Russia's trolling tactics are getting more elaborate

The Russian-linked actors are trying to spread fake tweets tied to Marco Rubio and UK government officials.

Facebook’s early May takedown of a Russian political disinformation operation was much larger than previously thought, according to research published this weekend by the Atlantic Council’s Digital Forensic Research Lab.

The Russian-linked actors behind the campaign went well beyond just amplifying political narratives on Facebook, and in fact began much earlier by planting false stories and then later amplifying these fake stories using fake accounts.

In one case, these Russian-linked actors impersonated Sen. Marco Rubio’s Twitter account in a tweet that made it look like he was disparaging Britain’s Government Communications Headquarters.

Then-Defense Secretary of the UK Gavin Williams was also victim to a similar photoshop effort.

One of the false stories that the Russian trolls created and amplified through fake accounts includes a storyline that a Spanish intelligence agency rooted out an anti-Brexit pilot to assassinate Boris Johnson. Johnson is now in the running to serve as the UK’s next prime minister.

As many Russian-linked disinformation operations have attempted before, this campaign focused on sowing divisions in Western countries, However, the tactics were different in this instance. Beyond spreading the operation across more than 30 platforms, Russian actors used many different languages and practiced tight operational security to avoid getting caught.

Overall, the campaign spanned across 6 languages and dozens of fake accounts, and more than 30 platforms, including Medium, Reddit, change.org, Germany’s homment.com, and San Francisco’s indybay.org.

“This suggests a substantial operation with multiple language teams working simultaneously on content generation and translation,” the researchers write, who assess it is likely this was run by a Russian intelligence agency. Infamous Russian troll farm Internet Research Agency was run by the Russian military intelligence agency known as GRU.

The trolls are learning

Images of the spoofed Rubio tweet, which alleges GCHQ spied on President Donald Trump in 2016, were later shared by fake accounts created by the Russian-linked actors. In at least one instance, the fake tweet was amplified by an official government channel.

The way the fake accounts were created took advantage of the gaps on social media that allow users to purport to be someone they are not. Many of the fake accounts were often created and then used to post in the same day — and then never used again.

“The use of so many online forums indicates a key online vulnerability,” the researchers write. “The ease with which throwaway accounts can be created and used to post false content.”

Researchers note the rapid use and discarding of accounts was likely done to obfuscate the Russians’ activity, but also speaks to how the Russians are changing their tactics as researchers discover their previous disinformation campaigns.

“The devotion to OPSEC was remarkable and sets this apart from any other operation the DFRLab has encountered,” the researchers write.

But this tactic also marked the campaign’s death knell. The throwaway tactic made it all the more noticeable to the researchers because of how different their goals were (having a limited following to avoid detection) from how a normal user might typically think about social media (a platform on which to gain many followers).

Because of the throwaway strategy, the campaign’s reach, even using 30 platforms, was not very large. The Facebook accounts rarely had any reactions and some articles had under 100 views.

Just the beginning

A senior U.S. intelligence official told reporters Monday in a briefing on election security that Russia’s efforts to interfere in the 2020 elections have continued to use social media to incite divisive arguments among U.S. users

“Russia’s goal is to pit Americans against each another because they believe a divided America is consistent with their strategic interests,” the official said.

Discussing the disinformation operation, Rubio warned this is one example of what is to come in the upcoming election cycle.

“This is minor compared to what lies ahead for us,” he tweeted. “Now imagine if image was of a fake tweet from leader in a part of world with tensions running high. Or if it was a deep fake video that exacerbated bilateral tensions between two nations on the brink of war. Information warfare is a powerful weapon we should not take lightly.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure