let's stop Russian fakes

Russia has launched a cyber attack on dozens of Italian companies and government agencies

The hackers targeted, in particular, Intesa Sanpaolo, Banca Monte dei Paschi, Iccrea Banca, Milan Linate and Malpensa airports, as well as the ports of Taranto and Trieste, Reuters reports: https://www.reuters.com/world/europe/alleged-pro-russian-hackers-hit-20-italian-websites-cybersecurity-agency-says-2025-02-17/ 

In addition, the websites of several ministries, carabinieri, financial police and some transport companies were attacked, ANSA reports.
The Italian National Cybersecurity Agency claims that the pro-russian hacker group NoName057(16) is behind the series of attacks. These cyberattacks did not affect the operation of companies.
Cybersecurity officials linked the attack to a statement by Italian President Sergio Mattarella, who compared modern russia to the Third Reich because of its war of aggression against Ukraine.

russia has created a new spy unit for sabotage in europe

The new unit, known to Western intelligence agencies as the Special Tasks Department (SSD), is based at the russian military intelligence headquarters on the outskirts of moscow, The Wall Street Journal reports: https://www.wsj.com/world/europe/russia-spy-covert-attacks-8199e376

According to Western intelligence services, it was created in 2023 in response to Western support for Ukraine. "russia believes that it is in conflict with what it calls the ‘collective West’ and is acting accordingly, including threatening us with nuclear weapons and increasing its army", James Appathurai, NATO's Deputy Assistant Secretary General for Hybrid Warfare, told the newspaper.

Sandworm hackers from RF target organisations in the US and EU

They use several methods to compromise victims' online infrastructure and gain access to critical sectors, Microsoft analysts say: https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/

These include energy, oil and gas, telecommunications, shipping, weapons production, and international government projects. According to analysts, russian cybercriminals initially focused on attacks on Ukraine's infrastructure, but in 2023, the BadPilot campaign, a subgroup of Sandworm, achieved permanent access to ‘numerous’ high-value sectors in the US, EU, Central Asia, and the Middle East.

How DeepSeek spreads disinformation in favour of China

The threats posed by the Chinese AI assistant DeepSeek are so obvious that the chatbot is being banned in different countries. In Italy, the national regulator did this to protect user data. Due to security risks, the chatbot is also prohibited for government agencies in Taiwan. Employees of the Congress, the Pentagon, and the US Navy have been banned from using it. Australia's largest cybersecurity company urged critical organisations to stop using DeepSeek. The UK and Irish authorities are also checking it for security risks.In addition to problems with the security of personal information, DeepSeek has already been caught in Chinese propaganda.

The researchers tested the chatbot's capabilities and found that its answers not only reflect Beijing's view of certain events in the world, but also directly spread disinformation. For example, DeepSeek distorted the words of former US President Jimmy Carter, who allegedly agreed that Taiwan was part of China. This was one of several examples documented by NewsGuard, a company that monitors disinformation on the Internet.

NewsGuard has called DeepSeek a ‘disinformation machine’.South Korea's National Intelligence Service (NIS) has accused the DeepSeek of excessive collection of personal data and using all incoming queries for its own training. Unlike other services with generative AI, DeepSeek's chat history can be shared with other parties, as the app has a function to collect keyboard input patterns, which allows it to identify users and connect with servers of Chinese companies such as volceapplog.com.Obviously, artificial intelligence is becoming a key tool in the spread of disinformation, regardless of who creates it. And we, as conscious citizens, should take this into account when we draw new knowledge from the neural network.

International Reporters gathers Kremlin propagandists from different continents 

On a moscow-funded platform, a dozen pseudo-journalists from eight different countries are promoting russia's occupation of Ukraine, military ‘successes’ and praising russia's foreign policy, Reporters Without Borders (RSF) said. Among them:- Adrien Bocquet - a Frenchman living in russia who spreads disinformation about the war in Ukraine in the French media;- Andrea Lucidi, a pro-kremlin Italian who demonstrated the russian invasion symbol ‘z’ and was granted ‘asylum’ in russia;- Vanessa Beeley, a British woman who collaborated with russian propagandist RT and supported former Syrian dictator Assad.

RSF also found that in the first nine months of 2024, International Reporters received more than €27,000 from the sanctioned russian organisation Dialogue Regions, as well as direct funding from the russian Ministry of Digitalisation.In addition to the above-mentioned pseudo-journalists, RSF focuses on the co-founders of the resource - victoria smorodina and Christel Neant.

viktoriya smorodina is the editor-in-chief of the International Reporters website and also runs the russian LLC Laboratory of Attention, established in October 2023, whose main activity is to finance this platform.Néan is originally from France, moved from Belgium to occupied Donetsk in 2016, and later became a russian citizen. She created the French-language propaganda website donbass insider. She is currently filming interviews and stories with local residents of the occupied cities in eastern Ukraine.In addition, according to RSF, the kremlin news agency is currently expanding its network in Africa. In 2024, it signed a cooperation agreement with the Cameroonian media group For You Media, headed by politician Serge Matomba.

Russia is deceiving foreigners into assembling drones to kill Ukrainians

The russians have launched an advertising campaign offering employment to citizens of Azerbaijan, Kazakhstan, Armenia and other countries in the alabuga economic zone. They promise career growth, high salaries and interesting work. In reality, workers are involved in the assembly of Iranian military drones Shahed-136. People sign contracts, and when they find out what kind of work is actually offered, they try to refuse.

But those who refuse are intimidated and blackmailed. Some are subjected to physical violence. There are also cases where people's documents are taken away.

Mostly young people (under the age of 22) looking for a promising job are recruited for this work. More information about the scheme can be found in an investigation by the Azerbaijani TV channel Baku TV.But the geography of the search for ‘talent’ is actually much wider. The Russians also invite Latin Americans and even women from Africa to assemble weapons for murder. There is a story about this on The African Report: https://www.theafricareport.com/364458/how-russia-recruits-african-women-for-its-war-effort/

Russia has stepped up its disinformation campaign against Switzerland

After the full-scale invasion of Ukraine, russians began to actively promote narratives aimed at undermining confidence in Switzerland's neutrality and discrediting it as an international mediator, the Swiss portal SWI writes (https://www.swissinfo.ch/eng/foreign-affairs/how-switzerland-is-caught-up-in-russias-propaganda-machine/88785511). Most often, russians criticise Switzerland for supporting Ukraine, accepting refugees and hosting a peace summit in June 2024. 

In 2024, the russian TV channel "rt" increased its news coverage of Switzerland 10-fold by launching special sections, including ‘The End of Neutrality?’. And the hacker group NoName05716 attacked the websites of the municipalities of Geneva and Vevey and banks in the cantons of Vaud and Zurich.

How does disinformation penetrate Switzerland?- The kremlin's propaganda seeps into Switzerland via France and Germany with the help of Anti-Spiegel and Réseau International, which are often cited by pro-russian Swiss resources such as weltwoche.ch, uncutnews.ch, conversion-news.org;- russians use Telegram, YouTube, TikTok, X, proxy media or fake websites imitating the original ones to spread lies and manipulations;- russian ‘online troll farms’ engage people to create millions of comments or offensive posts on social media to foment conflict or influence public opinion.

Russia interferes in German elections: Storm-1516 cyber group exposed

The cyber group is linked to the bot farms of the Prigogine and russia's Main Intelligence Directorate. So far, the criminals have created more than 100 fake news sites imitating legitimate media, investigators from the German publication Correctiv have found. They use artificial intelligence and diplomatic fake news technologies to spread disinformation about politicians and socially sensitive topics. For example, that ‘German Vice Chancellor Robert Habeck abused a young woman’ and ‘the head of the Bundestag Defence Committee, Markus Faber, is a russian agent’.

Fake news and videos are spread through a network of pro-russian influencers on Telegram, X and other platforms. In addition, in January, the Bluesky platform recorded the activation of 100 German-language accounts associated with Doppelgänger. They spread narratives discrediting Ukraine and the German coalition. According to CeMAS analysts, fake posts blame the Green Party for economic problems and criticise Chancellor Olaf Scholz for supporting Ukraine.

At the same time, hundreds of German-language posts that have appeared over the past month have expressed only affection and support for the far-right AfD party.The posts monitored by CeMAS contained links to fake German news sites or to articles on real sites that confirm their narrative, or simply images. These posts demonstrate typical examples of the russian Doppelgaenger disinformation campaign model.The goal of the campaign:- discrediting German politicians;- influence the outcome of the Bundestag elections;- creating chaos in the information field.More details here.

The trend of official organisations abandoning their accounts on social network X

The City Hall of Paris announced that it was closing its account on X. The farewell post says that the account will be closed as of 20 January, as social media platform X ‘reduces the reach of factual and objective messages, fuelling hate speech and disinformation’. Instead, the city authorities of the French capital announced the transition to the Bluesky social network.

Earlier, on 15 January, the German Ministry of Defence announced its decision to leave the social network X. A few days earlier, the Belgian newspaper De Morgen left Elon Musk's platform. This was announced by the newspaper's editor-in-chief Remy Amcreutz:

"Our publication does not want to be part of a social network where conspiracy theories and racism are spread without any moderation. That's enough. Elon Musk's values are completely opposite to those of a democratic society and De Morgen".
In addition, more than 80 French NGOs have been leaving social network X since 20 January. In an open letter, the signatories note that ‘the lack of moderation and the configuration of algorithms contribute to the spread of hateful content, the spread of conspiracy theories and theories that deny climate change’.

Russian hackers launch first phishing campaign on WhatsApp

The launch of the campaign through this platform indicates a change in the tactics, methods and procedures of cybercriminals who are trying to avoid detection in this way, Microsoft said in a blog post.The mechanics of phishing are as follows: the attackers initiate electronic communication with the targeted organisations [organisations that support Ukraine in the full-scale war with russia] to attract their attention.

Next, an email with a malicious link is sent from an address purportedly belonging to a US government official.
The email contains a QR code that allegedly directs users to a WhatsApp group with information about ‘the latest non-governmental initiatives to support Ukrainian NGOs’.
After scanning the QR code, which is actually used by WhatsApp to connect the account, the attackers access the messages using existing browser plugins that are designed to export messages from the account to the WhatsApp web version.

The Kremlin's Doppelganger project continues to operate

Between 28 December 2024 and 5 January 2025 alone, Alliance4Europe analysts identified 288 tweets belonging to the russian Doppelganger project. During this period, information criminals spread 24 fake articles in French, German, Ukrainian and Hebrew.According to Alliance4Europe's report, all but one of the articles contain a link to a russian IP address linked to a British legal entity.

It belongs to a citizen of Ukraine. Analysts note that this requires a more detailed investigation.
The information about the incident was shared with the administration of Platform X, reputable media and European governments. However, it can already be stated that despite repeated warnings and instructions on how to track such activities, the Doppelganger operation continues to operate on Elon Musk's platform.
Read more about the Doppelganger international disinformation project here: https://euvsdisinfo.eu/?s=Doppelganger

The Kremlin is trying to influence the upcoming presidential election in Poland

The task of the influence group, which was prepared by russia's Main Intelligence Directorate, is to spread fakes and organise bot farms. This group has already been exposed by Polish intelligence services. This was reported by the head of the Ministry of Digitalisation Krzysztof Gawkowski.

russian intelligence services are using specialised platforms on the darknet to look for Poles willing to spread disinformation for a reward of 3-4 thousand euros.

These attempts have been noticed since the beginning of 2025.He explained that it is about spreading disinformation and recruiting people to create content to destroy the cohesion of the political scene in Poland. "Russia is waging a cyber war with Poland, not a cold war, but a warm one. We are the most attacked country in the European Union", Gawkowski added. The first round of the presidential election in Poland is scheduled for 18 May.

Europe launches large-scale campaign to block pro-Kremlin Telegram channels

The restrictions apply to media outlets such as "ria novosti", "izvestia" and "rossiyskaya gazeta, as well as federal TV channels: "russia 1", "channel one", "ntv" and "russia today". However, an analysis by Insight News Media has revealed dozens of other russian propaganda channels on Telegram that are not affiliated with official russian media.

These channels continue to operate and spread russian disinformation in different languages.

Content analysis has revealed a wide network of channels spreading kremlin disinformation in English. Among them are specially created pro-russian English-language channels targeting audiences in the EU and the US. The russians use a similar approach to other foreign audiences, including France, Italy, Spain, Germany, Austria and Switzerland. In addition, analysts note the active work of the russian Embassy in Bolivia on the Telegram platform. Please pay attention to the information channels on Telegram.

Chinese government-linked hackers launch cyberattack on the US Treasury Department

So, China is beginning to use russia's methods against its opponents. So far, there is no confirmation of cooperation between the kremlin and Chinese intelligence services in this area, but it is only a matter of time. The targets of the attackers were the Office of Economic Sanctions, the Office of Foreign Assets Control (OFAC) and the Office of the Secretary of the Treasury.

According to the Washington Post (https://www.washingtonpost.com/national-security/2025/01/01/treasury-hack-china/), Chinese companies are of the greatest interest to China, against which Washington may impose restrictions. In addition, this cyberattack demonstrates China's desire to obtain intelligence on its main competitor in the struggle for global power and influence. It is noted that the documents accessed by the hackers were not classified, and the extent of the damage caused by the cyber intervention is currently being assessed by experts.

Why the Russian Orthodox Church is considered a covert spy network around the world?

What has long been obvious to the Ukrainian public about the nature of the russian Orthodox Church (ROC) is gradually becoming clear to the European establishment. The ROC is used not only as an instrument of soft power, but also as a real spy network.The OSINT agency Molfar has conducted a study from open sources, analysing 11 European countries. In the first part, we talk about 5 of them - Sweden, Norway, Finland, the Netherlands and the Czech Republic.

One of the examples is a russian church in Västerås, Sweden, which is suspiciously close to numerous strategic facilities. A few kilometres from the church, there is a plant for the production of nuclear fuel cells - Westinghouse Electric.

The distance between them is only 4.22 kilometres. Another strategic facility, the Västerås flygplats airport, is even closer, almost 500 metres away. A combined heat and power plant and the headquarters of the energy supplier Mälarenergi AB are located 6 kilometres from the church. And almost 5 kilometres away is the ABB Metallurgy metallurgical plant. Until 2024, the rector of the church served as CEO of NC Nordic Control AB, a Swedish company owned by russian developer pavel gerasimov (Gerda group). gerasimov owns a large number of church projects in Sweden, while he is also involved in a drug trafficking case.We recommend that you read the full study here.

Oleg Yasinsky designer of the Russian disinformation network in Latin America

Infobae has published an investigation into how the Telesur correspondent and RT columnist has set up a structure with local collaborators who replicate narratives in favour of moscow and against the West to Spanish audiences. With his clear Spanish and smiling face, Yasinsky sends each of his reports to Telesur, Chavismo's network in Latin America. In the russian media, he is presented as a ‘Ukrainian-Chilean’.Oleg Yasinsky is the head of the disinformation network that the kremlin is building in Latin America. The ‘Yasinsky Network’ has started to operate mainly in Chile, Venezuela, Bolivia and Argentina, where Yasinsky has more contacts.  Yasinsky is the main regional link in a much broader chain of disinformation with a global reach. It is part of a mega-structure in the russian capital that has three command centres: The Social Design Agency (SDA), the Internet Development Institute and Structura National Technologies.

These corporations are under sanctions from the European Union and the United Kingdom.Yasinsky managed to create his own network of small media outlets and collaborators (‘loyal contacts’) in Latin America. Among the media outlets that give the greatest impetus to his instructions is the long list available to Infobae: Presssenza, El Ciudadano, Summary Latinoamericano, Desinformemonos, Telesur, Estrategia, Barão de Itararé, Peoples Dispatch, Clacpi, Dialogues do Sul, Liberación, In Pirqa, Colombia Informa, La Pluma, VeritasPress, Critical Sociology, Globatium, Malaga al Día and Luis Emilio Recabarren. 

What does the russian agent ask of the editors and journalists of these media?- To create a public opinion in Latin America that Ukraine and the Ukrainian people are not as they are portrayed by the Western media, and that not all Ukrainians support the (Volodymyr) Zelenskiy regime and NATO;- To convey to Ukraine and the countries of the former Soviet Union that the voices of Latin Americans, Europeans and Ukrainians living abroad support a ‘brotherly’ people, a peaceful and friendly Russia/Ukraine.’In addition to publishing in local media, Yasinsky is also trying to create NGOs in different countries in support of the ‘other Ukraine’. Infobae's sources add that the processes are being managed from Chile, where Yasinsky usually spends a lot of time and the country where he has the most contacts (as well as a passport of that country). Read more about the investigation here.

russia intensifies blackmail, sabotage, cyberattacks in the eu

russia's subversive activities in the West have become systematic. In the last year alone, russians have stepped up their subversive activities in Europe, from cyberattacks to assassinations, with the obvious aim of creating chaos and an atmosphere of fear. In March, perpetrators hired by russian military intelligence set fire to warehouses belonging to Ukraine in Leyton, east London. moscow has also been accused of a series of arson attacks across Europe, from Polish shopping centres to a German factory. 

And as British cabinet minister Pat McFadden recently warned, russia has expanded its cyberattack campaign. For example, the attacks on Czech railways this year or the regular waves of false bomb threats. Such sabotage and campaigns of cyber and proxy attacks are aimed at dividing and demoralising Europeans, as well as trying to convey to Europeans the sense that continued support for Ukraine is having a negative impact on their lives and security. But the issue is not Ukraine, it is the fact that the kremlin wants to continue its criminal activities with impunity.

Romanian intelligence has data on Russian interference in the presidential election

Documents on interference in the presidential election are released in Romania. Intelligence suggests that the kremlin is behind the crime, but local analysts point to the contrary.During the election campaign, identical messages were actively spread on social media and influencers were involved. The operation itself was carried out from ‘external locations’ to circumvent restrictions.

According to the BBC, this is stated in the investigation documents released by Romanian President Klaus Iohannis.
Intelligence officers also found that one TikTok account paid $381,000 to users who campaigned for a pro-russian candidate in just one month, starting on 24 October. In addition, data for accessing election websites were stolen from genuine users and published ‘on the platforms of cybercriminals originating from russia.

Viktor Orbán continues to manipulate the issue of Russian energy carriers

Hungarian Prime Minister Viktor Orban has called for a review of the European Union's sanctions against russia over energy prices. Similar calls from a number of European politicians at various levels are regularly published by the russian media.In this way, kremlin propaganda tries to convince European communities that refusal from russian energy carriers will primarily affect ordinary Europeans. They will "suffer", "freeze", and "pay more". 

But the truth is that no European country that has refused to cooperate with Gazprom has seen prices rise. The underground storage facilities are full and Europe will get through the next winter without any problems. Only those few countries that did not want to give up russian gas after the start of the full-scale invasion of Ukraine have problems and have additional difficulties with supplies and payments. That is why Orban's calls for a review of sanctions are not viable. 

The US imposes new sanctions for interference in the electoral process by Iranian and Russian intelligence services

Kremlin increases spending on censorship and suppression of independent journalism

Kremlin intelligence services are trying to ‘colonise’ the Bluesky social network

Russia is stepping up its efforts in the information space against Ukraine and its allies

TikTok is suspected of criminally ignoring fake accounts before the Romanian elections

Russia regularly transfers weapons to third countries for acts of aggression

Russian cybercriminals target European and American users

Russians are training new propagandists in Africa

The Kremlin's anti-Israel rhetoric is reinforced by the arming of Jerusalem's opponents

Kremlin cybercriminals are attacking government websites and companies in Belgium

Finland and the USA record large-scale operations of influence on the part of the Kremlin

Russia is trying to bring Poles and Ukrainians into conflict against the backdrop of a natural disaster

Kremlin cybercriminals are attacking government websites and companies in Belgium

Russian special services are recruiting Europeans with pro-Russian views to Telegram

Russia has created a network of influence on events in several countries in Meta

A blogger from the USA spread pre-election fakes for Russian money

Agents of the Russian special services were detained in Poland

The information war waged by the Russian Federation against the West reached Canada and Japan

"Reporters Without Borders" is launching a project to analyze the impact of propaganda and disinformation in the world

Russia bribed more than 130,000 citizens of Moldova to prevent its accession to the EU

Russia intensified its information war against Moldova

Russia's ally has stepped up phishing cyberattacks against high-ranking US and Israeli officials

Polish special services neutralized a group of cyberspies controlled by Moscow, and Norway is preparing for sabotage

Western investors in big Russian business

In the Baltic countries and Poland, 8 sabotage attempts by Russia were recorded

The Czech Republic has detected a number of hybrid attacks from Russia

The Russian Orthodox Church is expanding its sphere of influence