Suspected Russian operatives tried to stir far-right outrage about COVID-19 on 4chan

Operators of an apparent Russian propaganda campaign shared coronavirus disinformation in an effort to influence the American far-right, according to a report out Tuesday by cybersecurity firm Recorded Future. 

The findings are included in a new report shedding light on a long-running Russian propaganda campaign known as Operation Secondary Infektion. The years-long campaign has used regional European websites, forged documents and throwaway accounts to further Russia’s political agenda in Europe.

Secondary Infektion is perhaps best known for spreading disinformation through small, local websites, then promoting fabricated narratives on social media, with mixed success.

Secondary Infektion promotes narratives in line with Russia’s political agenda in Europe, leading researchers to believe the group supports Russia’s intelligence apparatus. Since 2014 the group has staged a number of campaigns, including using fake tweets from accounts like Sen. Marco Rubio, R-Fla. to spread a false narrative that British citizens planned to assassinate Prime Minister Boris Johnson.

Researchers say the effort remains active and that operators continue to spread virus-themed disinformation and anti-western sentiment, though they have generated less engagement in recent months.

The latest case highlighted by Recorded Future sought to create a narrative that some Americans had blamed the Muslim community for COVID-19.

Researchers found an article on a Russian self-publishing site titled, “The American Ultra-Right Accuse Muslims of Making Pleas to Spread Coronavirus.” The article referred to a thread on 4chan that appears to encourage Muslims to spread the virus in Western countries. One reply to the post suggests taking violent actions against Muslims.

Investigators then traced the screenshot to a real post on 4chan, an anonymous online forum associated with extremist and violent content. Articles about the post had spread on sources normally included in Secondary Infektion operations shortly after its publication, suggesting that an operative had posted it. Researchers now say that, based on the translation errors in an embedded picture, it is likely a forgery.

The dual motive of trying to stir discontent on the American right, as well as Secondary Infektion’s longstanding objective to paint the U.S. in a negative light represents a divergence from the group’s normal playbook.

“The concerning thing is that influence actors we believe are associated with Secondary Infektion demonstrated that they can be on platforms that have associations with violence and domestic extremism,” said Brian Liston, lead analyst on the report. “Whether or not that they help motivate or drive that behavior in other cases that we have not identified…remains to be seen.”

Unlike Reddit and other social media platforms that have grown more adept at spotting Russian intelligence behavior, 4chan is virtually unmoderated, making it a perfect target.

Operation Secondary Infektion is relatively small and unsophisticated compared to the success and scale of other Russian operations like the GRU’s Internet Research Agency campaign that sowed discord in the 2016 election and reached millions of Americans.

While Secondary Infektion’s strategy has largely stayed the same over the years, the Recorded Future report also identified two new cases where operators of the group used online personas more than once. In one case, actors imitated a branch of the Anonymous collective. Traditionally Secondary Infektion is thought to only use single-use personas.

The report also ties Secondary Infektion to another Russian propaganda campaign, dubbed Ghostwriter, which was discovered by researchers at FireEye. That group also amplified anti-Western narratives in Eastern Europe and spread COVID-19 information through local news sites.

Liston says that Secondary Infektion’s activity remains ongoing. While he could not speak in detail about the more recent campaigns, Liston says that they have focused on the same themes of using forgeries to spread disinformation about the coronavirus and regional politics.