top of page
CRC logo (2).png

Weekly Report: Cyber based hostile influence campaigns 11th - 17th August

  • Writer: CRC
    CRC
  • Aug 21
  • 7 min read

Updated: Aug 25

Weekly Media Update cover: child with helmet, light bulb on teal background. Text: Information Operations report, 11th-17th of August 2025

[Listen to the Podcast]
Podcast Weekly Review W33_2025

[Introduction]

During the 11th to the 17th of August, 2025, we observed, collected, and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events.


Russian backed influence operations dominated the cyber landscape this week, demonstrating a significant evolution in tactics and targeting. Kremlin-aligned groups are moving beyond simple propaganda, employing sophisticated methods like impersonating news organizations and fact-checkers, seeding large language models with state-approved narratives, and deploying AI-generated content to spoof legitimate media. These technical escalations are paired with a consistent strategy of exploiting and manufacturing societal divisions in target nations, particularly in Canada, where campaigns incited xenophobia against Indian and Ukrainian diasporas. Concurrently, the institutional decay in nations like Bulgaria created a permissive environment for Russian disinformation to flourish, turning domestic political chaos into a vector for broader European instability.



[Report Highlights]


[Weekly Review]


  1. The Kremlin ramps up projection tactics ahead of the Alaska conference 

A publication by EUvsDisinfo  details how In the run up to the conference in Alaska, Russia’s disinformation strategy relied heavily on projection, accusing others of the very aggression and bad faith it commits.

Moscow vehemently portrays itself as a key global power and peace seeker, yet this posture reflects its efforts to mask its severely weakened economy and frustrated military ambitions in Ukraine. The report details how Russia engages in bad faith negotiations while it continues its military assault, targeting civilian infrastructure and undermining Ukraine’s economy.

The analysis concludes that Russia’s informational strategy is a smokescreen designed to distract from its own violations and battlefield atrocities.


Source: EUvsDisinfo, 2025. Alaska and the illusion of strength. [online] Available at: https://euvsdisinfo.eu/alaska-and-the-illusion-of-strength/


  1. Matroyoshka's TTPs Against NewsGuard – a Meta Campaign

An article from NewsGuard details a Russian malign influence campaign, dubbed "Matroyoshka," that has begun directly impersonating NewsGuard to undermine its credibility. The campaign escalated after NewsGuard reported on its efforts to spread false claims about Moldova’s pro-Western government. In retaliation, Matroyoshka produced fabricated videos styled as NewsGuard reports, falsely alleging corruption within the organization. The campaign’s latest tactic involves a layered falsehood: a fake NewsGuard "rebuttal" video that purports to correct a previous fabricated claim, stating it received "only 100 million Euros" from Moldova. This meta-campaign aims to overwhelm fact-checkers and erode public trust in information arbiters.


Source: NewsGuard, McKenzie Sadeghi, 2025. Russian Campaign Targets NewsGuard — Again. [online] Available at: https://www.newsguardrealitycheck.com/p/russian-campaign-targets-newsguard


  1. Pravda Operation's LLM Seeding Targets Canadian Historical Narrative

An article by DisinfoWatch details a Russian smear campaign targeting Canada’s National Memorial to the Victims of Communism as part of a broader historical revisionism strategy. The effort, amplified by a Kremlin-linked influence group known as the "Pravda Operation," uses Telegram to link the memorial to an unrelated 2023 controversy in Canada's Parliament. This tactic aims to create domestic suspicion and discredit the monument. The analysis places the campaign in the context of Russia’s annual efforts to deflect from the anniversary of the 1939 Molotov-Ribbentrop Pact with Nazi Germany. A key goal of the Pravda Operation is to seed and manipulate Large Language Models (LLMs) with Kremlin-approved narratives, embedding propaganda into future AI technologies.


Source: DisinfoWatch, 2025. Canadian Memorial Targeted By Russian Pravda Operation. [online] Available at: https://disinfowatch.org/disinfo/canadian-memorial-targeted-by-russian-pravda-operation/


  1. Russian IO Deploys Xenophobic Tropes Against Canada's Indian Diaspora

A publication by DisinfoWatch reports that Kremlin-aligned propagandists are promoting racist disinformation to incite hatred against Canadians of Indian heritage. The campaign, amplified by outlets like Tsargrad.TV and the Pravda Network falsely claim that Hindus control all three major political parties in Canada. This assertion is demonstrably false, as census data shows Hindus comprise about 2.3% of the population and hold only 1.2% of parliamentary seats. The analysis highlights specific tactics, such as substituting the NDP party's name with the Russian term "Narodniks" to invoke extremism and conflating Hindu and Sikh identities to create confusion. This campaign mirrors previous Russian efforts that targeted Ukrainian Canadians, revealing a consistent strategy of weaponizing cultural tensions to stoke xenophobic fears and undermine Canada's multicultural society.


Source: DisinfoWatch, 2025. Kremlin Propagandists Promoting anti-Indian Hate in Canada. [online] Available at: https://disinfowatch.org/disinfo/kremlin-propagandists-promoting-anti-indian-hate-in-canada/



  1. Russian Group Spoofs News Outlets Using AI-Enhanced Disinformation

A POLITICO article reports that a pro-Russian propaganda group, tracked by Microsoft as Storm-1679, is intensifying its efforts to spread disinformation by spoofing reputable news organizations and leveraging artificial intelligence. The campaign produces fabricated content, particularly videos with AI-generated audio, that mimics the branding of outlets like the BBC, ABC News, and others. Storm-1679 strategically times its operations around high-profile news events, such as elections or diplomatic meetings, to maximize potential impact. While most of the group's content fails to gain traction, occasional successes, like a fake video amplified by high-profile American figures, validate its high-volume approach. This escalation of foreign influence operations comes as the U.S. administration is actively scaling back the federal agencies tasked with countering such threats.


Source: POLITICO, Dana Nickel, 2025. Russia is quietly churning out fake content posing as US news. [online] Available at: https://www.politico.com/news/2025/08/17/russia-us-news-media-disinformation-campaign-00512173?ICID=ref_fark&utm_content=link&utm_medium=website&utm_source=fark


  1. Razor-Thin Mandate in a Disinformation Crossfire

In an article from Institute for Strategic Dialogue (ISD), the 2025 Polish presidential election was heavily targeted by FIMI campaigns from Russia and Belarus pushing anti-EU, anti-Ukrainian, and anti-establishment narratives. Through Doppelganger, Operation Overload, the Pravda Network, and sanctioned Radio Belarus, alongside domestic nationalist actors, operators exploited platform gaps on X, Meta, and TikTok. Overall impact was limited by civil society mobilization and rapid-reaction networks, and no cyber incidents affected core voting. Yet the persistence of tactics since 2017 and 2021 signals an unchanged threat environment stoking divides over migration, Ukraine, and the economy. The piece urges a permanent Digital Services Coordinator, stricter DSA enforcement, and more media literacy and civil society capacity. With Karol Nawrocki winning by under one percentage point, even modest manipulation remains consequential in a polarized contest.


Source: FDEI for election integrity (FIMI‑ISAC), Alliance4Europe, Debunk.org, GLOBSEC, EU DisinfoLab, DFRLab, Institute for Strategic Dialogue (ISD), 2025. FDEI for election integrity (Jan 2025 – Jan 2027): polish election country report 2025. [online] Available at: https://fimi-isac.org/wp-content/uploads/2025/08/FDEI-POLISH-ELECTION-COUNTRY-REPORT-2025-2.pdf



  1. Disinformation as a Systemic Social Media Phenomenon

A new article in Sage Journals reframes disinformation not as isolated falsehoods but as a systemic phenomenon actively amplified by the architecture of social media. The analysis by Raquel Recuero argues that platforms confer "structural advantages" upon disinformation through algorithms and engagement-driven economic models, enabling it to outpace accurate information. This systemic view explains why simple content debunking is insufficient. Disinformation, often a mix of true and false elements, adapts and persists through a feedback loop involving platforms, actors, and audiences. The article concludes that effective analysis requires a shift from examining individual pieces of content to understanding the broader social and technical dynamics that constitute the entire communicative system.

 

Source: Sage Journals, Raquel Recuero, 2025. A systemic framework for disinformation on social media platforms. [online] Available at: https://journals.sagepub.com/doi/full/10.1177/29768624251367199


  1. Report Advocates Competing With, Not Countering, Extremist Narratives

In an article from ICCT, the authors argue that identity-based disinformation (IBD) is a primary accelerant of extremist mobilisation and communal violence, and that prevailing countermeasures underperform. They show how IBD exploits pre-existing biases and identity needs to polarise communities, citing Myanmar’s anti-Rohingya campaigns and the Great Replacement narrative, while noting the migration of content into closed channels and the “jailbreaking” of AI systems by far-right actors. Traditional counter-narratives rarely shift violent intent and can backfire when beliefs are identity-bound. As a remedy, the piece advances the Equal-Alternative Narrative (EAN) model, operationalised through Positive Identity Expansion, which provides prosocial, culturally authentic pathways that satisfy needs for belonging, status, and purpose without confronting ideology head-on. Examples include reframing Buddhist protection in Myanmar around compassion and virtue rather than violence. The Reclaiming Our Narratives toolkit from OICD translates this into practice, emphasising identity mapping, credible messengers, narrative literacy alongside media literacy, and needs-based interventions aligned with initiatives such as the UK’s Healthy Identity Intervention.

 

Source: ICCT, Anna Kruglova and Bruce White, Countering identity-based disinformation through positive narrative expansion. [online] Available at: https://icct.nl/publication/countering-identity-based-disinformation-through-positive-narrative-expansion


  1. Bulgaria's Institutional Decay Enables EU-Wide Disinformation Threat

With seven national elections in just three years, Bulgaria's political chaos has created an institutional vacuum where disinformation now metastasizes. A BalkanInsight article explains how this environment has made Bulgarian citizens the most vulnerable in Europe to false narratives and has allowed the country to become a backdoor for Russian influence into the EU. The analysis points to a captured state broadcaster, the suspension of a national anti-disinformation coalition, and the weaponization of social media by politically connected networks. These internal failures have enabled large-scale, Russian-funded campaigns targeting elections and sowing discord over the adoption of the euro. The authors warn that unless the EU prioritizes the enforcement of existing standards, new laws will fail to address the root cause of the problem: the collapse of institutional credibility.


Source: BalkanInsight, Alexandra Karppi and Vanesa Valcheva, 2025. In Dysfunctional Bulgaria, Disinformation Thrives and Spills Over into EU. [online] Available at: https://balkaninsight.com/2025/08/12/in-dysfunctional-bulgaria-disinformation-thrives-and-spills-over-into-eu/


[Takeaways]

The core implication of the observed activities is that the modern information battlefield is no longer about the message, but the system that delivers it. Malign actors are successfully targeting the foundational elements of public trust: fact checking bodies, news media, and the integrity of AI-driven information technologies. The impersonation of NewsGuard and the deliberate seeding of LLMs represent a strategic effort to corrupt the very tools societies use to discern truth. Consequently, defensive strategies must evolve from content debunking to securing the information ecosystem itself, focusing on platform architecture, AI integrity, and the psychological resilience of populations.


[Download Report]


 
 
bottom of page