A Russian-based information operation used fake accounts, forged documents, and dozens of online platforms to spread stories that attacked Western interests and unity. Its size and complexity indicated that it was conducted by a persistent, sophisticated, and well-resourced actor, possibly an intelligence operation.

The operation shows online platforms’ ongoing vulnerability to disinformation campaigns. Far more than on Facebook, which exposed it, or Twitter, the operation maintained fake accounts on platforms such Medium and Reddit, and online forums from Australia to Austria and from Spain to San Francisco. Its level of ambition was very high, but its impact was almost always low.

Nika Aleksejeva
Lead Researcher, Baltics
DFRLab, Atlantic Council

Lukas Andriukaitis
Research Associate
DFRLab, Atlantic Council

Luiza Bandeira
Research Associate, Latin America
DFRLab, Atlantic Council

Donara Barojan
Research Associate
DFRLab, Atlantic Council

Graham Brookie
Director
DFRLab, Atlantic Council

Eto Buziashvili
Research Assistant
DFRLab, Atlantic Council

Andy Carvin
Senior Resident Fellow
DFRLab, Atlantic Council

Kanishk Karan
Information Integrity and Safety Specialist
Twitter

Ben Nimmo
Nonresident Senior Fellow
DFRLab, Atlantic Council

Iain Robertson
Deputy Managing Editor
DFRLab, Atlantic Council

Michael Sheldon
Research Assistant
DFRLab, Atlantic Council

Nika Aleksejeva, Lukas Andriukaitis, Luiza Bandeira, Donara Barojan, Graham Brookie, Eto Buziashvili, Andy Carvin, Kanishk Karan, Ben Nimmo, Iain Robertson, and Michael Sheldon, Operation “Secondary Infektion” – A Suspected Russian Intelligence Operation Targeting Europe and the United States, Atlantic Council’s Digital Forensic Research Lab (DFRLab), June 22, 2019, https://dfrlab.org/2019/06/22/operation-secondary-infektion/.