Strategies to Counter Russian Influence Networks

𝗧𝗵𝗲 𝗯𝗲𝘀𝘁 𝗰𝗼𝘂𝗻𝘁𝗲𝗿𝗺𝗲𝗮𝘀𝘂𝗿𝗲𝘀 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗥𝘂𝘀𝘀𝗶𝗮𝗻 𝗶𝗻𝗳𝗹𝘂𝗲𝗻𝗰𝗲 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻𝘀 𝗶𝗻𝘃𝗼𝗹𝘃𝗲 𝗱𝗶𝘀𝗺𝗮𝗻𝘁𝗹𝗶𝗻𝗴 𝘁𝗵𝗲 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲, 𝗱𝗶𝗿𝗲𝗰𝘁𝗹𝘆 𝘁𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗼𝗽𝗲𝗿𝗮𝘁𝗼𝗿𝘀, 𝗮𝗻𝗱 𝗿𝗲𝘃𝗲𝗮𝗹𝗶𝗻𝗴 𝘁𝗵𝗲 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝘄𝗼𝗿𝗸𝗶𝗻𝗴𝘀, 𝗳𝘂𝗻𝗱𝗶𝗻𝗴 𝘀𝗼𝘂𝗿𝗰𝗲𝘀, 𝗮𝗻𝗱 𝘁𝗿𝗮𝗱𝗲𝗰𝗿𝗮𝗳𝘁 𝗼𝗳 𝘁𝗵𝗲 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻𝘀. This Foreign Affairs Magazine article, 𝘛𝘩𝘦 𝘓𝘪𝘦𝘴 𝘙𝘶𝘴𝘴𝘪𝘢 𝘛𝘦𝘭𝘭𝘴 𝘐𝘵𝘴𝘦𝘭𝘧, by Thomas Rid provides an interesting perspective on Russia's influence operation network "Doppelganger" and the Social Design Agency (SDA), which is behind the campaign's 700 fake websites and phony social media accounts. Recent leaks of over 3,000 internal documents from SDA have provided unprecedented insight into the planning, operations, and objectives behind Russian disinformation efforts. These documents include project plans, budgets, key performance indicators, daily targets, and even communications between SDA operatives and Kremlin officials, offering a rare and detailed look into how such campaigns are structured and evaluated. 𝗔𝗺𝗽𝗹𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗧𝗵𝗿𝗼𝘂𝗴𝗵 𝗪𝗲𝘀𝘁𝗲𝗿𝗻 𝗠𝗲𝗱𝗶𝗮: Ironically, one of the biggest boosts to the Doppelganger campaign came from Western media coverage, which made it seem more successful than it was. SDA used this exposure to secure further funding and mislead Russian authorities about the campaign’s real effectiveness. 𝗗𝗲𝗰𝗲𝗽𝘁𝗶𝗼𝗻 𝗪𝗶𝘁𝗵𝗶𝗻:  The SDA not only misled its targets but also its own leadership. By exaggerating its impact, SDA convinced Russian officials that their efforts were more effective than they were, creating a cycle of self-deception. 𝗖𝗼𝗹𝗱 𝗪𝗮𝗿 𝗧𝗮𝗰𝘁𝗶𝗰𝘀 𝗶𝗻 𝗮 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗔𝗴𝗲:  While the core tactics—like fake documents and false identities—are familiar from the Soviet era, SDA also employs modern digital tools like social media manipulation, fabricated communications, and augmented reality to amplify its efforts. 𝗖𝗼𝘂𝗻𝘁𝗲𝗿𝗶𝗻𝗴 𝗗𝗶𝘀𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻:  The article highlights the importance of careful strategies when countering disinformation. While exposing these efforts is necessary, overly sensational media coverage can sometimes play into the hands of disinformation operators by amplifying their message. The best countermeasures involve dismantling the infrastructure behind these campaigns, directly targeting the operators, and most importantly, focusing on upstream exposure—revealing the inner workings, tradecraft, and funders behind these operations to weaken them from the core. Full article: https://lnkd.in/df-xZ2KG A sample of the leaked documents from the US DOJ: https://lnkd.in/dzKeaAb3

The Cyber Intelligence Institute’s study on “Russische Agenten und Spione” by Christopher N. is a reminder that Moscow still invests heavily in old-school HUMINT, even as it hypes AI and bot farms. Had to run this through a translator, but absolutely worth it. What feels new is the rise of “Wegwerf-Agenten”—online-recruited, single-use operatives who perform one act of sabotage or courier work and are then written off by their handlers. They cost little, sow uncertainty, and—because first contact often happens in Telegram—fit neatly into Russia’s broader hybrid playbook. The paper’s recommendations are straightforward but worth repeating: 1. Add agent activity to risk assessments, not just cyber exploits. 2. Run periodic counter-surveillance and awareness training for employees, contractors, and facility guards. 3. Tighten physical and digital access points—supply chains included. 4. Establish rapid channels with law enforcement and intel services so anomalies get shared early. 5. Use behavioural OSINT indicators (travel patterns, synchronized payments, repeat burner accounts) to flag coordination before an operation matures. Two takeaways stick with me: ~Behaviour beats content. The same principle we discussed after the NATO STRATCOM Dialogue applies here: whether it’s a botnet or a lone courier, patterns of coordination are easier to spot—and harder for an adversary to mask—than any single post or act. ~Hybrid means human + digital. Russia’s services still rely on diplomats, illegals, and couriers alongside their troll farms; strengths include political cover and psychological savvy, weaknesses include digital sloppiness that good OSINT can expose. For organisations focused on narrative defence alone, this is a prompt to widen the lens. A coordinated influence campaign can start with a Telegram DM and end with a cafe meeting—and one café meeting can open as many doors as a malware implant. #InfoOps #HUMINT #OSINT #HybridThreats #CognitiveSecurity #PSYOP #STRATCOM #DefTech #VannevarLabs #defenseTech

🇪🇺Operarional recommendations from chapter 6 on hybrid threats from EU Institute for Security Studies Chaillot Paper 186: 🇷🇺 Exploit the vulnerabilities of Russia’s strategy : 🔹Russia tailors its messaging to local contexts, but at the expense of overall coherence. 🔹Exploit Russia’s self-image and quest for status: expose contradictions in Russian rhetoric versus reality — using satire and incisive mockery to erode credibility. 🔹un-power by reducing Russia’s capacity to exploit informational vulnerabilities across Europe. ⚔️ Counter these Russian narratives: • Russia as a legitimate alternative to the liberal international order, fighting a hypocritical “collective West” • faltering European unity & internal divisions • cultural, religious, and historical affinities (esp in the Western Balkans) justify support to Moscow & use of local proxies 🧱 Fix European vulnerabilities 🔹our information environment made of fragmented media, technological disruption, psychological susceptibility to emotive, belief-based narratives. 🔹resist shift into a “post-truth” space, where audiences accept narratives based on beliefs and emotions rather than facts. 🔹build cohesion & shared approach to information resilience 👣 Strategic Recommendations: 🔹Expose and Degrade Russian Narratives • Use Russia’s own rhetoric and imagery to highlight contradictions and discredit its moral posture. • Apply satire, humour and creative storytelling to reach broader audiences and undermine authoritarian seriousness. 🔹Enable Deterrence in the Information Space • Ensure hostile influence operations face visible consequences, through attribution, exposure, and, where possible, sanctions or counter-measures. • Publicly naming Russian information operations can degrade credibility and deter future ones. 🔹Tailor Messaging and Engagement • Mirror Russia’s localised approach: adapt EU communication to local cultures, grievances & vulnerabilities. • Build joint EU–Member State–partner frameworks for both rapid reactive messaging and proactive influence campaigns. • Promote positive narratives highlighting democratic resilience, transparency, and EU values — not only debunking lies, but shaping the discourse. 🔹Integrate Information into the Wider Strategy • Treat the information dimension as integral to the resilience–deterrence–un-powering triad. • Move beyond passive defence: actively shape the information ecosystem to limit Russia’s capacity to manipulate it. • Extend analysis and tailored responses to key regions identified in the report — Europe, the Balkans, the Mediterranean, and Sub-Saharan Africa.

GLOBSEC's "Global Offensive: Mapping the Sources Behind the Pravda Network" report reveals a sophisticated, expanding disinformation ecosystem spreading pro-Kremlin narratives, adding a necessary layer to the previous research on the topic. Comprising over 87 localized subdomains, it functions as a continuous propaganda machine, primarily manipulating AI and language models by flooding digital spaces with content. The study analyzed over 4.3 million articles from 8,000+ sources. Telegram is the main distribution channel (up to 75% of content), with channels boasting 250 million subscribers. Russian websites, including state media like TASS and RT, contribute nearly 20%. Facebook is also utilized. Article output sharply increased in 2023-2024, prioritizing quantity over quality (85% published in under a minute). Serbia, the US, Ukraine, Moldova, and Italy are key targets, alongside the CEE region and Africa. Network analysis shows interconnected sources, with distinct local Telegram clusters. Examples from Czechia, Slovakia, Hungary, and Poland highlight local channels (e.g., RuskiStatek, UKR LEAKS_pl) spreading pro-Russian and anti-Ukrainian propaganda. ⭕ Recommendations include enhanced monitoring, interdisciplinary research, AI data manipulation prevention frameworks, and sanctioning those responsible for disinformation. The report notes blocking domains won't stop the network, as it recycles content from existing pro-Kremlin sources. 🔗 For more details: https://lnkd.in/dSPhV_8e