announcing Ukraine’s surrender.
In this regard, Mandiant’s report helps lift the veil on a number of Russian online campaigns that have gone largely unnoticed or unattributed until now. This is particularly the case of “Second Infection,” a vast Russian information manipulation operation that has been known since 2014 but has increased its anti-Ukraine initiatives since the start of the war.
So, in March, these disinformation specialists “spread the internet rumor [le président ukrainien] “Vladimir Zelenskiy committed suicide in a bunker after collapsing in the face of Ukraine’s numerous military defeats,” Mandiant experts write.e The Reich at the end of World War II is probably no coincidence. Since the beginning of the conflict, Russian propaganda has tried to paint the president of Ukraine as a modern-day Adolf Hitler…
“Second Infection” is also responsible for another “fake news” spread on social media in April, alleging that the Azov Regiment will take “revenge” on Vladimir Zelensky – probably by destroying him – for abandoning them in Mariupol. A way to undermine the authority of the President of Ukraine over one of the most popular battalions.
Mandiant’s report also reveals the extent to which Russia’s allies are involved in this information war. Thus, Ghostwriter Belarusians created administrative documents from scratch, which were distributed on the Internet to feed the conspiracy theory, according to which “a group of Polish criminals with connections to high-ranking officials in the state apparatus – collected the organs of Ukrainian refugees and sold them to wealthy European clients,” – write the authors of the report.
These few examples show the two main axes of attack of these cyber agents: to sow confusion in the enemy ranks (for example, by making people believe that Zelensky is dead) and to weaken Ukraine’s relations with its European neighbors.
Ghostwriter is not his first such operation. These apostles of online discord have always been experts at trying to sow discord in Western countries. “Until 2020, this operation was mainly aimed at weakening the population’s support for NATO in Latvia, Lithuania and Poland,” Mandiant wrote in a report published in 2021.
The return of the Russian “troll factory”.
They simply adapted their modus operandi to the new reality of war. This is also a more general observation made by Mandiant’s experts. Alden Wahlstrom, an analyst at Mandiant and co-author of the report, emphasizes: “Each pro-Russian group uses the special know-how it has acquired over the years to use in this information war.”
Thus, the APT28 group, accused of accessing the servers of the American Democratic Party before the presidential elections in 2016, is suspected of accessing information that could harm Ukraine.
This conflict even marks the grand return of the Internet Research Agency (IRA), the notorious St. Petersburg ‘troll factory’ that became synonymous with ‘fake news’ during the 2016 US presidential election.” A new Telegram group called “Cyber Front Z” was created at the beginning of the war in Ukraine in order to organize the distribution of pro-Russian content. As far as we can independently confirm, the activity in this chat room is consistent with IRA practices,” says Alden Wahlstrom.
Cyberpropagandists and other Russian hackers and their direct allies in Belarus are not the only ones involved in the war in Ukraine. Groups from other countries “friendly” to Moscow, especially China and Iran, also took advantage of this opportunity, but it is not necessary to spread “made in Russia” propaganda. “They’re jumping on the bandwagon and crafting narratives that serve their national interests,” said Alice Revelli, an analyst at Mandiant and co-author of the study.
Opportunism in Beijing and Tehran
The Chinese group Dragonbridge, which runs an army of thousands of fake social media accounts, has become one of the leading Internet proponents of the bizarre thesis that the United States is secretly developing biological weapons in laboratories located in Ukraine.
The group, which is always quick to portray the United States as the biggest bad side of the international order, has spread messages that Washington is “fanning the flames of the conflict in the hope that the war will allow it to sell more weapons to Ukraine.” Authors of Mandiant’s report.
Iranian groups are also using this conflict to develop anti-American narratives… but not only that. This is an opportunity for them to praise Tehran’s nuclear policy, as they assure that “if Ukraine had not given up its nuclear arsenal, the country would not have been attacked.”
Pro-Tehran hackers even created a fake Twitter account of a Russian journalist named Fyodor Lukyanov, telling him that Israel is the main supporter of Ukraine. Mandiant experts point out that this influence campaign, called Roaming Mayfly by Mandiant, “deliberately targets Russian public opinion in an attempt to create tension between Russia and Israel.”
It is difficult to know whether these operations are effective or not. After all, the morale of the Ukrainian military seems quite high, and Westerners seem unanimous in their support for Kiev.
But, at the very least, “these campaigns have created an informational chaos that makes it difficult to tell right from wrong, and that’s already an achievement,” says Alden Wahlstrom. And it is also a formidable testing ground for wartime disinformation techniques. “All these groups are watching what each other is doing during this conflict to learn something for the future,” said a Mandiant analyst. Hoping to be more effective in the next conflict.
