Russia’s Influence Ecosystem: A Deep Dive into Tactics and Trends

Four years into the full-scale invasion of Ukraine, Russia’s influence ecosystem has evolved from a wartime tool back into a global strategic asset. New covert operations, generative AI, and a revitalized hacktivist scene are reshaping the landscape. Let’s wade into the swamp and see what’s lurking beneath the surface.

The Ecosystem at a Glance

Russia’s modern information operations build on Soviet-era ‘active measures,’ adapted for the digital age. The ecosystem blends overt state media, covert intelligence ops, and patriotic proxies into a self-sustaining machine. Its core objectives: diminish Western primacy, dominate Russia’s ‘near abroad,’ and ensure regime stability at home.

Key Targets

• US and Europe: Top adversaries, targeted to undermine political stability and NATO/EU unity.
• Near Abroad: Former Soviet states viewed as Russia’s sphere of influence.
• Middle East & Africa: Growing focus to reassert global power.
• Domestic: Suppress opposition and promote Kremlin policies.

Evolving Tactics

• Generative AI: Used for planning, research, and content creation at scale.
• Narrative Resonance: Hijacking existing societal fissures for tailored messaging.
• Cyber-Enabled IO: Combining wiper malware, hack-and-leak, and website defacements with influence campaigns.
• Media Mimicry: Impersonating legitimate news outlets to add credibility.
• Direct Dissemination: Using email, SMS, and messenger apps to bypass social media platforms.

10 Key Dynamics

Google Threat Intelligence Group distilled ten dynamics that define this ecosystem. Here are the highlights:

1. Large-Scale IO Campaigns Are Integral

Campaigns like Secondary Infektion and Operation Overload pivot to meet strategic needs, providing a persistent influence capability.

2. Persistence Over Exposure

Actors often mock public exposure and continue operations unabated, cycling domains and infrastructure to evade sanctions.

3. Cyber Espionage Meets IO

State-sponsored groups weaponize stolen data for hack-and-leak operations, as seen with UNC4057 targeting UK politics.

4. Hacktivists as Influence Agents

Groups like NoName057(16) amplify narratives and provide plausible deniability for state actors.

5. Cross-Promotion Cultivates New Assets

Established actors promote new ones, creating a self-sustaining cycle. For example, JokerDNR boosted APT44-linked Solntsepek.

6. Domestic Targeting Is Constant

Internal ops promote Kremlin policies and suppress opposition, like UNC5101 deceiving anti-Putin voters.

7. Shared Drivers, Distinct Actions

Actors coalesce around topics spontaneously, but coordination is less common than it appears.

8. Systemic Flexibility

The ecosystem can mobilize incrementally or at scale, messaging on multiple issues across geographies simultaneously.

9. Overt Media Fuels Covert Ops

State media like RT directly coordinates with covert actors and hacktivists, seeding narratives and amplifying influence.

10. Outsourcing for Scale and Deniability

Contractors like NTC Vulkan develop tooling, while proxy actors execute campaigns, providing plausible deniability.

Conclusion

The war in Ukraine provided a rapid feedback loop, driving investment in new assets and AI experimentation. As Russia reorients toward global objectives, defenders must understand this ecosystem’s durability to anticipate future threats. For more on securing your digital swamp, check out our reviews of Google Cloud and Cloudflare Workers.

Original announcement published on Google Cloud.