At a glance.
- Mandiant's Cyber Defense Report looks at influence operations.
- Disinformation for domestic morale.
- Bronx cheers, with a side of fact-checking.
Mandiant's Cyber Defense Report looks at influence operations.
Mandiant has released the second issue of its Cyber Snapshot report, looking at the proliferation of information operations (IOs), threats to NFTs and cryptocurrency, and enterprise security best practices.
The researchers note that Russian state-sponsored threat actors are currently “conducting widespread IO campaigns to bolster the positive perception of the Russian invasion of Ukraine to the Russian people.” Meanwhile, China-aligned actors are carrying out information operations to “sway public opinion against the expansion of rare-earth minerals mining and refining operations in the U.S. and Canada, likely as an attempt to protect China’s heavy investments in rare-earth production.”
The researchers add, “Mandiant finds that these kinds of campaigns are happening constantly. We regularly see new actors who operate on behalf of nation-states that have never before demonstrated a significant cyber capability.”
As usual, lies require a bodyguard of truth. Mandiant says the most effective information operations involve combining truth and lies, particularly through leaking stolen information. “The most concerning trends seen in the IO space concern hack-and-leak campaigns. Hack-and-leak IO campaigns are cyber operations in which an attacker breaks into a victim’s network, steals sensitive, damaging data and leaks it publicly to influence a given audience. In many cases, hack-and-leak operators will alter the material they steal to make it seem even more damaging," the researchers say. "These IO campaigns have had significant impacts in the past, including during the 2016 presidential election in the U.S. As an increasing number of actors adopt IO as a viable means to achieve their goals every year, campaigns will continue to evolve as their capabilities improve.”
Disinformation for domestic morale.
Maintaining domestic morale has grown into a significant problem for Russia's government, and it's directing significant resources toward propaganda directed at the home audience. Fears that the war isn't being won, that Russia's resources aren't up to it, and that half measures are crippling the fighting forces are growing. The missile strikes against Ukrainian cities over the past week and a half have more informational than strategic significance.
"Air raid warnings are howling over several of Ukraine's regions at the same time," Russian state television host Olga Skabeeva said, as she led a discussion of Russia's drone and missile strikes against Ukrainian civilian targets. Her point, and that of her interlocutors, was to emphasize the defensive and justifiably retaliatory character of those strikes. "A state of heightened danger remains in effect in the Ukrainian capital. We are continuing to inflict pinpoint strikes against infrastructure objects. Let's watch the latest footage." The video she introduced showed an Iranian-produced Shahed-136 (which the captioning called by its recently assigned Russian name "Geran") hitting the roof of a high-rise building in Kyiv while pedestrians on the street below ducked and covered. Ms SKabeeva resumed her commentary. "Today, [Anton] Gerashchenko posted a video of the remnants of our drone, or the Iranian drone, Shahed-136 or Geran-2. Many have noted the inscription--look closer--'For Belgorod.' They've tormented the people who live near the territory bordering Ukraine. Once again, I assert that we're forced to conduct these strikes, that they leave us no choice." (Anton Gerashchenko is an advisor to Ukraine's Minister of Internal Affairs.)
Thus the drone strikes are now being framed in Russian state media as retaliation for Ukrainian strikes at military targets in Belgorod, a Russian city near the Ukrainian border where numerous Russian logistics sites and staging areas are located. The New York Times dates the Ukrainian strikes to Sunday; Russian attacks against Ukrainian cities had then been in progress for about a week. Dmitry Abzalov, Director of Russia's Center for Strategic Communication, offered a familiar wheels-within-wheels explanation of the exchanges of fire. The US is behind them: "The situation will keep intensifying over the next several weeks due to elections. The economic situation in the US is also difficult. They're fighting for the Senate. As we've been saying for six months, in the lower House [of Representatives] it's already decided. The Senate is where the main fight will take place. There are certain people from certain districts for whom foreign policy successes are crucial. They will keep moving this agenda forward until November 8th. It's very important and we should understand that the horizon of this election is November 8th. These things affect the intensity of what is happening. They'll be throwing in masses of people just to stick their flag into anything." Presumably the UK, as usual in the Russian government's line, is also complicit: throughout the discussion of American wire-pulling, the split screen beside Mr. Abzalov showed a video (no audio) of British Prime Minister Truss making a speech, but perhaps the point is that one Anglophone is as good as another. Ms Skabeeva took the last words. "In other words there is no other conclusion. We will spare no Kalibr [missiles] in the near future. in the following weeks leading up to the US midterms, nor will we spare Geran [drones]." (And again, all credit to the invaluable work of the Russian Media Monitor in curating Russian television for Western audiences.)
Bronx cheers, with a side of fact-checking.
St. Petersburg's Internet Research Agency was the world's leading troll farm, excelling in disruptive influence operations whose goal, fundamentally, was to darken counsel, to confuse. But a long appreciation in the National Interest argues that the IRA has dropped from its place on the influence ops leaderboard, falling during the current hybrid war behind the North Atlantic Fellas Organization (NAFO), which is currently running crude circles around Russian mouthpieces, trolling and sh*tposting like an avid doge team in some virtual Iditarod. Russian disinformation operations, where they've needed to put across a consistent, unitary persuasive message, have so far failed to show up, internationally at least. (Domestic messaging is a different matter.)
The NAFO is interesting in that, first, it appears to be a genuine grass-roots movement, not a top-down policy shop like the IRA. Officials and the international relations intelligentsia seem disproportionately represented among the Fellas, but NAFO bears no obvious signs of astroturf, nor does it appear to be a government auxiliary. Second, it seems to be able to convey a consistent message: the negation of Russia's positive line on the war. This isn't negative in the same way the IRA's work has been. Where the IRA sought confusion, the Fellas deliver refutation and ridicule. Do the Russian organs claim they're winning? NAFO jeers and presents evidence to the contrary. Do the state television presenters denounce Ukraine as the aggressor? The Fellas blow their collective nose in that tissue of lies. And so on.
Nor is NAFO all ridicule and vulgar images of a cartoon doge wiping his fourth point of contact with the Russian tricolor flag. (Yes, Fellas, we saw that one somewhere in your threads, and we're ashamed to say we found it kind of funny.) The group has also established a Discord server devoted to fact-checking and debunking Russian media reports and other official mendacity. When this war is over, information operators will profit from a serious after-action review of NAFO's approach to influence. The essayist in the National Interest, Maximiliana Wynne, suggests the lines along which such a review is likely to proceed:
"In today’s digital age, the internet is at the forefront of ideology and is undisputedly the dominant source of news and information for consumers worldwide. Narratives increasingly shape outcomes by feeding biases and fears that cause populations to think, act, and even sway public opinion to vote in certain ways. NAFO has shed light on new methods for countering state-sponsored disinformation, highlighting the importance of assembling and backing online movements seeking to set the message straight in the cyber world. Disarming disinformation campaigns in the future will require a shared responsibility among those who govern and the governed."