Russian disinformation networks ramp up attacks on European elections

“Olena Zelenska has become the first owner of the brand new Bugatti Turbillon,” reads the headline in French, above a picture of Ukraine’s first lady with her arm around her French counterpart, cut together with a picture of a sportscar.

The article looks real enough, though petrolheads may note the misspelling of Tourbillon. It even cites as evidence a video recorded by a dealership employee describing the supposed sale, and a picture of a Bugatti invoice for €4.5m made out to Mrs Olena Zelenska. If you were under any doubt, the site’s name should lay your fears to rest: Verite Cachee or, in English, hidden truth.

In fact, the video is a deepfake, the invoice is falsified and the entire site is part of a Kremlin-linked influence operation, using AI-generated content to deliver a payload of Russian talking points. The false attack on Zelenska was designed, it seems, to hint at corruption.

Veritecachee.fr is one of two sites set up less than two weeks after the French president Emmanuel Macron announced a surprise election, the other called France en Colere (Angry France). The Bureau of Investigative Journalism (TBIJ) and the Tow Center have connected both to a network of websites linked to John Dougan, an American former police officer now living in Moscow and known for spreading Kremlin-backed disinformation. This network was first identified by researchers at Clemson University in December last year.

Even as this Dougan-affiliated network has targeted the French election, another Russia-linked disinformation operation, unmasked by French authorities earlier this year, has ramped up its activity in Europe. In June, the “Portal Kombat” network launched 10 new sites, mostly aimed at Europe. Another five targeting Eastern Europe were set up in April and May.

Portal Kombat began launching a network of disinformation sites within weeks of Russia’s invasion of Ukraine in 2022: about 40 are focused on Ukraine with names like kherson-news.ru and news-kharkov.ru, while about 50 “pravda” websites cater to different countries and languages with names like “pravda-fr.press,” “pravda-uk.online,” and “news-estonia.com.”

In the ongoing war, Ukraine has relied heavily on NATO countries for military and financial aid to hold off Russia’s advances. To undercut the largely unified western alliance support of Ukraine, the Kremlin has continued to promote narratives that malign President Zelensky as well as leaders supporting Kyiv aiming to influence electoral outcomes in Russia’s favour.

For example, a debunked story with the headline “Emmanuel Macron’s Party to Pay €100 to all who vote for his party in the French elections” published on France en Colere, linked to a newly created website impersonating Ensemble, Macron’s coalition. This website contained details about the candidates alongside details about the “Macron bonus.” This was picked up by at least six of the pravda sites citing Telegram channels as sources. Forensics analysis conducted by researchers at DFRLab on the impersonated website pointed to Russian footprints.

Overall, TBIJ found twelve stories about the “Macron bonus” in this network, and just under thirty stories about Zelenska’s Bugatti.

TBIJ was able to identify the sites across both networks by analysing domain data for shared characteristics, such as IP addresses, WHOIS records, and which servers are used to connect domain names.

Another six sites – five British, one French – linked to Dougan’s network are now inactive. The sites, which were previously identified by Recorded Future, were created in the run up to the elections this week; of the British sites, three were set up days after heavy byelection defeats for the government in February, one in late March when speculation about an election was rife and another at the end of May, little more than a week after the election was called.

Dougan has given contradictory statements to the BBC, both denying his involvement with the network and seeming to brag about his ability to spread misinformation.

Via text, Dougan described himself as a “simple web host” and claimed that another pro-Kremlin online figure, Mike Jones, owned several of the domains. Dougan provided a screenshot of a conversation allegedly with Jones – a UK citizen who lives in Moscow – about three of the UK-focused sites.

“Funny how he’s relishing in me getting such bad publicity after I kept his name out of everything,” wrote Dougan.

When pressed about the two active French sites, and the wider network that has been attributed to him, he denied knowing anything further.

Dougan and Jones have both made numerous appearances on Russian state-controlled media — be it propaganda outlet RT or the Russian Ministry of Defence’s TV Zvezda — either in support of the Kremlin or promoting anti-western and anti-Ukrainian rhetoric. In a video Dougan uploaded in May to Rumble, a video platform favoured by the online right and conspiracy theorists, Jones refers to Dougan as a “good friend.” However, when asked, Dougan said he did not have contact details for Jones.

TBIJ and the Tow Center’s analysis suggests that Jones may have some link to three of the UK-focused sites, based on domain data. Jones did not respond when TBIJ put the allegations to him via Discord and Telegram.

Darren Linvill, a professor at Clemson University, said Dougan was likely only a small part of a much bigger operation behind the network. “There is no evidence he is doing anything more than some web service. I find it highly unlikely he is drafting narratives, creating videos, coordinating with state-controlled media, or organising dissemination of messaging,” he said. “This is a highly organised endeavour that he is surely only a small part of. A part that as an American the Kremlin is all too happy for him to play.”

Portal Kombat has interacted with Dougan’s network, with over a dozen hyperlinks to stories from the two new French sites.

The speed with which these influence operations were able to respond to snap elections underscores how new technology, in particular generative AI that can churn out content, is making it easier to create misinformation outlets.

Although it is difficult to assess the full reach of the sites, the Bugatti article alone has clearly helped bolster Russia’s anti-Ukraine narratives. The faked news was written up by multiple sites, including Russian state media and a Jordanian news outlet, whose article was then syndicated by MSN, one of the most visited news sources worldwide.

Similar tactics employed by Dougan’s sites targeting UK audiences also appear to have had some success. An article on London Crier alleging that Ukraine’s President Zelensky had purchased Prince Charles’ private residence Highgrove for $20m was retweeted by the Russian embassy in South Africa, prompting a flurry of debunks. The site that ran the false article was suspended by its domain registrar on June 20.

Many of the headlines on the sites in Dougan’s network seem to be generated by AI, as evidenced by the inclusion of standard language used by systems such as ChatGPT. One read “Sure, here’s a short title for the body of the article provided Incredible violence in a French commune”. Recorded Future also identified AI prompts mistakenly included in articles.