Thread by @benimmo

JUST OUT: new report on the accounts identified by Reddit as connected to Russian operation "Secondary Infektion".

Looks like the stories were designed to divide Western countries.

H/t the teams at @Reddit, @Medium and @Facebook for insights.

graphika.com/reports/uk-lea…

This one started when Reddit published a list of 61 accounts that it believed were tied to the earlier Secondary Infektion.

Fifteen were linked to the UK trade leaks, eight were already known, the rest were new.

reddit.com/r/redditsecuri…

The Reddit accounts shared stories that had originally been posted by single-use burner accounts on websites like homment[.]com, Medium, and the BuzzFeed Community - the same ones that Secondary Infektion used.

The themes were wide-ranging, from Ukraine to Kaspersky.

Many stories incorporated forged documents. None seemed to get significant pickup. The operation used burner accounts for everything - not a good way to build audience.

Three stories stand out for what they say about the operation's attempt to target political divisions.

This was one of them: a story claiming to have a photo of the "do-not-prosecute list" that featured in the smear campaign against US Ambassador Marie Yovanovitch.

It came out five days after reports of the "list" began in the US, so it was following the story, not driving it.

The story appeared in English, Spanish and German on homment[.]com and others, attributed to unnamed Ukrainian groups without proof.

Then it showed up in Russian, attributed to "the Western press", i.e. homment.

Classic way to launder disinfo to a Russian-language audience.

There's no indication that the fake list was picked up in the U.S., or that the operation tried to land it in front of American influencers.

It looks like this was aimed at smearing the U.S. in the Russian-speaking world.

Another story was almost funny. It started with a fake interview planted on the BuzzFeed Community, claiming to talk with an MI6 agent.

His language was frankly Shakespearean.

"I remember the election day full well."

"Just a peacockery."

Really?

The operation plugged this periodically for months, without significant pickup. Fake accounts pushing a fake story struggled to engage real people.

But it looks like an attempt to feed anti-UK sentiment in the U.S.

Another story that got no pickup was aimed at separatism in Catalonia.

It featured a letter claiming that the EU had guaranteed the Catalans membership, and came out just before the 2017 referendum.

Potentially explosive, actually ineffective.

There were plenty more, including one insinuation that Angela Merkel is an alcoholic.

And there are almost certainly more left to find. #OSINT community and #DigitalSherlocks, the game's afoot.

Final point: this all started with a @Facebook takedown in May, attributed to operators from Russia.

They practised very high operational security, so this has taken a long time to piece together.

H/t to all the investigators involved.

about.fb.com/news/2019/05/m…