Bit of a thread. I started working on this data set a couple months ago. Early accounts I found dated back to 2016 but in February I stumbled onto some of the COVID-19 disinfo that Russian trolls, likely from the Secondary Infektion campaign, were pushing. thedailybeast.com/russian-trolls…
Secondary Infektion (SI) is a pretty specific campaign of disinformation that's suspected to be linked to the Russian government. I'm grateful to @benimmo of @Graphika_NYC for helping me on this as they're some of the smartest people around on this campaign.
Heres the SI-linked COVID-19 story. Someone *cough* created a fake hacktivist group called Anonymous Kazakhstan & pushed messages to Kazakh social media claiming that the group had hacked biologists at the Central Reference Lab in Kazakhstan & found it was the source of the virus 
SI personas on Reddit and Russian-language blogs pushed a version of the story. Why blame the Central Reference Lab in Kazakhstan of all places? It's funded by the Pentagon as part of a nonproliferation program, which apparently Moscow is not fond of.
The fake story tries to paint US aid as a threat to Kazakhstan both in the form of the fake COVID-19 leak and dark intonations about China, one of Kazakhstan's most important investment sources, sanctioning the country. Basically trying to foul the public well for US nonpro aid
What else did they get up to? I found about 40ish personas spread across ~20 stories on everything from Facebook, Reddit, Medium, and hyper obscure forums so bear with me.
Here's one persona SI used on Christmas 2019 to try and claim that the Democrats had colluded with a former KGB officer (he's not a former KGB officer, it's a lie) during the 2016 election. They encouraged everyone to watch Rudy Giuliani on OANN
You may remember the "ackshually, the DeMoCrAtS cOlLuDeD wItH uKrAiNe" narrative from the intelligence community briefings the NYT reported on. Same message the IC claimed Russian intel services were trying to seed. 🤔nytimes.com/2019/11/22/us/…
SI also focused its election meddling farther afield from the US and the 2016 election. As recently as 2018, they were trying to pull a repeat (albeit at a much less brazen volume and scale) during Sweden's 2018 elections. Here's a fake letter they forged from Pompeo for that
Like most of SI's forgeries, it's sub-intern caliber work in broken English that anyone with half a brain would recognize as false. The story here is supposed to be about the US finding out that a Swedish political party is being helped by Russian hackers, which, lol
Again, the forgery is absurd on its face but just for funsies, I had Sam Meyer, one of @ArmsControlWonk's imagery analysis, wizards run it through their fancy software, Tungstene. Sam found that not only was it a forgery, it was a forgery from a template.
An actual letter that had been scanned or photographed wouldn't have layers like that. With this, you can just add on whatever text you like and crank out whatever other sloppy forgeries you'd like to pass off in Pompeo's name. Not that it would get you very far.
Some of the SI stories were a little intriguing in and of themselves. At one point they appeared to be trying to implicate a suspected Shadow Brokers leaker in other (fictitious) leaks.
In October 2016, prosecutors charged NSA employee Hal Martin with illegally retaining classified information from his job. He'd come under scrutiny because at one point the feds were investigating whether or not he had leaked classified tools the Shadow Brokers.
Martin was never charged with that in any case. But a November 2016 SI article posted on a number of forums tried to claim that Martin had leaked the names of CIA officers involved in the torture program (he didn't and probably wouldn't have had access to those anyhow)
I'm hesitant to say it was an earnest effort to divert public attention since it's so transparently nonsense. But it does have an air of intrigue about it given that no one knows who the Shadow Brokers are and some believe they're a Russian persona.
This one has a bit of an air of palace intrigue. Russian-linked SI trolls also seeded a dispararing story about former Prime Minister Dmitry Medvedev, calling him a drunk with no political future 😬
Forgeries—both of documents and legitimate news outlet screenshots—are the stock and trade of SI and for the Medvedev story they used a forged screenshot of a fake article purportedly from The Guardian
They also tried to enrage Turkish audiences with a forged screenshot of a fake tweet from the U.S.-backed Kurdish forces in Syria claiming they'd received US Javelin anti-tank missiles from Ukraine. Never happened. (label mine here)
So what to make of this campaign? One thing stands out is that it was a failure by almost any metric. The articles rarely if ever escaped the orbit of the fake personas that created them. My favorite response to one story on Reddit is from this hero
In terms of lessons learned in curbing this stuff, open platforms are an issue. We've seen the same kind of open platform abuse tactics used by Iranian trolls and from some of the same platforms. thedailybeast.com/new-york-post-…
Reddit and Medium are particular favorites of SI. Facebook less so and Facebook tends to be better at taking these things down. After we sent our findings to Facebook, they nuked about a dozen accounts.
Anyway, there's more stories and personas. I'll be writing those up for our members at Beast Inside and publishing later tonight. Thanks for reading.
