Russia-aligned hackers running anti-Nato fake news campaign – report

‘Ghostwriter’ campaign said to involve replacing true stories with false ones on news sites in Poland and Lithuania

Hackers “aligned with Russian security interests” have been engaged in a sustained campaign to compromise news websites in Poland and Lithuania to plant false stories aimed at discrediting Nato, according to a new report.

Part of the campaign – labelled “Ghostwriter” – involved gaining access to news sites publishing systems, deleting stories and replacing them with false news that sought to delegitimise the transatlantic alliance.

In one example, a Lithuanian news site was compromised last September and a false article was inserted into its archive wrongly claiming that German soldiers serving with Nato had desecrated a Jewish cemetery.

In May this year, a series of Polish sites were targeted and stories published with fake quotes attributed to the commander of the US army in Europe, in which he was said to have ridiculed the capability of the Polish military.

Emails purporting to be from a local news service with links to the doctored articles were then sent out to other media and public institutions in an attempt to disseminate the fakes and give them further credibility.

Lithuanian sites were targeted again in January, with a false story that the first Covid-19 case in the Baltic country came from a US officer, part of the standing deployment to protect the country from Russian incursion.

Researchers at Mandiant, a specialist cybersecurity firm, have pieced together what had been reported as 14 isolated incidents and argue that they are part of a broader anti-Nato campaign that has been since running since at least March 2017.

The attribution of hacking attacks is notoriously difficult, but the research firm said it was evident that the arguments made were “aligned with Russian security interests”, and that given that none of the culprits had been immediately detected, it would imply that “the actors behind the campaign are relatively well resourced”.

John Hultquist, senior director of intelligence analysis at Mandiant, said: “The method of hacking media sites to push fabricated narratives is a powerful one,” and added that he expected it to recur in Europe and the US “as a means to alter perception there”.

Faking news stories was part of a wider disinformation operation that also included articles being published on websites accepting user-generated content pushing the same anti-Nato narratives. Several pieces were authored by a “Rod Renny” and often appeared on the pro-Russian site the Duran in English.

There was one instance of a non-news site being targeted. This April a fabricated letter appeared on the website of the Polish War Studies Academy, supposedly written by its commander, and calling for Polish troops to fight against “American occupation” – an apparent reference to the Nato exercise Defender Europe 20.

Also in April, an email saying Nato was going to withdraw troops from Lithuania because of the coronavirus crisis was sent to media organisations, based on a faked letter supposedly sent by the secretary general, Jens Stoltenberg, to the country’s defence minister.

Nato said it could not comment on the research, but that it was aware it was the target of disinformation. The military organisation has been careful about blaming Russia, saying only that it was targeted by “a number of specific disinformation attacks” in a briefing published this month.

It instead made some more familiar accusations, blaming Russia’s international media – Russia Today and Sputnik – for spreading news stories that blend “true and false elements, which bypass people’s natural filters for detecting disinformation”, and Russian actors for using false social media accounts to spread lies online.


Dan Sabbagh Defence and security editor

The GuardianTramp

Related Content

Article image
German spy chief says Russian hackers could disrupt elections
Cyber-attacks aim to delegitimise democratic process and elicit political uncertainty, says Bruno Kahl

Kate Connolly in Berlin

29, Nov, 2016 @3:34 PM

Article image
Russian hackers suspected of Kremlin ties used Windows bug ‘to spy on west’
Cyber-threat intelligence firm iSight says ‘Sandworm Team’ used unknown bugs from 2009 to steal EU and Nato documents

Alec Luhn in Moscow

14, Oct, 2014 @5:41 PM

Article image
‘Trident is old technology’: the brave new world of cyber warfare
Forget debates about Britain’s nuclear deterrent. New technology means a country can be brought to its knees with the click of a mouse

Julian Borger

16, Jan, 2016 @8:00 AM

Article image
Russia accuses cybersecurity experts of treasonous links to CIA
Rumours swirl of connection to revelations about US election hacking, as state media says Sergei Mikhailov and Dmitry Dokuchayev ‘betrayed their oath’

Shaun Walker in Moscow

31, Jan, 2017 @11:19 PM

Article image
Nato must defend western democracy against Russian hacking, say Fallon
UK defence secretary accuses Moscow of ‘weaponising misinformation’ to disable democratic machinery

Ewen MacAskill Defence correspondent

03, Feb, 2017 @8:12 AM

Article image
EU to run war games to prepare for Russian and Chinese cyber-attacks
Ministers to be put in fictional scenarios after series of hacking incidents

Daniel Boffey in Helsinki

27, Jun, 2019 @12:48 PM

Article image
Malicious forces creating 'perfect storm' of coronavirus disinformation
Russia and China among state and other actors spreading fake news and disruption, say experts

Peter Beaumont, Julian Borger and Daniel Boffey

24, Apr, 2020 @12:30 PM

Article image
EU raises funds to fight 'disinformation war' with Russia
European commission to help member states recognise work of Kremlin ‘troll factories’

Daniel Boffey in Brussels

05, Dec, 2018 @2:51 PM

Article image
WikiLeaks' Nato revelations cause 'bewilderment' in Russia

US embassy cables show Nato had drawn up plans to defend Poland and Baltic states against Russian attack

Tom Parfitt in Moscow

07, Dec, 2010 @2:36 PM

Article image
Nato and Kremlin in war of words over Russian missile deployment
Putin spokesman says Kaliningrad move is merely defending Russia’s security after Nato accuses it of ‘military posturing’

Shaun Walker in Moscow

22, Nov, 2016 @6:21 PM