Suspected Russian operatives tried to stir far-right outrage about COVID-19 on 4chan

Members of the same operation posed as members of the Anonymous hacking collective.
Russian propaganda
One of the news agencies behind the Facebook activity, News Front, is funded by Russia’s Federal Security Service. (Getty Images)

Operators of an apparent Russian propaganda campaign shared coronavirus disinformation in an effort to influence the American far-right, according to a report out Tuesday by cybersecurity firm Recorded Future. 

The findings are included in a new report shedding light on a long-running Russian propaganda campaign known as Operation Secondary Infektion. The years-long campaign has used regional European websites, forged documents and throwaway accounts to further Russia’s political agenda in Europe.

Secondary Infektion is perhaps best known for spreading disinformation through small, local websites, then promoting fabricated narratives on social media, with mixed success.

Secondary Infektion promotes narratives in line with Russia’s political agenda in Europe, leading researchers to believe the group supports Russia’s intelligence apparatus. Since 2014 the group has staged a number of campaigns, including using fake tweets from accounts like Sen. Marco Rubio, R-Fla. to spread a false narrative that British citizens planned to assassinate Prime Minister Boris Johnson.


Researchers say the effort remains active and that operators continue to spread virus-themed disinformation and anti-western sentiment, though they have generated less engagement in recent months.

The latest case highlighted by Recorded Future sought to create a narrative that some Americans had blamed the Muslim community for COVID-19.

Researchers found an article on a Russian self-publishing site titled, “The American Ultra-Right Accuse Muslims of Making Pleas to Spread Coronavirus.” The article referred to a thread on 4chan that appears to encourage Muslims to spread the virus in Western countries. One reply to the post suggests taking violent actions against Muslims.

Investigators then traced the screenshot to a real post on 4chan, an anonymous online forum associated with extremist and violent content. Articles about the post had spread on sources normally included in Secondary Infektion operations shortly after its publication, suggesting that an operative had posted it. Researchers now say that, based on the translation errors in an embedded picture, it is likely a forgery.

The dual motive of trying to stir discontent on the American right, as well as Secondary Infektion’s longstanding objective to paint the U.S. in a negative light represents a divergence from the group’s normal playbook.


“The concerning thing is that influence actors we believe are associated with Secondary Infektion demonstrated that they can be on platforms that have associations with violence and domestic extremism,” said Brian Liston, lead analyst on the report. “Whether or not that they help motivate or drive that behavior in other cases that we have not identified…remains to be seen.”

Unlike Reddit and other social media platforms that have grown more adept at spotting Russian intelligence behavior, 4chan is virtually unmoderated, making it a perfect target.

Operation Secondary Infektion is relatively small and unsophisticated compared to the success and scale of other Russian operations like the GRU’s Internet Research Agency campaign that sowed discord in the 2016 election and reached millions of Americans.

While Secondary Infektion’s strategy has largely stayed the same over the years, the Recorded Future report also identified two new cases where operators of the group used online personas more than once. In one case, actors imitated a branch of the Anonymous collective. Traditionally Secondary Infektion is thought to only use single-use personas.

The report also ties Secondary Infektion to another Russian propaganda campaign, dubbed Ghostwriter, which was discovered by researchers at FireEye. That group also amplified anti-Western narratives in Eastern Europe and spread COVID-19 information through local news sites.


Liston says that Secondary Infektion’s activity remains ongoing. While he could not speak in detail about the more recent campaigns, Liston says that they have focused on the same themes of using forgeries to spread disinformation about the coronavirus and regional politics.

Tonya Riley

Written by Tonya Riley

Tonya Riley covers privacy, surveillance and cryptocurrency for CyberScoop News. She previously wrote the Cybersecurity 202 newsletter for The Washington Post and before that worked as a fellow at Mother Jones magazine. Her work has appeared in Wired, CNBC, Esquire and other outlets. She received a BA in history from Brown University. You can reach Tonya with sensitive tips on Signal at 202-643-0931. PR pitches to Signal will be ignored and should be sent via email.

Latest Podcasts