Anti-NATO disinformation effort uses coronavirus to poke political tensions
A propaganda campaign is using the coronavirus pandemic to inflame anxieties about NATO troops throughout Eastern Europe, security researchers have determined.
The group, dubbed Ghostwriter, has been focused on amplifying anti-Western narratives in Poland, Latvia and Lithuania since 2017. Operatives have planted fabricated diplomatic documents, tried spreading the false narrative that Canadian soldiers had been spreading COVID-19 through Latvia and leveraged news sites to spread articles that appear to be legitimate, according to a report the security firm FireEye published Tuesday.
While researchers have not attributed the effort to the Russian government, the findings are the latest addition to a growing consensus that pro-Kremlin entities are seizing on COVID-19 to inflame existing political divisions. Russia’s military intelligence agency, the GRU, is using three websites to try to spread disinformation about the U.S. response to the virus, U.S. officials told the Associated Press.
“We believe the assets and operations…are for the first time being collectively tied together and assessed to comprise part of a larger, concerted, and ongoing influence campaign,” the FireEye report noted.
In one case, Ghostwriter personas tried disseminating a fabricated letter that appeared to be written by Jens Stoltenberg, Secretary General of the North Atlantic Treaty Organization, suggesting that Lithuania intended to leave the alliance amid the coronavirus pandemic. They also falsified quotes, apparently taken from an interview with the commanding general of the U.S. Army in Europe, complaining about the state of the Polish and Baltic militaties.
In another case, Ghostwriter personnel authored a letter seemingly from the commander of the Polish War Studies Academy that urged Polish soldiers to rebel against American “occupation forces” stationed there. Polish officials denounced that letter at the time, citing it as an information operation aimed at undercutting relations with the U.S.
The campaign relied on at least 14 inauthentic web personas that have been involved in 15 operations dating back three years. Often, the accounts claim to be journalists, editors or citizens in the targeted countries in an apparent attempt to assume some credibility on the issues they discuss. Some of those accounts then support the work of their counterparts, trying to build engagement and the number of views on a given post.
The tactics closely resemble the work of Operation Secondary Infektion, a suspected Russian effort that’s used more than 300 websites to spread Kremlin talking points on regional blogging websites. John Hultquist, who tracks cyber-espionage at FireEye, cautioned that researchers have not found a link between Ghostwriter and Secondary Infektion.
