The Kremlin uses clones of Der Spiegel, Fox News and RBC for a disinformation campaign targeting Ukraine – The Insider

The social network X is seeing a rise in content with the message "Ukrainians should demand that their government makes a truce with Russia." The spam campaign began on October 25, with tweets being posted at a very high rate (2.5 tweets per minute) for several hours. This was noted by the analytical project "Bot Blocker / antibot4navalny", which studied the posts, writes The Insider.

The articles are spread through fake websites of well-known media outlets – not only Ukrainian mass media, but also prominent Western ones. The campaign coincides with a sudden wave of piquets "for demobilization" in Ukrainian cities, where women came out into the streets holding identical posters.

The Insider is familiar with the analytics data from X (formerly Twitter).

Some of the posts have links to several sham news / analytical reviews. As researchers have noted, they are posted on websites that are counterfeits of well-known Ukrainian news outlets. They all write that defeat in the war is imminent and inevitable; that the military and financial aid that was intended for Ukraine will be withdrawn due to Israel; that Ukrainians are facing a winter without heating, pensions and salaries; that due to the lack of proper military equipment, the authorities are sending thousands of soldiers to the slaughter to stay in power.

Screenshot by The Insider

Essentially, this is a massive spam attack with pro-Kremlin content targeting not only the Ukrainian audience, but also the West. Several dozen materials were distributed not only in English, but also in French, German, and Hebrew.

Photo by The Insider

The same accounts that are spreading the fake articles also post Kremlin propaganda. Namely, links to the ukraine inc website with a video about the "drug addict Volodymyr Zelensky."

As the analysts explained to The Insider, the tweets being posted at such a rate and in such quantities indicates that this is an automated process:

"Unlike traditional paid trolls, which we've been studying for over a year, this spam attack is all about automated posting. That means you can scale it up by 10 times, 100 times, 1000 times very cheaply. The current amount of such spam per minute is roughly comparable to what a Twitter 'troll factory' usually produces. But live trolls behind keyboards are expensive and difficult to scale up, and with automated spam this can be done very easily."

The accounts not only spread anti-Ukraine rhetoric. Many also post a photo of a wall tagged with Stars of David. The same accounts are posting this photo in the replies to multiple posts. The caption for the photo is approximately the same for everyone, only in different languages. To quote: "Sad to see the conflict go this far," "The sad reality of how international conflicts can affect everyday life."

According to the "Bot Blocker / antibot4navalny" project, this is a way to instill anxiety and shift the focus away from Ukraine and to the Arab-Israeli conflict.

GRU hackers have been practicing disinformation and phishing attacks through fake global media websites for years, and with the start of the full-scale invasion, such attacks have intensified. The Insider has written about this in their article "Clone Attack. The GRU launches a large-scale cyber attack on Ukraine."

The articles have both Ukrainian and Russian versions. The links lead to Ukrainian-language websites, but the headlines of the materials in the links are in Russian – seemingly, the outlets are primarily Russian.

It makes no sense for real Ukrainian speakers and journalists to post materials on third-party websites.

The accounts mainly follow large Qazaq mass media / officials. That is, they were either created by a Qazaq contractor or using VPN with an exit in Qazaqstan.