‘Grotesque’ Russian disinfo campaign mimicks Western news websites to sow dissent

In Germany, news magazine Der Spiegel warned about natural gas shortages. In the United Kingdom, the Guardian, another media outlet, raised doubts about Russian war crimes in Ukraine. In Italy, Ansa, a leading news agency, criticized Kyiv’s storage of much-needed grain.

These news stories were all promoted extensively on Facebook and Twitter. They were all fake — and formed part of an extensive Russian influence operation to promote the Kremlin’s invasion of Ukraine that targeted people across the European Union and U.K., according to a report published Tuesday by Meta.

The extensive covert campaign relied on false media sites designed to mimic those of legitimate European brands like Der Spiegel, the Guardian and Ansa, among others.

In total, Meta’s researchers and other disinformation investigators discovered more than 60 fraudulent media websites — almost all of which were promoted heavily on social media, including via Facebook advertising totalling, collectively, more than $100,000 — that peddled Russian propaganda about its war in Ukraine and tried to sow doubts across the Continent about domestic governments’ ongoing support for Kyiv.

“It’s an attempt to smash and grab,” Ben Nimmo, Meta’s global threat intelligence lead, told POLITICO. “They set up these very sophisticated spoof domains. And then they tried to blitz them out across as many different platforms as they can.”

The social media giant could not attribute the months-long campaign to a specific group within Russia. But scores of evidence, including some of these websites being registered within the country, the extensive use of the Cyrillic alphabet and language mistakes primarily associated with translated Russian, highlighted how the covert influence activity originated in Russia. It began soon after Moscow’s invasion of its Western neighbor.

The campaign, which ran between April and September, represents the largest and most complex undercover effort to promote Russia’s interests on social media since the beginning of the war in Ukraine. Part of the covert operation was previously reported on by T-Online, a German news outlet, whose brand was similarly copied by these Russian actors to push Kremlin-backed propaganda. Other media organizations whose websites were copied to promote Moscow’s falsehoods include Germany’s Welt, France’s 20 Minutes and the U.K.’s Daily Mail.

It relied on multiple networks on fake social media users, many of which used profile images generated via artificial intelligence tools. It targeted people in Germany, France, Italy, Latvia, the U.K. and Ukraine, respectively.

“It’s grotesque,” said Alexandre Alaphilippe, executive director of EU Disinfo Lab, a nonprofit organization that specializes in tracking online influence campaigns and discovered this Russian-affiliated campaign separately to the work done by Meta. His team was able to link many of these fraudulent fake news websites to the same wider network, and found repeated ties that directly linked the influence campaigns in different languages to Russian actors.

“We found extensive Russian traces,” he added. “We also found the infrastructure (to help support the covert campaign) was based in Europe to run this operation.”

Good tradecraft, little impact

Despite the sophistication of the months-long campaign, researchers discovered the network, including almost 1,000 fake Facebook profiles, failed to break through with legitimate European social media users.

The fraudulent accounts bought Facebook ads to promote the Russian propaganda to an online audience | Image via iStock

As part of the activity, for instance, these fraudulent accounts — many of which used the same naming structure as part of the profile usernames — bought Facebook ads to promote the Russian propaganda to an online audience. They often linked to the pro-Kremlin articles in the spoofed media websites and posted repeatedly on each other’s Facebook feeds in an effort to garner engagement from the wider online world. None of this promotion garnered the attention of anyone outside the clandestine network.

Initially, the activity was divided evenly between all the European countries. But as the network expanded, the covert campaign redirected much of its efforts toward Germany, based on Meta’s analysis. Researchers at the Atlantic Council’s Digital Forensic Research Lab, which tracks online misinformation and independently reviewed Meta’s analysis before publication, found posts criticizing Berlin’s move away from Russian natural gas and warning Germans of a likely energy crisis because of their government’s new energy policies.

The posts however received little to no interaction with legitimate social media users. In part, that was because the Russian-affiliated accounts often had language discrepancies that outed them as non-native German speakers. Others also posted repeatedly in Russian, including links to Russian food recipes, while some made basic mistakes like using a male profile image for an account associated with a woman.

“This was a clear cut case of inauthentic activity. It ticked all the boxes,” said Nika Aleksejeva, lead researcher for the Baltics at the Atlantic Council’s Digital Forensic Research Lab, who initially discovered this covert network in August.