Discover and read the best of Twitter Threads about #SecondaryInfektion
Most recents (5)
BREAKING: @Graphika_NYC has been digging into Russian info op #SecondaryInfektion for months. Today, we’re exposing its full scale.
6 years
7 languages
> 2,500 pieces of content
> 300 platforms (no, that’s not a typo)
And some truly epic fails.
secondaryinfektion.org
6 years
7 languages
> 2,500 pieces of content
> 300 platforms (no, that’s not a typo)
And some truly epic fails.
secondaryinfektion.org
Top takeaways: 1) Secondary Infektion is a full-scale disinfo operation that’s been around at least six years.
We don’t know which entity is behind it, but they’re persistent, high-opsec, and a tough investigative nut to crack.
We don’t know which entity is behind it, but they’re persistent, high-opsec, and a tough investigative nut to crack.
This is a conservative estimate based on many interlocking criteria, including:
Short-lived, single-use burner accounts;
Forged documents;
Specific combinations of sites and fora;
Finds published by platforms (eg @Reddit).
We’re sure there's more to find.
Short-lived, single-use burner accounts;
Forged documents;
Specific combinations of sites and fora;
Finds published by platforms (eg @Reddit).
We’re sure there's more to find.
One point on attributing operation #SecondaryInfektion, because there are various theories going around: we don't have the smoking keyboard here, so attribution is a question of degrees of probability.
medium.com/dfrlab/top-tak…
medium.com/dfrlab/top-tak…
#SecondaryInfektion was:
persistent (since Jan 2014);
sophisticated;
well resourced;
obsessed with secrecy;
rubbish at getting impact.
The security measures were relentless, and unprecedented for any op I've seen.
All that suggests an intelligence op.
persistent (since Jan 2014);
sophisticated;
well resourced;
obsessed with secrecy;
rubbish at getting impact.
The security measures were relentless, and unprecedented for any op I've seen.
All that suggests an intelligence op.
It doesn't look like the Internet Research Agency. They were actually good at getting impact, at least sometimes.
The GRU would be the next obvious choice, because they have form. Remember Alice Donovan?
medium.com/dfrlab/trolltr…
The GRU would be the next obvious choice, because they have form. Remember Alice Donovan?
medium.com/dfrlab/trolltr…
One of the odd things about operation #SecondaryInfektion was how little it was on Twitter - even less than on Facebook.
So far, we've found one account, that the FB account pointed to. Ostensibly a Ukrainian girl in Germany.
So far, we've found one account, that the FB account pointed to. Ostensibly a Ukrainian girl in Germany.
The operation used this account (now suspended) to ping stories to German politicians and commentators, especially AfD.
The nastiest story it posted, and the only one that got any traction, was a claim based on a forged "guide to Muslim immigrants" in Germany.
As ever, posted by a single-use burner account.
As ever, posted by a single-use burner account.
More on the info op from Russia that we've dubbed #SecondaryInfektion, for its resemblance to the Soviet-era AIDS libel.
Planting stories far away, then amplifying them with covert assets.
Full report here: docs.wixstatic.com/ugd/9d177c_3e5…
Planting stories far away, then amplifying them with covert assets.
Full report here: docs.wixstatic.com/ugd/9d177c_3e5…
As far as we can tell, the operation started in Russian in early 2014, and focused on Ukraine.
A few of the Russian-language personas were repetitive posters.
Note the blue-face version of @navalny, too. He's a frequent target.
medium.com/dfrlab/russian…
A few of the Russian-language personas were repetitive posters.
Note the blue-face version of @navalny, too. He's a frequent target.
medium.com/dfrlab/russian…
The same persona posted the same story to multiple platforms. The Facebook account started in March 2015; an account with the same name and profile picture was on LiveJournal in early 2014.
JUST OUT: welcome to operation #SecondaryInfektion, a Russian-based information operation that's persistent, sophisticated, and well resourced.
Suspected source: Russian intelligence.
@DFRLab has been investigating. Top takeaways here.
medium.com/dfrlab/top-tak…
Suspected source: Russian intelligence.
@DFRLab has been investigating. Top takeaways here.
medium.com/dfrlab/top-tak…
This was a major operation. At least 9 languages, dozens of fake accounts, over 30 different platforms. It had high ambition, but most of the time, low impact.
The full report on #SecondaryInfektion is online here: digitalsherlocks.org/ourwork
The full report on #SecondaryInfektion is online here: digitalsherlocks.org/ourwork
How do we know it was from Russia? It started with a @Facebook takedown of accounts "emanating from Russia". Kudos to FB for finding it, these operators tried hard to hide.
When we dug into it, we realised the assets on FB were the tip of the iceberg.
newsroom.fb.com/news/2019/05/m…
When we dug into it, we realised the assets on FB were the tip of the iceberg.
newsroom.fb.com/news/2019/05/m…
