Summit Old, Summit New
Russia-Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations About NATO Summit
- Russia-linked actors engaged in a multi-pronged effort to influence online conversations around the July 2023 NATO Vilnius summit, using deceptive practices to advance narratives almost certainly intended to denigrate NATO and host nation Lithuania. These included disseminating documents purportedly hacked from the Lithuanian government, and seeding false claims about NATO’s spending and involvement in French domestic affairs.
- The actors conducted two distinct influence operations, employing a range of inauthentic behaviors almost certainly intended to deceive online audiences. These tactics, techniques, and procedures (TTPs) included creating and disseminating bogus NATO press releases and operating fake personas across multiple online platforms.
- Based on behavioral indicators, we attribute the first operation with medium confidence to Doppelganger, a sprawling campaign that has impersonated media outlets and government agencies since at least May 2022 to disseminate pro-Russia messaging. Based on behavioral indicators, we attribute the second operation with medium confidence to Secondary Infektion, a Russia-linked campaign active since at least 2014 that uses fake personas to seed falsified and hacked documents online.
- The exact nature of the relationship between these two sets of activity is unclear, but the near-simultaneous targeting of online conversations about the NATO summit using new and old TTPs speaks to the persistence and multi-faceted nature of Russian influence operations. This threat landscape comprises multiple actors operating concurrently, but not always in direct collaboration, to pursue the same strategic objectives, employing a range of both tried-and-tested and newly developed capabilities.
- Despite this persistence, the operations appear to have had a limited impact on the online conversation about the Vilnius summit. Their content received minimal shares from authentic users, and what online traction they did generate was largely in existing pro-Kremlin communities. Graphika also observed social media users, including influential pro-Kremlin figures, calling out the activity as fake, suggesting the actors often failed in their efforts to deceive online audiences.
Léa Ronzaud
Senior Analyst
Léa Ronzaud leads monitoring and investigations into the detection and tracking of Russian influence operations and violent extremist groups. She also researches nihilistic violent extremism and hacktivism. Léa’s work has helped disrupt efforts by extremists in multiple countries to orchestrate real-world harm and exposed the inner workings of nation-state influence operations from Russia, China, and Iran.
Joseph A. Carter
Vice President, Customer Success and Operations
Joseph Carter was Vice President, Customer Success and Operations, at Graphika.
Tyler Williams
Vice President of Intel
Tyler Williams is an expert in open-source intelligence methodologies and structured analytic techniques. Under his leadership, Graphika's intelligence analysts illuminate commercial and security interests, from brand backlashes to state- and non-state-linked influence operations (IO), extremist movements, and other online manipulation and harms.
Download the complete PDF
The full report includes the complete network graph maps, raw attribution indicators, cross-platform topology analysis, and the full takedown timeline with platform-level data.
- Full network graph visualizations
- Attribution indicators with confidence scores
- Raw behavioral modeling data
- Takedown coordination timeline
Related Reports
Agitate the Debate
Inauthentic Accounts Pose as Taiwanese Users to Spread Political Memes and Videos Ahead of 2024 Election
Read the Report
Character Flaws
School Shooters, Anorexia Coaches, and Sexualized Minors: A Look at Harmful Character Chatbots and the Communities That Build Them
Read the Report
Rumores Renovables (ESP)
Análisis del ecosistema en línea de las comunidades hispanohablantes que se oponen a las iniciativas de energía renovable
Read the ReportSee How Graphika Can Help Your Team Act on This Intelligence
This report is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.