Russian Op 7: Venom in Venezuela

Forged letter alleged false flag attack

Russian Op 7: Venom in Venezuela

Share this story

Forged letter alleged false flag attack

(Soruce: @KaranKanishk/DFRLab)

This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.

Much of the Russian operation’s content focused on European issues. One significant outlier was a story it launched on February 26, 2019, three days after clashes broke out over aid deliveries to Venezuela.

A False-Flag False Flag

The story began on a Spanish-language forum, The article (archived here) claimed that the United States was planning a chemical attack in Venezuela to justify a military intervention, citing as proof a letter purportedly written by the Mission Director of the U.S. Agency for International Development (USAID) Colombia, Lawrence Sacks, to Venezuela’s interim president, Juan Guaidó.

The beginning of the Spanish-language post on (Source: globedia/archive)

The letter was an obvious forgery. Setting aside USAID’s long history of humanitarian work, the essential implausibility of it plotting a war crime using chemical weapons, and the unlikelihood of plotting such a war crime in open language through an unencrypted channel, sentences such as “Current situation is jeopardizing our joint action directed against the regime of usurper Maduro” sound like they were written by a Bond villain rather than by a native English speaker.

The fake letter did not specify what sort of attack was intended; the author of the Spanish post wrote “it can be supposed” that it would chemical or biological.

Register, Post, Repeat

The account behind the article, “Gilbmedina84,” was equally questionable: it was registered the same day the article was published; its profile page showed no personal information; it had no followers; and it only posted this one article.

Profile page for “Gilbmedina84,” showing the creation date (left box), number of publications (center box), and number of followers (right box). (Source:

The same day, an account with the same username posted the article to Spanish forum meneame and Spanish-language subreddits r/latinoamerica, r/notArgentina, r/mexico, r/Colombia, r/vzla, r/cuba, and r/chile. In each case, the account registered that day and never posted again.

Three days later, on March 1, newly registered, single-use accounts posted a German translation of the story to two sites:, an Austrian forum for local news, and, a Berlin-based forum. Both versions attributed the article to The profile page on confirmed that the account behind it never returned to the site after making its one post.

Profile page for “TomTay,” also known as “Tom Taylor from Braunau,” from The upper box shows that the account was created on March 1, 2019, and only made one post. The lower box shows that “TomTay” was last seen on March 1, 2019. (Source:

English, But Not as You Know It

Also on March 1, a user called “Joel Forster” posted a translation of the story into non-native English on San Francisco forum This was the only article from this user, and it was full of curious turns of phrase:

“Mr. Trump started to burst threats…”

“In the view of the mentioned ‘necessary components’…”

“Immediately after that Guaidó will expose the bloody tyrant during the new phase of informational war…”

“Now the U.S. uses the old good scheme proven by time…”

“Informational war” — as opposed to, say, “information war” or “information warfare” — is a non-native phrase regularly used by Russian speakers, including Ministry of Defense translators. There is a Russian idiom that refers to the “old good times” and that is similar to English speakers referring to the “good old days.”

The same day, an identical article ran on a forum in South Africa, It did not give an author name, or an English-language source, and the name “Joel Forster” was not mentioned anywhere on the page. Nevertheless, a user called “Anna Mroczna” cross-posted the article to, a known vector for disinformation. The account attributed the story to South Africa Today but said that it was “translated from the Spanish by Joel Forster.” The “Anna Mroczna” persona was part of the operation, analyzed here.

Left, screenshot from showing the lack of search results for the name “Joel Forster.” Right, screenshot from the submission to, showing the attribution to South Africa Today and to Joel Forster. (Source:, left;, right)

Finally, on March 5, one of the accounts that Facebook exposed as being run from Russia picked up the German version of the story from with the comment, “Venezuela is the next candidate for U.S. democratization.” This account posed as an Austrian nationalist and interspersed shares from pro-Kremlin outlets with a high number of articles posted by newly registered accounts to blog sites.

Post by the Russian Facebook account masquerading as an Austrian, sharing the post on (Source: Facebook)

None of these posts gained significant traction or scored significant numbers of shares, views, or likes. The version was viewed 1,537 times but did not gain a single like; the version only received one reaction, which called the post “such stupidity.” Five of the subreddits removed the Spanish story for various violations, and it gained just five votes on the other subreddits combined. The article was shared just once on Facebook. It is therefore highly unlikely that the story moved from one language to another as a result of viral interest.

Scan of the spread of the three language variants on social media, using the BuzzSumo online tool. The Spanish version performed best, but only had 84 engagements. (Source: @etobuziashvili/DFRLab via Buzzsumo)

Facebook confirmed that the “Austrian nationalist” account was run from Russia. The DFRLab’s analysis further revealed that the forged USAID letter showed language errors characteristic of Russian speakers. The accounts that posted the fake story — in Spanish, English, and German — were newly created accounts that only posted once, while the English and German translations appeared on multiple platforms on the same day.

On that basis, it is most probable that the entire story, as well as its transmission from one language to the next, was the work of this Russian operation. Moreover, it appears likely that the purpose of the fake was to smear the reputation of the United States as the Venezuelan crisis reached its climax.

Follow along for more in-depth analysis from our #DigitalSherlocks.