Pro-Kremlin propaganda targets TNA sister publication Misbar, other MENA fact-checkers

In the aftermath of the Russian invasion of Ukraine on 24 February 2022, pro-Kremlin disinformation networks intensified their online influence campaigns, in an attempt to sabotage Ukraine’s war effort.

These campaigns, which started with the Russian annexation of Crimea in 2014, and the subsequent war in Eastern Ukraine, have continued to evolve ever since.

A recent iteration of these operations, dubbed Matryoshka, is now specifically targeting news outlets that debunk false news about Ukraine.

Caught in the crosshairs, however, are multiple MENA-focused outlets with limited reporting about Ukraine. Among these outlets are the English version of The New Arab’s sister fact-checking publication Misbar, as well as the Persian-speaking Iran-focused fact-checker FactNameh.

The New Arab (TNA) Investigative Unit identified two instances in which the campaign succeeded in its aim of disrupting the work of these fact-checking outlets.

Other MENA-based fact-checking websites were targeted, such as  Sudanese BeamReports and Syrian Verify-Sy, TNA can reveal based on information we obtained from the pro-Russian opposition group Antibot4navalny.

Disinformation experts we spoke with agree that this manipulation of “the good faith efforts of the fact-checking community” will have a negative impact on their ability to perform their watchdog role, especially as the world enters the biggest election year in history.

Roughly half the world’s population will go to the polls in 2024. Pro-Russia influence campaigns increase during election years.

What is Matryoshka?

The anonymous volunteer group Antibot4navalny, which tracks Russia-related influence operations on X (formerly known as Twitter), was first to reveal the Matryoshka campaign.

The campaign uses a network of accounts that display features of inauthentic behaviour. 

‘Inauthentic accounts’ attempt to mislead people about their identity or the origin of the entity they represent. 

It is not clear how the accounts used in the campaign were acquired. One of these accounts has previously been listed in an online marketplace for compromised accounts.

None of the accounts seem to behave in bot-like fashion, and are most likely operated by humans.

According to Antibot4navalny, the campaign started on 5 September 2023 when one of these inauthentic accounts posted on X a video of a fake BBC news clip in response to Hulu, the US subscription streaming service.

The video alleged that Hulu succumbed to pressure from the US Department of Homeland Security and cancelled a documentary series that intended to tackle the topic of “drug-using politicians”.

According to the clip, the first episode of the series was intended to focus on Ukrainian President Volodymyr Zelensky.

To seem more legitimate, the fake clip used BBC’s news videos branding, as well as the logo of US news channel Fox News.

Other accounts from the same campaign used similar tactics to appear genuine.

Some accounts shared screenshots of news pieces from legitimate news sites, while others used branding from other known TV channels, such as French channel Canal+.

US nonprofit News Literacy Project calls this type of fake news "imposter content", since it aims to “launder faulty ideas through a credible source”.

The Matryoshka campaign takes a different approach.

Instead of sharing the fake news pieces themselves, accounts re-share posts from other accounts in the same network, and post them directly on the feeds of known fact-checking outlets. These “reshares” are formulated as a fact-checking request.

The accounts simulate the behaviour of a typical social media user, who might be sceptical of a piece of news, and would like the opinion of a trusted fact-checking source.

However, this process of resharing is repeated by other accounts in the network, ad nauseam. The “stacking” of posts containing false news reports is akin to how Matryoshka dolls operate, which is where the campaign gets its name from.

The campaign has targeted more than 500 accounts on X so far, according to Antibot4navalny, although that number is most likely an undercount.

Among the most targeted outlets are Germany’s state-owned international broadcaster Deutsche Welle and non-profit investigative outlet Correctiv.

Accounts of official governmental organisations have also been targeted. These include the accounts of Ukraine’s Center for Countering Disinformation and of the head of the European Parliament Spokesperson’s Unit, which tackles disinformation.

Disrupting the work of fact-checkers

TNA has identified two instances in which the campaign succeeded in achieving its aim of disrupting the work of fact-checkers.

In one instance, an account asked the English-language account of Misbar to verify the authenticity of a Banksy graffiti in Paris. It depicted a baby Zelensky sitting on the lap of German Nazi politician Joseph Goebbels.

Misbar did comply with the request, and came back two weeks later with a complete debunking of the alleged graffiti.

Dr. Ouissal Harize, senior editor at Misbar English told TNA that “Misbar might have been targeted by this campaign because of our extensive work covering the war on Ukraine and the misinformation related to it.”

“We do not believe our work was affected in any way; the X account was one of many that tag us to draw our attention to suspicious news they want to fact-check,” she added.

According to data collected by Antibot4navalny between 5 September 2023 and 18 January 2024, the account of Misbar English on X received 13 separate disingenuous verification requests from 14 different accounts. TNA independently verified these statistics.

TNA also identified three instances in which Misbar said that it would look into the verification request.

All of the requests were related to the war in Ukraine or some of its ramifications. Misbar was among the top 50 most targeted fact-checkers by the campaign.

In a separate instance, an account from the Matryoshka network posted a fabricated video allegedly produced by BR24, part of German public broadcaster Bayerischer Rundfunk.

BR24 replied to the ‘inauthentic account' with an article it had produced, in which it had denied releasing the video in question. The German broadcaster showed instead how the clip was linked to pro-Russian disinformation accounts.

TNA contacted the fact-checking team at BR24 to inquire about this instance, and the potential impact the campaign could have on their work.

Janina Lückoff, editor and head of the fact checker team at BR24, said: “Of course, dealing with fake media content ties up our capacity. Before doing a fact-check, we consider what might be the goal of this particular claim/narrative. Ultimately, we focus on what reaches many people and has the potential to unsettle them – we believe it is important to inform the public about this.”

"Disinformation experts agree that this manipulation of 'the good faith efforts of the fact-checking community' will have a negative impact on their ability to perform their watchdog role, especially as the world enters the biggest election year in history."

This is not the first time pro-Kremlin groups weaponised disinformation against the practice of fact-checking.

The Digital Forensics Research Lab (DFRLab), part of US think tank The Atlantic Council, showed in May 2022 how “Kremlin and Kremlin-aligned [social media] accounts are co-opting fact checking tropes to spread disinformation” about the Russian invasion of Ukraine.

Layla Mashkoor, deputy managing editor at DFRLab, explained to TNA how the Matryoshka campaign could be part of this co-opting strategy.

“We know that pro-Kremlin actors try to distort the truth, but this campaign exemplifies how they also seek to distract from the truth. Distracting fact-checkers with red herrings impacts their ability to do their actual work of promoting facts and evidence,” said Mashkoor.

Links to previous Kremlin operations

The Matryoshka campaign seems to build off an earlier pro-Kremlin influence operation called Doppelgänger, which has been reportedly linked to Russia’s GRU military spy agency.

US company Meta, which owns Facebook, has described Doppelgänger as the “largest and the most aggressively-persistent Russian-origin [influence] operation” it has tried to take down since 2017.

The Council of the European Union imposed sanctions on seven Russian individuals and five entities reportedly behind the operation in July 2023. 

According to the Council, the campaign is aimed at “distorting information and disseminating propaganda in support of Russia’s war of aggression against Ukraine”.

After the European Parliament (EP) passed a resolution on the allegations of Russian interference in the EU elections on 8 February 2024, Russian Foreign Ministry Spokeswoman Maria Zakharova denied the allegations, calling them “absurd”.

Answering a media question on the resolution, Zakharova said that “the EP has invented a true ‘manifesto of neo-liberal dictatorship’”.

According to her, the resolution is part of “endless far-fetched speculations about Russia’s influence, spy hysteria, and other Russophobic paranoid trash”.

Qurium Media Foundation, a Swedish non-profit dedicated to the defence of digital rights and internet security, has also been tracking the Matryoshka campaign. We asked Tord Lundström, digital forensic engineer at Qurium, whether it was an evolution of the more subversive Doppelgänger influence operation.

“We believe this is an evolution of their current strategy that now focuses on harassing fact checkers that are somehow compelled to verify these fake news [...] [which results] in an amplification of their narratives,” Lundström told TNA.

"'Often, these are small teams of people facing a tremendous quantity of claims to parse through, so efforts to distract these vital sources of information could have a detrimental effect on the online information space,' said Layla Mashkoor, deputy managing editor at DFRLab."

"We are aware that the group has compiled a large list of ‘fact checker’ organizations, likely mining the info in [their X] profiles," said Lundström.

Speaking to TNA over messaging service Signal, the anonymous group Antibot4navalny stated that the operators behind this network are just getting started.

Based on the “very low volume of posting and gained reach” as well as the “extremely high variability” in how the accounts in the network operate, the group believes that the operators “are comparing what works and what doesn't”.

The group shared the example of an X post in response to Donald Trump Jr., the son of former US President Donald Trump. According to Antibot4navalny, this was an attempt by the campaign operators to figure out “what categories of users/accounts are more likely to engage”.

What’s next?

The year 2024 will see 83 national elections in some 78 countries around the world, including in the United States, the United Kingdom, Russia and Ukraine, according to the US think tank The Atlantic Council.

TNA asked Layla Mashkoor from DFRLab what impact the Matryoshka campaign could have in this so-called “super-election” year, once it ramps up its efforts.

“Fact-checkers are one of the key pillars in upholding fact-based information online. We know elections often trigger an increase in disinformation, and fact-checkers are key in countering those falsehoods,” she said.

"Often, these are small teams of people facing a tremendous quantity of claims to parse through, so efforts to distract these vital sources of information could have a detrimental effect on the online information space,” added Mashkoor.

"Janina Lückoff, editor and head of the fact checker team at BR24, said: 'Of course, dealing with fake media content ties up our capacity. Before doing a fact-check, we consider what might be the goal of this particular claim/narrative. Ultimately, we focus on what reaches many people and has the potential to unsettle them – we believe it is important to inform the public about this.'"

The work of these fact-checking outlets was made harder in July 2023, after X put in place measures that restrict researchers' ability to discern sources of disinformation on the platform.

Tord Lundström, the digital forensic engineer at Qurium, would like to see more effort being put into preventing operations like Matryoshka from reaching their full potential.

“We reported Doppelganger [for the] first time in September 2022 and we believe that it is time to make accountable those that provide infrastructure to these types of activities,” he told TNA.

On 18 December 2023, the EU Commission opened formal proceedings against X to assess “the effectiveness of measures taken to combat information manipulation on the platform”.

February 16 correction: this piece linked to a screenshot of a story published on the French newspaper La Montagne, suggesting it was a fake news site. The piece was corrected to say that La Montagne is a legitimate news site.