Russia waged a disinformation campaign to plant false stories with the media before and during its invasion of Ukraine, according to a new report by cyber security firm Mandiant.
The report details how known actors and campaigns can be refocused or leveraged in support of large-scale conflict or other security interests, the report said.
"For years, analysts have documented that Ukraine, a key strategic interest of Russia's, is a testing ground for Russian cyber threat activity that they may subsequently deploy elsewhere," said Mandiant Senior Analyst Alden Wahlstrom, one of lead authors of this report. Now, we witness how pro-Russia actors have leveraged the assets and campaign infrastructure developed over time (in whole or part) to target Ukraine.”
A Russian influence campaign that began before the invasion is known as Secondary Infektion, and has continued throughout the invasion, the report said. Mandiant linked multiple new false stories to the information campaign, such as a claim that Ukrainian President Volodymyr Zelenskyy committed suicide in a bunker due to military failure, that a group of Azov soldiers sought violence against Zelenskyy and the claim Ukrainian and Polish governments sought to work together to deploy Polish troops in Western Ukraine.
The report also described a Ghostwriter operation, in which compromised assets were used to spread a false story that Polish criminals were harvesting the organs of Ukrainian refugees, and claimed that Poland's Internal Security Agency was in the process of investigating the ring and "high-ranking Polish officials" that were involved.
The company also identified and named a new pro-Iran campaign Roaming Mayfly which may be linked to a previously identified Iranian influence campaign called Endless Mayfly that used deceiving content to elevate stories with false information.
“Iran is using Ukraine for narrative hijacking in hopes of their Information Operation resonating better," Sam Riddell, Mandiant analyst, said. "By jumping on the topic of the day that’s driving headlines, they’re using the momentum from that news cycle to continue pushing their own narratives that they’ve always been trying to advance.”
Multiple IO activities have been linked to Roaming Mayfly, including the idea that “U.S. fled from Afghanistan in 2021, and had now abandoned Ukraine, which deserved its fate due to its alliance with the ‘American axis of evil.’” A different idea boosted by Roaming Mayfly drew contrast between the war in Ukraine and the war in Yemen to highlight western hypocrisy.
The report also noted a pro-China campaign called DRAGONBRIDGE that uses thousands of accounts across multiple social media platforms to produce Chinese and English content that reportedly elevates Russian state media narratives.
