How Kremlin bots spread false articles about US, Kyiv and UK responsibility

(To Renato Caputo)
25/03/24

The distribution network of fake news of the Kremlin has started sending pseudo-journalistic articles about who is behind the terrorist attack on the Crocus town hall. In these materials, the reader is informed that the United States, Ukraine, the British intelligence agency Mi-6 and the collective West as a whole are to blame. And US information that ISIS is responsible is false.

The distribution scheme of the materials allows us to come to the conclusion that the same bot network is behind this disinformation campaign Doppelgänger, also called RRN. This is demonstrated by the fact that, firstly, the same fake “media” sites as in previous attacks are promoted: spiegel.ltd, grenzezank.com, hauynescherben.net, meisterurian.io, onnam.life and many others.

As before, the same scheme as “two-level bots” is used: some publish content independently, others massively retweet on Twitter (X) in comments on other people's posts with a completely unrelated topic. For example, under a post about a football match. Likewise, a system of intermediate redirects is used, limited by the user's geolocation.

According to Meta, IT companies are behind the spam attack National Technologies , Social Design Agency (ASP), which are under European sanctions. The ultimate owner of National Technologies LLC è Rostec. The bots also promoted the website EuroBRICS, which demonstrated links to the special services center (military unit 54777) of the GRU (Russia's military intelligence service). Previously, the European Union introduced a package of sanctions against participants in the digital information manipulation campaign, this package included the aforementioned “National Technologies”, TSA, as well as several officers of the same military unit 54777 of the GRU.

These materials are distributed in English, German, Arabic, Spanish, Italian, Polish, French and Hebrew. As he observes Bot Blockers, this network uses several languages ​​for the first time: apparently, the spread of Kremlin propaganda is increasingly expanding to Western audiences.

What and how bots spread

A clone of the German publication Der Spiegel published an article titled “Legalized terrorism. The terrorist attack in Russia raises the question of Ukraine's cooperation with Islamic terrorist groups” (following image).

But the network spreads Kremlin narratives not only through clones of famous media. Doppelgänger it also has its own websites that look like regular news publications. In particular, the Il Correspondente portal, published in Italian. On this site, the article about the latest terrorist attack entitled “Terrorism Returns to Moscow” states that “The Kyiv regime is directly responsible for the Crocus massacre. Ukraine has become a global center for the recruitment and training of terrorist cells by the United States and Great Britain.”

In another material, again on the same portal, the “author” concludes that the United States and Ukraine are behind the terrorist attack, since “the terrorists behaved like trained soldiers and used military tactics typical of mercenaries”, and after the shooting they headed towards Ukraine. In this work of disinformation, Russian network sites also published material alleging that the West was deliberately spreading “fake news” that ISIS was behind the attack: “The most surprising thing is the West's reaction to what is happening. Without expressing grief, the British authorities announced almost immediately after the terrorist attack that Ukraine was not involved in the Crocus massacre. Kyiv, in turn, began to actively spread information about the involvement of ISIS militants in the explosions and executions of civilians, without providing any evidence. The New York Times published a false statement by Islamic State terrorists in which they claimed to be the masterminds of the attack, but used a model that the Islamic State had not used for several years.".

On the same night (March 23 to 24), when the narrative of the West being guilty of the terrorist attack was spread in several languages, a bot network also distributed materials to the Ukrainian public with another fake news, which called for street protests aimed at demanding the rotation/demobilization of the Ukrainian armed forces. Through social networks, Ukrainians are told to take to the streets to demonstrate (following image).

What the network Doppelgänger has distributed previously

The network Doppelgänger regularly activates the "emitter", most often this is associated with the war in Ukraine: for example, a bot network sent fake quotes from Beyoncé, Oprah, Ronaldo and others with indignant requests to stop aid to Kiev.

Previously, with exactly the same concerned comments, bots had mass-posted photographs of buildings in France on which the Stars of David were painted: they are painted on Jewish homes as a warning about pogroms. The Insider, citing data from the project Bot Blockers, wrote that the same accounts are distributing pro-Russian publications, which indicates that the same bot network distributed the photo.

Furthermore, under the guise of “deep concern”, hundreds of robots Doppelgänger have released a video, allegedly from the Turkish nationalist organization “Grey Wolves”, in which terrorists threaten to repeat the attack on Jews at the 2024 Olympics in Paris that occurred in 1972. Munich Olympics. 17 people subsequently died, including 11 members of the Israeli team.

After the results of the presidential elections, the network Doppelgänger launched an information campaign, which was probably supposed to create an image of the legitimacy of the presidential elections held in Russia, the Agency wrote with reference to the analysis of Bot Blockers. The tweets, written in English, French, German and Ukrainian, promoted three talking points related to the Russian election. The first is that competitive elections were held in Russia, in which many Russians who really support Vladimir Putin participated, and Russia itself has long-standing democratic traditions. The other two are linked to Ukraine. The first is that the Ukrainian authorities made a mistake by canceling the elections, and the second is that Ukraine should not “cancel” everything Russian, including Russian culture.

Photo: X