A fake Zelensky appearing on video claiming Ukraine is surrendering, spreading rumors that Poles are harvesting organs from Ukrainian refugees for resale, or a fabricated Russian journalist claiming on Twitter that Israel has always supported Ukraine to harm Russia.

The scale and diversity of online disinformation and influence campaigns around the war in Ukraine is illustrated in a report by Mandiant – one of the main American cybersecurity companies – which France 24 was able to consult on Thursday 19 May.

While the efforts of pro-kyiv hackers have already been widely commented on, observers are only just beginning to get a sense of the extent of operations carried out by the pro-Moscow camp.

Fake suicides and bogus organ trafficking

Since the beginning of the war and the famous fake video of Volodymyr Zelensky announcing the capitulation of Ukraine, disinformation operations have multiplied.

In this regard, Mandiant's report helps to lift the veil on a series of Russian online campaigns that had so far not been spotted or attributed.

This is particularly the case of "Secondary Infektion", a vast Russian information manipulation operation, certainly known since 2014, but which has multiplied anti-Ukrainian initiatives since the start of the war.

Thus, in March, these pros of disinformation "circulated the rumor on the Internet that [Ukrainian President] Volodymyr Zelensky had committed suicide in a bunker, overwhelmed by the many Ukrainian military defeats", write the experts of Mandiant.

Any resemblance to the fate of a certain Third Reich Nazi leader at the end of World War II is probably not coincidental.

Russian propaganda having since the beginning of the conflict tried to portray the Ukrainian president as a modern Adolf Hitler...

"Secondary Infektion" is also responsible for another "fake news" that circulated widely on social networks in April according to which the Azov regiment would seek "revenge" from Volodymyr Zelensky - probably by eliminating him - accused of having them abandoned in Mariupol.

A way to undermine the authority of the Ukrainian president over one of his most famous battalions.

Mandiant's report also uncovers the extent to which Russia's allies have participated in this information warfare effort.

Thus, the Belarusians of Ghostwriter fabricated from scratch administrative documents propagated on the Internet to feed a conspiracy theory according to which "a gang of Polish criminals - with links to 'highly placed officials in the state apparatus' - would harvest organs from Ukrainian refugees for sale to wealthy European clients," the report's authors write.

These few examples illustrate the two main axes of attack of these cyber agents: to sow confusion in the ranks of the enemy (by making believe that Zelensky is dead, for example) and to weaken the relations that Ukraine can have with its neighbors Europeans.

Ghostwriter is not his first operation of its kind.

These apostles of online discord have always been specialists in trying to sow discord in Western countries.

"Until 2020, this operation was mainly aimed at weakening the support for NATO of the populations in Latvia, Lithuania and Poland", wrote Mandiant in a report published in 2021.

The return of the Russian "troll factory"

They simply adapted their modus operandi to the new reality of war.

And this is also a more general observation made by Mandiant's experts.

“Each pro-Russian group puts its specific know-how developed over the years to good use in this information war,” underlines Alden Wahlstrom, analyst at Mandiant and co-author of their report.

Thus, the APT28 group, which had been accused of having entered the servers of the American Democratic Party in 2016 before the presidential election, is suspected of seeking to get their hands on information that could harm Ukraine.

This conflict even seems to mark the great comeback of the Internet Research Agency (IRA), the notorious St. Petersburg “troll factory” that had become synonymous with “fake news” around the time of the 2016 US presidential election.” A new Telegram group – dubbed 'Cyber ​​Front Z' – was created at the start of the war in Ukraine in an attempt to organize the spread of pro-Russian content.Ukrainian media claim it is run by the IRA, and even while we have not been able to confirm this independently, the activity seen in this chat room is consistent with IRA practices,” Alden Wahlstrom said.

Cyber ​​propagandists and other Russian hackers and their direct allies in Belarus are not the only ones obsessed with the war in Ukraine.

Groups from other countries "friendly" to Moscow - especially China and Iran - have also jumped on this opportunity, but not necessarily to relay the "made in Russia" propaganda.

“They act out of opportunism and develop narratives that serve their national interests,” summarizes Alice Revelli, analyst at Mandiant and co-author of the study.

Opportunism in Beijing and Tehran

Dragonbridge, a Chinese group that runs an army of thousands of fake social media accounts, has become one of the Internet's leading proponents of the outlandish thesis that the United States is secretly developing biological weapons in laboratories located in Ukraine.

Always quick to portray the United States as the big bad of the international order, this same group spread messages suggesting that Washington has "fanned the embers of conflict in the hope that a war would allow them to sell more weapons to Ukraine," note the authors of Mandiant's report.

Iranian groups are also taking advantage of this conflict to develop anti-American narratives… but not only that.

This is an opportunity for them to praise Tehran's nuclear policy because they assure that "if Ukraine had not abandoned its nuclear arsenal, the country would not have been attacked", report analysts from Mandiant.

Pro-Tehran hackers even created a fake Russian journalist's Twitter account, called Fyodor Lukyanov, to get him to write that Israel is a major supporter of Ukraine.

This influence campaign, dubbed “Roaming Mayfly” by Mandiant, “deliberately targets Russian public opinion in an attempt to create tension between Russia and Israel,” Mandiant experts note.

It is difficult to know whether these operations were effective.

After all, the morale of the Ukrainian army seems to be quite high, and Westerners appear united in their support for kyiv.

But, at a minimum, "these campaigns have created an information chaos that makes it harder to tell right from wrong, and that's already an accomplishment," says Alden Wahlstrom.

And then it is also a gigantic testing ground for disinformation methods in wartime.

"All these groups are watching what each other is doing during this conflict, in order to learn something for the future," said the Mandiant analyst.

Hoping to be more effective in the next conflict.

The summary of the

France 24 week invites you to come back to the news that marked the week

I subscribe

Take international news everywhere with you!

Download the France 24 app

google-play-badge_EN