“The French authorities have uncovered the existence of a digital campaign to manipulate information against France involving Russian actors and in which State entities or entities affiliated to the Russian State have participated by amplifying false information. This campaign is based in particular on the creation of false web pages usurping the identity of national media and government sites, as well as on the creation of false accounts on social networks,” French Foreign Minister Catherine Colonna said in a statement.
Her statement, read out at a briefing on 13 June by Foreign Ministry spokeswoman Anne-Claire Legendre, said that Paris was “working closely” with its allies “to put an end to the hybrid war waged by Russia”.
According to a report published by the French Foreign Ministry, the campaign targeted the websites of several French national publications, as well as the website of the Ministry of Foreign Affairs and other government portals, by creating mirror pages.
“The involvement of Russian embassies and cultural centres, which have been actively involved in the expansion of this campaign, in particular through their institutional social media accounts, is a new illustration of the hybrid strategy that Russia is implementing to undermine the conditions for calm democratic debate and thus undermine our democratic institutions,” the Foreign Ministry said in a statement.
The disinformation operation called Doppelgänger (in European folklore, Doppelgänger is an evil double of a person, the dark side of a personality) was already documented in 2022, in particular by the European organisation EUDisinfoLab and the American giant Meta.
Its “second phase” is now underway, “but with more sophisticated modus operandi aimed at circumventing countermeasures and being less visible,” a source in French security structures told Agence France-Presse, RFI reported.
At the end of September 2022, Meta announced that it had succeeded in stopping a “covert influence” operation and manipulation of information on the Facebook platform, which was conducted from within Russia.
The operation was carried out by two Russian marketing consulting firms that promoted articles published on pirated websites on social media. The two companies spent about $105,000 on this.
At least four daily newspapers in France have now fallen victim to the Russian operation: Le Parisien, Le Figaro, Le Monde and 20 Minutes.
From a technical point of view, this involves creating (publishing) fake articles on pages identical in visual appearance and parameters to the official websites of popular media outlets but with a different domain name (for example, with the .ltd extension instead of .fr).
This type of cyber fraud is called “time squatting”.
The fraud is often aggravated by the fact that such fake publications contain hyperlinks to genuine articles from the “pirated” media. These fake materials are then distributed via social media to increase their “virality”.
The Russian disinformation campaign in France was uncovered during investigations conducted by VIGINUM, a special service created in 2021 by the French government to detect and combat attempts at foreign interference in the digital sphere.
“This information manipulation campaign, which VIGINUM has been monitoring for more than a year, is aimed at discrediting Western support for Ukraine,” the French intelligence service said in its conclusions.
According to VIGINUM, the campaign disseminated “pro-Russian content related to the war in Ukraine” that “defames Ukrainian leaders”. The attackers also “exploited” France’s domestic news agenda by spreading content that exacerbated political and social controversy.
VIGINUM identifies four main themes in the narratives of these fake publications:
- Ineffectiveness of sanctions against Russia, which will primarily burden EU states and/or their citizens;
- Russophobia of Western states;
- “Barbarism of the Ukrainian armed forces” and the neo-Nazi ideology that “prevails” among the Ukrainian leadership;
- “Negative consequences” for European countries of accepting Ukrainian refugees.
The French service VIGINUM reports that it has identified 355 domain names used in the Russian disinformation campaign.
Since the end of May 2023, this cyber operation has reached a new level; as the report notes, the attackers have begun posting materials imitating the publications of the French Ministry of Foreign Affairs.
“We have identified dozens of domain names purchased by Russians. We are not dealing with people who act in a single point, in “homoeopathic doses”; they are already close to industrial scale. At the same time, we are still determining their ultimate goal. Is it micro-targeting certain population groups? Or is it an ongoing, low-intensity campaign? Or is it being prepared for mass action at some point?” a security source commented to the France-Presse news agency.
He said the operation “was very well coordinated and structured”.
The initial platform of the operation is called RRN, after the name of the pro-Russian website RRN.world, Reliable Recent News (formerly called Reliable Russian News), a website created a few months after the start of the Russian war against Ukraine, which published many fakes, including the so-called “staged” massacre in Bucha.
In addition to tipping, the platform distributed caricatures of Zelenskyy or published pro-Russian discourse and fakes through specific so-called “re-information” sites.
The Agence France-Presse notes that, in addition to the French publications Le Parisien, Le Figaro, Le Monde and 20 Minutes,
The Russian cyber campaign of disinformation has affected the German Frankfurter Allgemeine Zeitung, Der Spiegel, Bild and Die Welt, as well as several Italian media outlets.
This operation is part of Russia’s long-standing and documented practice of influencing public opinion, the French Foreign Ministry said in a report.
Since the invasion of Ukraine, Moscow has relied on fake news to undermine public support for Ukrainians in the West.
Putin is “waiting for Western societies to get tired,” one European official said, reminding that with Russian energy supplies to Europe cut off, “last winter was mild,” but “if the next one is hard” and heating prices soar, it could “cause tensions in society.”