Russia-connected group pushed fake documents aimed at political flashpoints, researchers say

The report comes as election security experts remain on alert for efforts to manipulate the 2020 election from Russia and many other countries and nonstate actors.

On the internet, a letter from Sen. Ben Cardin, D-Md., dated July 13, 2019, looks legitimate. It has a U.S. Senate letterhead, Cardin’s signature and even a small “Printed on Recycled Paper” at the bottom.

But it is fake. Cardin never sent the letter, which attempts to portray him as making an exaggerated case for Russian opposition candidate Alexei Navalny to Sen. Bob Menendez, D-N.J.

It’s one of a handful of fake government documents that have circulated on the internet in recent months. One purports to be from a U.S. admiral, while another tries to float the idea that Secretary of State Mike Pompeo recognized the Armenian Genocide and blamed Turkey — something Pompeo has been careful not to do.

The letters were released Wednesday by the cybersecurity firm Recorded Future, which analyzed the documents and found what its researchers say is an organized, targeted effort with connections to Russia aimed at influencing geopolitical discourse. It’s the kind of operation that could be deployed for the 2020 election.

The report builds on previous analysis of an ongoing online disinformation campaign dubbed “Secondary Infektion,” which promotes documents, often forged, that appear created to strain tensions in international relations, particularly between former Soviet bloc countries and the West. The group was first discovered late last year, but it had previously not been linked to forging official U.S. correspondence.

The researchers said that they were able to establish a clear pattern by the group. Someone creates a blog post with a fake account to write a political screed, often embedding an unreleased or “leaked” political document in the post. Then, another single-use account will promote it on another tech platform. Most posts support overt Russian foreign policy goals, and have appeared in multiple languages.

The strategy makes it difficult to trace documents back to their original posting.

“These are all techniques that individually are not unique or effective, but when you put them all together, they become a signature for behavior,” said Priscilla Moriuchi, head of nation-state researchat Recorded Future, who wrote the study.

‘Bad tradecraft’
The materials uncovered by Recorded Future primarily focus on undermining the country of Georgia’s relationship with NATO, and Estonia’s with the European Union, echoing Russia’s aims for each.

But the researchers also found six documents that purport to be official correspondence with senior U.S. government figures. All contain strange grammatical errors that Recorded Future found are consistent with native Russian speakers.

The report comes as election security experts remain on alert for efforts to manipulate the 2020 election from Russia and many other countries and nonstate actors.

A spokesperson for the Office of the Director of National Intelligence declined to comment on the report, but pointed to past comments by the agency. In its last public intelligence report, the office warned that Russia would likely attempt to influence the 2020 U.S. election. In her most recent public comments, Shelby Pierson, ODNI’s top dedicated election security official, said that “malign influence campaigns” are “on the rise.”