Fraud Management & Cybercrime
,
Geo-Specific
,
Social Media
GenAI Is Accelerating Propaganda, Planning and Content Creation
Russian hackers have shifted focus from Ukraine to influence operations across the European Union and NATO countries, new research found.
Russia’s war-related hacking continues but the Kremlin has turned up the volume of disinformation intended to undermine Western primacy with the intent of asserting dominance abroad and keeping regime stability at home, Google’s Threat Intelligence Group said in a blog.
Recent pro-Russian information operations show an evolution in tactics, notably the growing use of cost-effective generative artificial intelligence tools for planning, research and content creation.
“As Russia seeks to reemerge from international isolation, we have increasingly observed a concurrent focus on pre-war pro-Russia influence objectives,” Google wrote.
Russia has long targeted the United States and Europe with messages meant to weaken transatlantic unity. Moscow also seeks to shape opinion in former Soviet states and build support for Russian initiatives in the Middle East and Africa.
For years, Russian state media outlets such as RT and Sputnik served as major vehicles for those influence efforts, but sanctions and distribution restrictions imposed by the U.S., the European Union and other countries following Russia’s election interference campaigns and invasion of Ukraine have significantly curtailed their international reach.
Looking for a different route, Russia is betting on networks of covert operators, proxy organizations and cyber-enabled campaigns to reach foreign audiences.
Threat actors have also impersonated legitimate news organizations by copying established media brands or creating convincing fake outlets to lend credibility to their propaganda.
“The current and historical targeting scope of each ecosystem component exposes both the Kremlin’s global ambitions and the realistic limitations of its power projection,” Google said.
The war against Ukraine has become a testing ground for Russia to refine influence tactics, including its use of AI. Google said large language models, primarily Gemini, has been used to build obfuscation infrastructure, generate decoy malware code to evade detection and automate content creation.
In the Russia-aligned influence campaign known as Operation Overload, AI was used to produce synthetic images, videos and deepfakes at scale, easily making fabricated narratives appear credible.
At the same time, such operations increasingly coincide with cyberattacks, Google said. Actors have paired wiper malware designed to permanently destroy, overwrite or corrupt data with website defacements carrying false surrender messages. They have also published stolen – sometimes manipulated – data through fake online personas.
Pro-Russia hacktivism has “evolved into an important component of the influence ecosystem that blends state-backed actors leveraging hacktivist tactics with an evolving cohort of likely third-party hacktivist actors that support Russia’s geopolitical interests.”
“While custom tool development facilitates operators in all phases of the IO lifecycle, Russian government actors can flexibly leverage different models for outsourcing campaign execution based on their specific needs,” Google wrote. “Proxy actors can also generate plausible deniability.”
One example is the self-proclaimed hacktivist group NoName057(16), which has presented itself as grassroots activism since 2022. Working alongside other Russian groups such as Killnet, it launched denial-of-service attacks on government, media and private sector websites in Ukraine, NATO member states and other Western countries for their support of Ukraine.
Threat actors in this ecosystem collaborate and use their unique toolkits to help each other out. Cyberespionage group Gamaredon offered its malware downloader to fellow Russian state-sponsored actor Turla last year in a collaboration to help Turla deploy its backdoor and maintain footholds (see: Russia’s Gamaredon Adapts Tactics to Target Ukraine).
“Through these levers, the Kremlin fosters the cross-component links that underpin the ecosystem, enhancing its overall utility as a versatile tool of state influence,” Google said.