Russian sock puppet crew tried to frame Texas governor for blackmailing Biden
A fake tweet from Texas Governor Greg Abbott about Ukrainian politicians blackmailing the Biden family. An invented gang rape of a Ukrainian woman by Polish nationalists. A false conspiracy theory that the President of Ukraine secretly allowed Polish troops to occupy and control swaths of Ukrainian territory under the guise of defending it from Russia.
As US spies warn of the possibility of fake videos and Russian-made propaganda provocations to justify another invasion of Ukraine in the coming weeks, the world need not look far to see what a campaign of disinformation and provocations against Ukraine would look like. Like. These stories, published in recent years, are examples of how this kind of campaign is going right now.
Since 2014, Secondary Infektion, a disinformation team attributed to Russia by cybersecurity chiefs Facebook and Reddit, has littered the internet with fake government documents and fake screenshots of non-existent social media posts. Despite the group’s long pedigree and deep catalog of content, its forgeries and forgeries have largely failed to stir public opinion or organic social media engagement. The content, however, offers insight into how Moscow attempted to undermine Ukraine’s pro-Western government with counterfeit provocations similar to those now expected by US intelligence.
A review of Ukrainian social media posts over the past year by The Daily Beast shows 21 examples of fake stories planted by accounts using the Secondary Infektion playbook.
A story, which relied on fake social media posts about Polish nationalists raping a Ukrainian woman as part of an initiation ritual, was published on November 8, 2021 by a fake “patriotic” Ukrainian Facebook page . Meta officials removed the page and attributed it to Secondary Infektion after The Daily Beast shared its findings with the company.
Separately, Reddit suspended six accounts last week after The Daily Beast identified them as possible Secondary Infektion sock puppets. Reddit suspended the accounts for violating the company’s terms of service prohibiting “manipulated content,” although company officials were unable to attribute the accounts to a particular entity. The company also suspended seven other accounts, which caused Secondary Infektion-type counterfeits on Ukraine over the past year.
Many other fake characters posted on Ukrainian open forums, social media, and news sites used the same behavioral tics as Secondary Infektion trolls, but The Daily Beast was unable to formally attribute them to the group.
Taken together, the messages serve similar purposes: portraying Ukraine as hopelessly corrupt and ruled by an extremist far-right movement, dividing and isolating Kyiv from key allies like Poland and Germany, and pitting the country’s nationalists against each other. to minorities.
The United States, Ukraine’s most important ally, features prominently in a number of Secondary Infektion messages. An article, published early in the Biden administration, sought to convince readers that Ukrainian President Volodomyr Zelensky couldn’t establish a relationship with Washington because Zelensky’s political rivals held dirt on President Biden’s son, Hunter, and his business dealings in Ukraine. As evidence, the trolls included a fake screenshot of a tweet from Texas Governor Greg Abbott showing Biden kissing former Ukrainian President Petro Poroshenko – Zelensky’s political rival – warning of how he “is bow to a third world country”.
Governor Abbott’s Twitter account shows no record of ever posting such a tweet, and a spokesperson confirmed in an email that the message was fake.
Accounts posting Abbott’s fake story used what became a well-known playbook for Secondary Infektion trolls. Trolls create accounts with stolen avatars the same day they share a post containing some kind of fake. They post a story once on an open forum, blog, and social media, and never engage or show activity on those accounts again. While Reddit remains popular for Secondary Infektion trolls who post in multiple languages, trolls tend to stick to a handful of dumps that vary by audience and language used.
In Ukraine, Secondary Infektion attempted to pit Ukrainian and Polish nationalists against each other in an effort to isolate Kiev from an increasingly important diplomatic and military ally. In articles published in Russian and Ukrainian in November 2021, Secondary Infektion trolls shared links to a Facebook post with a false story that members of Poland’s far-right National Radical Camp had raped and murdered a Ukrainian woman. of 51 as part of an initiation ritual for new members of the group.
The message was posted by a Facebook page set up in 2018 that claimed to be a pro-military Ukrainian patriotic group dedicated to offering “respect to the defenders of Ukraine”. The group, run out of Indonesia, according to transparency text on the page, posted only occasional innocuous patriotic content for years until it came out of character in November with screenshots of an alleged text message relating the story of the rape.
Meta officials quickly suspended the page after The Daily Beast brought it to their attention, and the company’s cybersecurity officials assess with moderate confidence that the page was linked to Secondary Infektion, according to a gatekeeper. word of Meta.
When not trying to inflame relations between Ukraine and specific countries, sock puppets using Secondary Infektion-type tactics have also attempted to use LGBT rights as a discrediting issue in the eyes of the West. An October 2021 post falsified a letter from a Ukrainian gay rights group, the LGBT Association LiGa, protesting a proposed infertility tax as discriminating against same-sex couples, who cannot legally adopt children or get married in Ukraine.
In a statement posted to Facebook, LiGa officials confirmed that the story “this letter was printed on letterhead that does not belong to LiGa and contains incorrect contact information for our organization and a false logo” , with a false signature of the president of the group. , Oleg Aliokhin.
As Russia has led an almost unprecedented mobilization of troops and weapons along the Ukrainian border over the past three months, Secondary Infektion type trolls have slowly turned their attention to the brewing crisis with stories aimed at undermining Kyiv’s response.
A post, posted to Reddit and Ukrainian blogs in early February, shared a leaked fake map claiming to show a ‘buffer zone’ to be occupied by Polish troops as part of a secret deal with the Zelensky administration to defend against Russia. . The false story, which warned that “large-scale territory will be separated from Ukraine for years,” appears to be an attempt to try to thwart growing military cooperation between the countries as Russian threats have piled up.
Relations with Germany, which have proved cold in the face of arms demands from the Ukrainian government as Russian border construction continues, have also been a frequent target for posts using the Secondary Infektion methodology.
In a tongue-in-cheek twist, an article published last week recounted a false story leaked by a fictitious Ukrainian government insider leaking details of a troll factory run by US, UK and Ukrainian intelligence services spreading anti-German memes on social networks to discredit the minus of Berlin. than enthusiastic support for Ukraine amid threats of further Russian aggression.
It remains unclear whether Russia plans to invade Ukraine or use a fake video pretext as warned by US intelligence. But Secondary Infektion’s failure to draw attention to its various forgeries and counterfeits suggests that if Moscow pursues a propaganda blitz, it’s like confronting an audience with healthy skepticism about the accent provocation. Russian.