Writing with Invisible Ink: Russia's Newest Disinformation Tactic

Dubbed 'Invisible Ink,' Alethea reports on Russia's increased sophistication in disinformation campaigns, and the network itself signals a shift in Russia's information operations objectives

In February and March 2024, Alethea identified 5,314 accounts on X (formerly Twitter) and 81 websites that we assess are seeking to divide Americans and amplify Russian propaganda—specifically counter-Ukraine messaging—ahead of the 2024 U.S. Presidential Election. Based on both the content shared and behaviors of these assets, we believe that this network is leveraged by Russia’s main military intelligence directorate, commonly known as the GRU. We assess that this activity is a continuation of a persistent Russian influence operation known as Doppelgänger, which was initially exposed in 2022. This network is using a new tactic, which Alethea dubs “Invisible Ink,” an amplification tactic. The network appears to be evading detection by researchers, security firms, and its targets by copying and pasting specific tweet URLs in lieu of retweeting or posting, requiring threat intelligence teams to know the exact tweet URL in order to ID amplification accounts.

Background: Doppelgänger is a persistent influence campaign first publicly exposed in 2022 and currently active primarily on X which promotes narratives intended to undermine support for Ukraine among the U.S. and its allies, which—based on Alethea’s findings—is likely leveraged by the GRU. It has previously been linked to Structura and Social Design Agency, two Russian entities. The campaign's main feature is the amplification of clones of legitimate news websites on social media by automated accounts, often known as “bots.” Over the course of the investigation, Alethea identified links shared by Doppelgänger assets to Observateur Continental and EuroBRICs, part of the broader InfoRos network which was sanctioned by the U.S. Department of the Treasury in 2021 due to its affiliation with the GRU. This network targets conservative voters in the United States, and, to a lesser degree, Germany and France. 

Why it Matters: The accounts in this network pose as conservative voters and amplify opposition to military aid funding to Ukraine. Past Russian information operations targeted both sides of the political spectrum to foment existing societal divisions. In this network, we assess that the operation targets more specific segments of the U.S. electorate in advance of the 2024 presidential election to promote candidates and policies favorable to Russian military objectives in Ukraine. 

Read the full report below: