A fake tweet from Texas Governor Greg Abbott about Ukrainian politicians blackmailing the Biden family. A made-up gang rape of a Ukrainian woman by Polish nationalists. A bogus conspiracy theory about Ukraine’s president secretly allowing Polish troops to occupy and control swaths of Ukrainian territory under the guise of defending it from Russia.
As American spies warn about the possibility of Russian-made fake videos and propaganda provocations to justify a new invasion of Ukraine in the coming weeks, the world doesn’t have to look far to see what a campaign of disinformation and provocations against Ukraine would look like. These stories, posted over the past few years, are examples of how that kind of campaign is playing out right now.
Since 2014, Secondary Infektion, a disinformation crew attributed to Russia by cybersecurity officials at Facebook and Reddit, has littered the internet with fake government documents and forged screenshots of nonexistent social media posts. Despite the group’s long pedigree and deep catalog of content, its forgeries and fakes have largely failed to move public opinion or organic engagement on social media. The content, however, offers a glimpse of how Moscow has tried to undermine Ukraine’s pro-Western government with provocation forgeries similar to those now expected by U.S. intelligence.
ADVERTISEMENT
A review of Ukrainian social media posts over the past year by The Daily Beast shows 21 examples of fake stories planted by accounts using the Secondary Infektion playbook.
One narrative, which leveraged forged social media posts about Polish nationalists raping a Ukrainian woman as part of an initiation ritual, was posted on Nov. 8, 2021, by a fake “patriotic” Ukrainian Facebook page. Meta officials removed the page and attributed it to Secondary Infektion after The Daily Beast shared its findings with the company.
Separately, Reddit suspended six accounts last week after The Daily Beast identified them as possible Secondary Infektion sock puppets. Reddit suspended the accounts for violating the company’s terms of service prohibiting “manipulated content,” although company officials were not able to attribute the accounts to any particular entity. The company also suspended an additional seven accounts which pushed Secondary Infektion-like forgeries about Ukraine over the past year.
Many more fake personas posted to Ukrainian open forums, social media, and news sites used the same behavioral tics as Secondary Infektion trolls, but The Daily Beast was unable to formally attribute them to the group.
Taken together, the posts aim for similar goals: to paint Ukraine as irredeemably corrupt and ruled by an extremist far-right movement, divide and isolate Kyiv from important allies like Poland and Germany, and to pit nationalists in the country against minorities.
The U.S., Ukraine’s most important ally, features prominently in a number of Secondary Infektion-like posts. One article, published early in the Biden administration, sought to convince readers that Ukrainian President Volodomyr Zelensky couldn’t build a relationship with Washington because Zelensky’s political rivals held dirt on President Biden’s son Hunter and his business dealings in Ukraine. As evidence, trolls included a forged screenshot of a tweet from Texas Gov. Greg Abbott showing Biden embracing former Ukrainian President Petro Poroshenko—Zelensky’s political rival—warning about how he would “pander to a Third World country.”
Gov. Abbott’s Twitter account shows no record of having ever published such a tweet, and a spokesperson confirmed in an email that the post was a forgery.
The accounts posting the fake Abbott story used what’s become a well-known playbook for Secondary Infektion trolls. The trolls create accounts with stolen avatars the same day they share a post containing some kind of forgery. They post a story once on an open forum, blog, and social media, and never engage or show activity on those accounts again. While Reddit remains popular for Secondary Infektion trolls posting in several languages, the trolls tend to stick to a handful of dumping grounds that vary depending on the audience and language used.
In Ukraine, Secondary Infektion has tried to pit nationalists in Ukraine and Poland against each other in an attempt to isolate Kyiv from an increasingly important diplomatic and military ally. In articles posted in both Russian and Ukrainian in November 2021, Secondary Infektion trolls shared links to a Facebook post with a fake story that members of Poland’s far-right National Radical Camp had raped and murdered a 51-year-old Ukrainian woman as part of an initiation ritual for new members in the group.
The post was published by a Facebook page created in 2018 which purported to be a patriotic Ukrainian, pro-military group dedicated to offering “respect for the defenders of Ukraine.” The group, run out of Indonesia, according to a transparency blurb on the page, posted only occasional anodyne patriotic content for years until stepping out of character in November with screenshots of a purported text message relaying the rape story.
Meta officials quickly suspended the page after The Daily Beast brought it to their attention, and cybersecurity officials at the company assess with moderate confidence that the page was linked to Secondary Infektion, according to a Meta spokesperson.
When not trying to inflame relations between Ukraine and specific countries, sock puppets using Secondary Infektion-like tactics have also tried to use LGBT rights as a wedge issue to discredit it in the eyes of the West. An October 2021 post forged a letter from a Ukrainain gay rights group, LGBT Association LiGa, protesting a proposed tax on childlessness as discriminatory towards gay couples, who cannot legally adopt children or marry in Ukraine.
In a statement published to Facebook, LiGa officials confirmed that the story “this letter was printed on a letterhead that does not belong to LiGa and has incorrect contact details of our organization and a faked logo,” complete with an fake signature from the group’s chairperson, Oleg Alyokhin.
As Russia has conducted a nearly unprecedented mobilization of troops and weapons along the Ukrainian border over the past three months, Secondary Infektion-like trolls have slowly turned their attention to the brewing crisis with stories aimed at undermining Kyiv’s response.
One post, published to Reddit and Ukrainian blogs in early February, shared a phony leaked map purporting to show a “buffer zone” to be occupied by Polish troops in a secret agreement with the Zelensky administration to defend against Russia. The fake story, which warned that “large-scale territory will be separated from Ukraine for years,” appears to be an attempt to try and thwart the growing military cooperation between the countries as Russian threats have piled up.
Relations with Germany, which has proved cool to the Ukrainian government’s requests for arms as Russia's border buildup continues, have also been a frequent target for posts using Secondary Infektion’s methodology.
In an ironic turn, one post published last week spun a fake story leaked by a fictitious insider in the Ukrainian government leaking details of a U.S., U.K., and Ukrainian intelligence-run troll factory spreading anti-German memes on social media to discredit Berlin’s less than enthusiastic support of Ukraine amidst threats of renewed Russian aggression.
It’s still unclear whether Russia plans to invade Ukraine or use a phony pretext video as U.S. intelligence has warned. But Secondary Infektion’s inability to get traction for its various fakes and forgeries suggests that if Moscow does go ahead with a propaganda blitz, it’s like to face an audience with a healthy skepticism towards Russian-accented provocation.
