At a glance.
- France alleges Russian disinformation campaign.
- The GRU's Cadet Blizzard operation.
- Ukraine's Cyber Police shut down a pro-Russian bot farm.
- Pentagon explosion hoax amplified by pro-Russian social media accounts.
France alleges Russian disinformation campaign.
French authorities report that Russian actors attempted to plant and amplify disinformation using, in part, spoofed pages misrepresenting themselves as major news outlets. Bloomberg reports that France's Ministry of Foreign Affairs uncovered a coordinated campaign that "involved the creation of fake web pages impersonating French media including 20 Minutes, Le Monde, Le Parisien and Le Figaro, and government sites, as well as the creation of fake accounts on social networks." Foreign Minister Catherine Colonna said in a statement, “France condemns these actions, which are unworthy of a permanent member of the United Nations Security Council. No attempt at manipulation will distract France from its support for Ukraine in the face of Russia’s war of aggression.”
The GRU's Cadet Blizzard operation.
Microsoft researchers have now identified a cluster of cyberattacks as the work of a GRU unit Microsoft has named "Cadet Blizzard." Redmond thinks that Cadet Blizzard, formerly tracked as DEV-0586 has been operating since 2020. They associate the unit with last year's WhisperGate wiper attacks against Ukrainian targets, and they note that in recent months the threat actor has been associated with influence operations.
Cadet Blizzard isn't the only GRU threat actor working against Ukraine. "Microsoft assesses that Cadet Blizzard operations are associated with the Russian General Staff Main Intelligence Directorate (GRU) but are separate from other known and more established GRU-affiliated groups such as Forest Blizzard (STRONTIUM) and Seashell Blizzard (IRIDIUM)." Compared to Forest Blizzard and Seashell Blizzard, Microsoft assesses Cadet Blizzard as generally less effective than it better-known institutional siblings. Still, it's enjoyed a modest level of success. Beside its involvement with WhisperGate, Cadet Blizzard has more recently been linked to the defacements of several Ukrainian organization websites, as well as multiple influence operations.
Ukraine's Cyber Police shut down a pro-Russian bot farm.
Ukraine's Cyber Police on Monday announced the arrest of three bot-farmers who were operating from a garage in the west-central Ukrainian city of Vinnytsia. They were engaged in automated disinformation, distributed through inauthentic accounts they ran in the Russian interest. Their motivation may have been more financial than ideological, as they received payment in Russian rubles, presumably from Russian paymasters. The Record reports that the three men who operated the bot farm created about five-hundred bogus accounts each day, used them to distribute pro-Russian propaganda and disinformation, and received the equivalent of about $13,500 each month. The rubles (at present a prohibited currency in Ukraine) were laundered through illicit (in Ukraine) payment services like WebMoney and PerfectMoney, then converted to cryptocurrencies and loaded onto bank cards.
According to the Cyber Police, "Bot accounts in social networks were used to discredit the Defense Forces of Ukraine, to justify the armed aggression of the Russian Federation, to form public opinion among Ukrainians in the interests of the enemy, and to destabilize the socio-political situation in the country." There was also some direct criminal activity, Ukrainian authorities say. "Fake accounts have also been used to commit fraudulent activities on trading platforms." Should the three men arrested be found guilty, they could each face up to fifteen years in prison.
Pentagon explosion hoax amplified by pro-Russian social media accounts.
AI-generated, faked imagery of what was represented as an explosion at the Pentagon briefly roiled markets when it began circulating on May 22nd. Much of the amplification the admittedly crude fake received can be credited, the Washington Post reports, to a verified Twitter account, @CBKNEWS121, known for "standing with Putin" and retailing a grab-bag of tired and cranky conspiracy theories. If this story gained currency, what can be expected from more sophisticated fakes?
