Russian Information Operations Tactics and Techniques

🗞️ A must-have for anyone teaching Russian disinformation tactics. A comprehensive yet highly pedagogical and illustrated catalogue of tactics with concrete examples. 👏🏼Well done @center for countering disinformation with the support of The European Union Advisory Mission Ukraine (#EUAM Ukraine) 🇪🇺 1️⃣ The first part is dedicated to the Mechanisms of destructive information influence: • Bots 🤖 • Fake accounts 🤳🏻 • Anonymous authority 👁️ • Appeal to authority 🔨 • Deepfakes 👾 • Potemkin villages 🤡 • Duplicating websites or accounts 👨🏻💻 • Framing 🖼️ • Information overload 🌧️ • Agenda-setting 📆 • Demonisation • Polarisation 🤯 • Confirmation bias 🧠 • Primacy effect 🪢 • Deceptive sources 🎭 • Information alibi 🥸 2️⃣ The second part offers an overview of the Tactics of destructive information influence. Particularly useful to identifies the perverse rhetorical tricks at play and counter them with the right arguments: • Clickbaiting • Rating • Information sandwich • Lost in translation • Presence effects • Contextomy • Gish gallop • Whataboutism • Conspiracy theories • Talking away • Mundanisation • Doublespeak • Sleeper effect • “Check it if you can” • False analogy • Trolling • False dilemma • Using jokes or memes • Stereotyping 3️⃣ The last part describes the various soft power tools weaponized to leverage influence : Soft power tools: Russia’s influence through… • films 🎦 • e-sports 🎮 • literature 📕 • music 🎶 • sports ⚽️ • churches ⛪️ • cultural centre networks 🤝🏻 • educational programmes and grants 🎓 • historical revisionism 🖊️ • loyal political structures🏰 👐🏻Many thanks to the authors for a reference document which deserves to be widely shared As someone who srudied humanities, I always longed for the ancient “class of rhetorics” which was, until the late 19th century, the penultimate year of secondary education in France before philosophy: students learned the full art of persuasion—finding ideas, structuring them, refining style, memorizing, and delivering speeches—through constant practice and study of classical models. The purpose was to train them in the art of eloquence—to speak and write clearly, elegantly, and persuasively. And to prepare future orators -lawyers, priests, politicians- as well as any educated citizen. Were this classical knowledge more widely shared today, we might be better equipped to resist the tactics outlined in part 2️⃣ as we would more spontaneously recognize the persuasion strategies used against us -even if they come in alluring video forms these days! - and be able to counter them with the tools of logic and structured argument.

„The Insider has obtained hacked correspondence from officers of Russia's foreign intelligence agency (SVR) responsible for “information warfare” with the West. The leaked documents, intended for various government agencies, reveal the Kremlin's strategy: spreading disinformation on sensitive Western topics, posting falsehoods while posing as radical Ukrainian and European political forces (both real and specially created), appealing to emotions — primarily fear — over rationality, and utilizing new internet platforms instead of outdated ones like RT and Sputnik. The “leitmotif of our cognitive campaign in the [Western] countries is proposed to be the instilling of the strongest emotion in the human psyche — fear,” the document states. “It is precisely the fear for the future, uncertainty about tomorrow, the inability to make long-term plans, the unclear fate of children and future generations. The cultivation of these triggers floods an individual's subconscious with panic and terror.” Curiously, 2023 saw its fair share of Russian-sponsored provocations seemingly aligned with Operation Kylo all across Europe. Research by a European media consortium revealed that a roving troupe of Russian hirelings kept turning up at protests in major cities such as Paris, Brussels, Madrid, and The Hague denouncing Western arms shipments to Ukraine. The men, the consortium concluded, had likely been hired by Russian special services. One was even found to be a student from St. Petersburg, who, as if taking literal instruction from Kolesov’s playbook, went searching online for volunteers who would be photographed for 80 to 100 euros. The images were meant to be used on social media to telegraph that anti-Ukraine protests were a mass phenomenon in Europe. Other stunts have followed. In October, not long after Hamas’s attack on Israel, hundreds of Stars of David were spray-painted on the walls of Jewish institutions all over Paris, images of which went viral online. The culprits were actually a Russian-speaking couple from Moldova who were caught in the act and explained they had been recruited to do this false-flag operation via the Telegram messenger. More recently, three men placed coffins in front of the Eiffel Tower with French flags and the phrase “French soldiers of Ukraine'' scrawled on them — a reference to French President Emmanuel Macron’s suggestion that French troops might one day be deployed to safeguard the port city of Odesa. The men are reported to have received up to 400 euros for the campaign. A “truly final version” of the project (…) clarifies that a core objective will be “mass protest actions in NATO countries, followed by the dissemination of content in the enemy’s media field. We have the necessary capabilities to attract a special contingent permanently residing abroad for such events,” perhaps referring to SVR “illegals,” or spies stationed in the West without diplomatic cover.“ https://lnkd.in/ePTS9zzG

I’ve been digging into RUSI’s new report “Russia, AI and the Future of Disinformation Warfare” (June 2025). I’m only halfway through, but several threads already echo what we heard #RigaStratComDialogues and what I’ve bumped into since my last PSYOP deployment: — AI as both megaphone and plot device. Pro-Kremlin Telegram admins discuss using large language models to mass-generate content while simultaneously weaving “rogue AI” storylines that blame tech failures on the West. — Opportunity–fear whiplash. The same channels praise AI’s scale then panic over “Western bias” in models like YandexGPT. One post calls the bot a coward for sidestepping Crimea questions and labels its developers “foreign agents.” — Sovereignty optics vs operator reality. Moscow markets Sberbank’s GigaChat as the patriotic answer to ChatGPT, yet field actors still lean on U.S.-hosted models for quality and plugins. — Concrete use-case: DoppelGänger. AI-cloned versions of Der Spiegel, The Guardian and 20 Minutes pumped out fabricated stories accusing NATO of organ trafficking in Ukraine. — Hacktivist scaling. Crew NoName057(16) openly advertises AI scripts for DDoS targeting and deepfake head-swaps, boasting whenever Google or Meta reports on them—free amplification baked in. — Wagner’s quality-control gripes. Inner-circle channels trash low-effort Russian deepfakes and pitch paid “PSYOP masterclasses” to raise the bar. A mercenary group doing after-action reviews on propaganda says a lot about where this space is headed. Vannevar Labs tooling sits at the edge of narrative detection and AI-assisted analysis, so this report has major implications for us. The report confirms two things: 1. Speed plus behaviour-level signals will beat content moderation every time; Russia’s own operators admit they spray and adjust. 2. Dependence on Western models is both a Russian weakness and a moving target—one update to an API can change an op tempo overnight. We bake that volatility into our pipelines now. I’ll finish the report this week, but if you’ve seen other research on AI-driven influence (especially beyond Telegram), send it my way. My reading list is never closed. —Rob, ex-PSYOP guy still chasing cognitive terrain #InfoOps #AIandSecurity #Disinformation #RUSI #DefenseTech #VannevarLabs #Disinfo #PSYOP #IO #cogwar #HybridWarfare

'A Russian spy plot that sought to sow "panic and terror" in the West has been revealed in a joint-investigation. Leaked emails from Russia's Foreign Intelligence Service (SVR) obtained by independent Russian site The Insider and the German newspaper Der Spiegel reveal an elaborate plan masterminded in 2022, dubbed "Project Kylo."... ...The SVR officer suggested that instead of pushing typical pro-Russian arguments about the conflict, the operation should "deepen internal contradictions between the ruling elites" in the West, including in the U.S., which is known among the special services as Russia's "main adversary." This involved SVR recruits creating fake advertisements disguised as news headlines, fake NGOs and websites, publishing manipulative content on social media platforms including YouTube, and hiring individuals to take part in protests in the West with the aim of filming them and disseminating the content online.' https://lnkd.in/grXk5Btt

Again and again, I find myself astonished by how little Russian strategic methods are truly understood in the West and how often their effects still come as a surprise. Not because the methods are new. But because we keep treating them as if they are. In this latest article in my Russia Active Measures Mini-Series (Part 4- The escalation ladder), I open one of the most important and least understood aspects of Russian strategic doctrine: how influence is escalated step by step, from quiet reconnaissance to tangible political, institutional, societal outcomes. Active Measures are not random acts. They are structured, layered, patient. They begin by mapping vulnerabilities, testing narratives, seeding stories, laundering them through credible messengers, amplifying them at scale, and ultimately shaping political environments and decision-making conditions. The goal is not disruption as a one-time event. The goal is long-term erosion. Erosion of trust, cohesion, confidence, decision-making capacity. This escalation ladder has been refined over centuries through Tsarist intelligence traditions, Soviet-era Active Measures, modern Russian hybrid warfare doctrine. What has changed is not the logic, but the speed and scale. Digital infrastructure, global connectivity, and AI have dramatically accelerated processes that once took years to unfold. The digital era did not invent these methods. It amplified them. This is also why understanding the historical foundations matters so deeply. In this article, I link back to my earlier Russia Mini-Series, where I explored the broader strategic culture and methods, including Maskirovka, lies, influence operations, the long-standing integration of political, informational, psychological warfare. These are not isolated tactics but components of a coherent strategic system. Influence does not operate only through obvious channels. Cultural exchange, intellectual engagement, business relationships, academic discourse, public debate can all become vectors, sometimes unintentionally, within larger strategic influence frameworks. Underestimating this reality, or treating it as something new or episodic, is dangerous. Modern defence is no longer only about protecting territory. It is also about protecting perception, trust, decision-making integrity, critical infrastructure - physical and informational. And in an era where open-source information, digital platforms, even AI models are probed, shaped, influenced, this challenge becomes both more complex and more consequential. Understanding the escalation ladder is not academic. It is essential for defence, public sector resilience, political leadership, anyone building systems that operate in today’s contested information environment. Because the greatest vulnerability is not exposure. It is underestimation. #ActiveMeasures #HybridWarfare #InformationWarfare #CognitiveWarfare #Russia #HybridThreats #Geopolitics #Cyber #InfluenceOperations #Disinformation

Russian intelligence recruited #Moldova’s former Chief of General Staff, who worked until the end of 2021 and wanted Russia to invade the country. The Insider has gained access to the Telegram correspondence between Igor Gorgan, former Chief of the General Staff of Moldova, and his GRU handler, Russian Colonel Alexei Makarov. Gorgan regularly reported to Makarov on Moldova’s domestic political situation and provided information on visits from Ukrainian Ministry of Defense representatives, who came to Moldova to purchase military equipment and ammunition. Gorgan served in the General Staff until late 2021, when the country’s new president Maia Sandu requested his resignation. Before the July 2023 mass expulsion of Russian spies working in Moldova under diplomatic cover in Moldova, Gorgan even managed to secure a job at the UN. “Leveraging his remaining connections in the Moldovan Defense Ministry, Gorgan continues to be a key GRU informant,” the publication said. Igor Gorgan and Alexei Makarov started particularly active communication in April 2022, following Russia’s full-scale invasion of Ukraine. The confidential meetings mostly took place in Chișinău cafes or on a fishing trip: “I can meet anyone, I am a man of action, we need to move forward faster! We should go fishing and talk about everything! We’re living in historic times! And we have to make this history!” one of the messages from the Moldovan general reads. According to these reports, Russia was particularly interested in what kind of weapons Kyiv was buying from neighboring countries, particularly Moldova. General Gorgan immediately reported: “Ukraine’s [state defense exporter] Ukroboronexport is trying to buy back (or take with the help of ‘partners’) six Mig-29s from Moldova, which are in Mărculești. They insist very strongly… So far, the airplanes are in place. They want to ‘pull off’ the operation through a front company from the United Arab Emirates in the near future.” the spy reported to the handler. Gorgan sent another message on the same day: “Railroad trains with fuel are coming from the territory of Moldova, namely from the village of Etulia to the Ukrainian settlement of Reni. The train with fuel moves only at night, during the day, it stands still not to become a target of the Russian Aerospace Forces.” Another message to the handler followed soon after: “The Ukrainians have been walking around our Ministry of Defense for three weeks asking for everything — artillery shells in particular.” Agent Gorgan was also restless about arms deliveries to Ukraine via Romania. Here’s the advice he gave to Colonel Makarov: “It’s essential to close the border with Romania as soon as possible! It’s a big hole! A lot of cargo comes to Ukraine from there. Especially military cargo! The Romanians still have some military factories that produce weapons and ammunition.” https://lnkd.in/dgt3_nSW

Major Cybersecurity Alert - Russian GRU Unleashes Sophisticated Campaign Against Western Supply Lines A devastating new intelligence report reveals how Russian military hackers have been systematically infiltrating the backbone of Western aid to Ukraine - targeting the very companies moving critical supplies across borders. The Scope is Staggering: • 85th Main Special Service Center (Unit 26165) - Russia's elite cyber warfare unit - has compromised dozens of logistics companies across 13 countries • Victims include major transportation hubs, ports, airports, maritime companies, and IT service providers • The operation spans from Bulgaria to the United States, with over 10,000 IP cameras hijacked to monitor aid shipments in real-time Their Methods: The hackers didn't just break into networks - they studied their targets like predators. They identified key personnel, mapped business relationships, and exploited trust between partner companies. Once inside, they accessed the most sensitive intelligence: train schedules, shipping manifests, container numbers, cargo contents, and exact travel routes of aid shipments to Ukraine. The Most Disturbing Discovery: Russians positioned themselves to watch everything. They compromised traffic cameras and private security cameras near border crossings and military installations. Camera targets were positioned to monitor aid flowing into the country. They could literally watch Western aid arrive and coordinate attacks accordingly. How They Got In: • Exploited Microsoft Outlook vulnerabilities to steal credentials • Used fake login pages impersonating government entities • Weaponized WinRAR file compression software • Conducted massive password-spraying campaigns • Even attempted voice phishing, calling victims while impersonating IT staff The Persistence Factor: Once inside corporate email systems, they manipulated mailbox permissions for sustained access, enrolled compromised accounts in multi-factor authentication to appear legitimate, and used legitimate Microsoft Exchange protocols to blend their data theft with normal business operations. Why This Matters: This isn't just corporate espionage - it's military intelligence gathering that directly threatens Ukrainian defense capabilities. Every compromised shipment manifest potentially enables Russian forces to target aid convoys, anticipate weapon deliveries, or disrupt critical supply chains. The investigation involved 15+ international intelligence agencies, highlighting how seriously Western governments view this threat. Organizations handling sensitive logistics or supporting Ukrainian aid efforts should immediately review their cybersecurity posture and monitor for the specific indicators outlined in this advisory. #CyberSecurity #Ukraine #Russia #NationalSecurity #Logistics

How Russia Sells Illusion: The Disinformation Architecture of Imperial Grandeur If you glance at Kremlin media, you might see Russia portrayed as a resurgent superpower: advanced technology, military prowess, global respect. But behind this façade lies a meticulously engineered disinformation machinery designed to reshape perceptions—and comfort a regime that fears its own weaknesses. For years, Moscow has deployed propaganda not merely as a tool of influence, but as an act of self-legitimization. It sells the narrative: Russia is always strong; its setbacks are betrayals; its enemies are doomed. The goal is not just to scare internal critics, but to persuade others—ourselves in the West—that resistance is futile. One vivid example is Russia’s creation of War on Fakes, a so-called fact-checking project. Ostensibly, it debunks false news, but in reality it amplifies Kremlin narratives under the guise of neutrality. In fact, many “fact checks” there simply repackage Kremlin talking points and dismiss unfavorable reporting as “biased.” Another striking case: the Doppelgänger campaign. Behind the scenes, Russian actors created fake media websites mimicking established Western outlets—Fox News, Le Parisien, Der Spiegel—to publish pro-Kremlin content in English, French, German, and beyond. These clones lend “legitimacy” to lies, waiting for Western media to pick them up. Add to that internal leaks from a “troll factory” operation: documents show how propagandists openly admit producing fake news and coordinating influence campaigns targeting European elections. They use memes, bots, and AI-assisted content to drown out opposition voices. These aren’t random acts of deception. They are pillars of disinformation strategy. A 2017 U.S. State Department report identified five pillars of Russia’s disinformation ecosystem—state media, trolls and bots, “patriotic” bloggers, proxy media, and distortion of facts. But why does Russia invest so heavily in illusions? Because real power is fragile. Russia lacks technological dominance, economic dynamism, demographic advantage, and soft power. What it can control is narrative. By claiming “greatness,” it inoculates its citizens against doubt. By broadcasting strength, it pressures neighbors. By creating doubt, it erodes alliances. In fact, in the war in Ukraine, disinformation is as much a front line as artillery. In Kharkiv, during the Russian 2024 offensive, civilians received mass messages via Telegram and SMS — falsely warning of imminent encirclement with maps and safe routes. Panic spread. The messages bore the logo of Ukraine’s State Emergencies Service. It was psychological warfare, deliberately misleading to fracture morale. To my fellow journalists, analysts, and policymakers in the West: don’t underestimate the symbolic dimension. Russia doesn’t need to win every battle—just enough minds. When disinformation succeeds, it distorts our choices.

🔖 Insightful report "Russia’s Information Confrontation Doctrine in Practice (2014–Present): Intent, Evolution and Implications" by the International Institute for Strategic Studies . The paper outlines how Russia has leveraged its information confrontation doctrine to shape both its domestic environment and the international order to serve its long-term goal of great power restoration. ‼️ Russia's Information Confrontation Doctrine comprises: ☑️ Integrated multi-domain strategy (cyber operations, electronic warfare, psychological warfare and conventional forms of sabotage); ☑️ Domestic control and regime stability (tight control over Russia's domestic information environment through censorship, surveillance, manipulation of the information infrastructure and suppression of dissent); ☑️ Regional influence and strategic intimidation (deployment of a range of cyber operations, disinformation campaigns and covert political influence efforts to assert its regional influence and counter Western integration); ☑️ Western destabilisation (sustained disinformation and cyber operations to destabilise Western democracies and erode international cohesion); ☑️ Global outreach and hybrid engagement (in Africa, Latin America and the Middle East, Russia, alongside cyber ops and strategic narratives, employs a blend of conventional military presence, private military companies and covert funding); ☑️ Adaptive and evolving capability (Russia’s information confrontation capabilities continue to evolve, becoming more flexible, responsive and technologically sophisticated). 📌 In a nutshell: Russia seeks to shape perceptions, manipulate emotions and fragment social cohesion through persistent narrative campaigns which are iterative, assertive and global in ambition.

Russian GRU cyber operatives are running a large-scale, targeted operations against Signal and WhatsApp users of government officials, military personnel and civil servants. The fake support message in the advisory tells victims, in capital letters: "DON'T TELL ANYONE THE CODE, NOT EVEN SIGNAL EMPLOYEES." That literal line is in the phishing message. AND IT WORKED. Attackers didn't need to break Signal. It just needed officials who trusted a a random chat message more than their own security training. Dutch intelligence services confirmed Dutch government employees were among the victims. The campaign exploits no technical vulnerabilities in either app. Instead, it uses the apps' own features against their users. Two methods. 1. A fake "Signal Security Support Chatbot" contacts the target, warns of suspicious activity and a possible data leak, then asks for the SMS verification code and Signal PIN. Hand those over and the attacker takes full ownership of the account, moves it to a number they control, and reads everything going forward. The victim can re-register using their old number and will see their local chat history intact - so they assume nothing happened. The advisory notes, with some understatement, that "this assumption could be incorrect." 2. A malicious QR code, dressed as a group invitation, silently links the attacker's device to the victim's account. The victim keeps full access and notices nothing. The attacker just reads along. What makes this operationally elegant is the irreversibility. Signal has no central management by design. This is for reasons of user privacy. There is no way to remotely deactivate a stolen account. Once gone, it is gone. GRU operatives just understood this. The advisory may also imply something governments rarely say. Signal was being used for communications viewed as sensitive. Its warning against sending classified information over consumer messaging apps may reflect concern that actual practice had drifted beyond formal policy.