THREATANALYSIS

By Insikt Group®

RUSSIA

Russian Information Operations
Aim to Divide the Western
Coalition on Ukraine

July 7, 2022

CYBER THREAT ANALYSIS | RUSSIA

Notably, many of the aforementioned narratives align with anunverified analytical note from the Fifth Service of Russia’s Federal
Security Service (FSB), reportedly intercepted and published by
the Security Service of Ukraine (SBU) on June 5, 2022. The note
discusses Russian information operations failures during Russia’s
war against Ukraine thus far, and provides recommendations
for influence efforts moving forward. The alignment of theanalytical note’s messaging with influence narratives identified
by Recorded Future supports the authenticity of the note. It
advises targeting the “European Community” with information
about the “deterioration of living standards” in the EU as a result
The following report reviews ongoing Russian influence efforts almost certainly of their support for Ukraine, proposing specific narratives such
aimed at undermining and dividing the Western defensive coalition supporting as “arming Ukraine at the expense of European taxpayers”,
Ukraine, as well as influencing public opinion of Russia’s war against Ukraine
favorably toward Russia. This report will be of most interest to government groups, “emphasizing economic hardship”, “forecasts about the number
journalists, and industry professionals seeking an understanding of current Russian of Ukrainian refugees and the created burden on the budget andinfluence narratives and objectives regarding Russia’s war against Ukraine. Thissocio-economic infrastructure”, and more. The analytical noteresearch was conducted using the Recorded Future® Platform and other open
sources. Prior to the publication of this report, Recorded Future notified and/or states that the intention of the “massive” information operation
made best efforts to notify all affected organizations of the identified activity to
is to “provoke internal public pressure on the governments andsupport incident response and remediation investigations. Where direct notification
was impossible, we notified relevant third-party organizations with a national cyber political elites of Western countries”.
security mandate.

The West’s response to Russia’s war against Ukraine, from
unprecedented economic sanctions on the Russian economy
Executive Summary
to billions of dollars in military aid, resources, and equipment
Since at least early May 2022, Russian influence networks, provided to Ukraine, has played an instrumental role in slowing
including state-controlled media, known covert intelligence Russia’s advance and likely contributed to the Russian military’s
outlets, and known propaganda and disinformation amplifiers, decision to recalculate and reconcentrate primarily on eastern
have almost certainly been conducting several multifaceted Ukraine after the initial phase of the invasion failed. The Russian
information operations to undermine and divide the Western government very likely did not anticipate a military conflict incoalition on Ukraine and influence public opinion of Russia’s Ukraine beyond 100 days, further miscalculating the impact that
war against Ukraine favorably toward Russia. These information a prolonged conflict would have on its economic and politicaloperations almost certainly aim to undermine and divide the affairs. As a result, the Kremlin is likely attempting to alleviate
Western coalition on Ukraine both directly, by creating or the impacts of international pressure on their economy andexacerbating divisions between Western coalition countries, and political affairs by attempting to divide and destabilize Western
indirectly, by influencing European populations to oppose their responses.
governments’ support of Ukraine and negative policies toward
Russia.
Based on observations from Russian influence networks,
we believe that the direct attempts to undermine and divide
the Western coalition by creating or exacerbating divisions areprimarily aimed at France, Germany, Poland, and Turkey. We haveidentified multiple influence narratives that attempt to indirectly
undermine and divide the Western coalition, including: stirring
domestic discontent toward Western political leaders; negatively
portraying Ukrainian refugees and the impacts they have on their
host countries; blaming economic, energy, and food security
concerns on Western governments for their negative policies
toward Russia; blaming Ukraine as the source of modern-day
fascist movements; and inciting distrust of Western media.

1

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA

Key Judgments• Since at least May 2022, Russian influence networks
have almost certainly been conducting several
multifaceted information operations to undermineand divide the Western coalition supporting Ukraine
in its defense against Russia, while shifting attitudesof European populations favorably toward Russia andRussia’s war against Ukraine.
• It is almost certain that these Russian information
operations are seeking to directly and indirectly
undermine and divide the Western coalition throughseveral influence narratives, such as blaming Westerncoalition governments for economic hardships their
populations are enduring, in order to influence domestic
populations to oppose their governments’ support ofUkraine and policies toward Russia.
• Many of the influence narratives identified by Recorded
Future align with an unverified analytical note (dubbed a“propaganda manual”) from the Fifth Service of the FSB
that was intercepted by Ukraine’s SBU, supporting thenote’s authenticity.
• Attempts to undermine support for Ukraine will very likely
continue through at least the end of the war, making
future political elections, individual domestic policy
issues, and other unforeseen events prime targets for
influence and narrative manipulation.

Threat Analysis

Ninth Directorate of the Fifth Service has reportedly “beenoverseeing the gathering of intelligence on Ukrainian society
to inform Russian decision-making”. On March 11, 2022, it wasreported that the head of the Fifth Service of the FSB, ColonelGeneral Sergei Beseda, was placed under house arrest alongwith his deputy. According to later reports, Beseda had been
moved to a high-security prison, reportedly for “theft of funds
allocated for subversive and undercover work in Ukraine, as well
as deliberately false information about the political situation in
Ukraine”.
The analytical note (a translated version of which can befound in Appendix A) first documents 7 “problems of informationand propaganda support of the special operation in Ukraine”
such as “insufficient evidence that a military measure was the
only possible one”, before recommending 5 changes in influence
efforts including focusing on influencing audiences in 4 areas:“inside Russia, in Ukraine, in the post-Soviet countries…[and]public opinion of Western countries”. The analytical note goeson to propose “targeted actions” for each of the 4 audiences.
For the “European Community”, the note advises:
To start a massive stuffing of information about thefacts and forecasts of the deterioration of people’s
lives in the EU, in connection with the policy of
EU governments to support nationalist groups in
Ukraine, to provoke internal public pressure on thegovernments and political elites of Western countries.
To form a negative attitude of the inhabitants ofEuropean countries to the policy of their state
toward Russia. Attention should be focused on thedeterioration of life in the EU and around the world in
the long term.

We believe that Russian influence networks are almost
certainly conducting multifaceted information operations toundermine and divide the Western coalition on Ukraine and
The note proposes 5 specific “arguments” — in other words,
influence public opinion of Russia’s war against Ukraine favorably
influencenarratives — to support the actions targeted above.
toward Russia. We identified several influence narratives insupport of these information operations by monitoring Russian These are:influence networks such as state-controlled media, known covert
intelligence outlets, and known propaganda and disinformation
amplifiers.
The influence narratives that we identified align with anunverified analytical note from the Fifth Service of the FSB,
reportedly intercepted and published by the SBU on June 5,2022. The Fifth Service of the FSB is responsible for targeting
Russia’s neighbors, and its Department of Operational Informationis responsible for compiling data on Russia’s “near abroad”. The

www.recordedfuture.com | Recorded Future ®

• “Arming Ukraine at the expense of European taxpayers,
and at the same time closing some social programs
within the EU, increasing the share of the poor in a
number of countries”• “Forecasts about the number of Ukrainian refugees andthe created burden on the budget and socio-economic
infrastructure of the EU, where there are already many
refugees from the Middle East and Afghanistan”• “Difficulties of the population due to problems withenergy carriers”

TA-RU-2022-0707

2

CYBER THREAT ANALYSIS | RUSSIA• “The lack of protection of the capital of any state andperson located in the Western financial and banking
system”• “Update information about neo-Nazis in Europe, make acomparison with Ukraine in order to show the European
community how Nazism is born and ask why they ban
Nazis in their countries, but support them in Ukraine? For
these purposes, it is advisable to use BBC documentaries
about neo-Nazis and Nazis (for example, ‘Nazis: howpolitical marginals became the ruling party’, ‘The
Holocaust: Untold stories of survivors’, etc.)”
Table 1 below shows the alignment of influence narratives
identified by Recorded Future and detailed in this report withthe aforementioned targeted actions and influence narratives
proposed by the analytical note. We believe that this alignment
supports the authenticity of the note.
Influence Narratives Identified by
Recorded Future

Actions and Narratives in the Analytical Note

Divisions between Western coalition
countries
Stirring internal discontent toward
Western leaders• “...deterioration of people’s lives in the EU, in connection with the policyof EU governments to support nationalist groups in Ukraine, to provoke
internal public pressure on the governments and political elites of Westerncountries”.
• “To form a negative attitude of the inhabitants of European countries tothe policy of their state toward Russia”.
• “Arming Ukraine at the expense of European taxpayers, and at the sametime closing some social programs within the EU, increasing the share of
the poor in a number of countries”.

Negative portrayal of Ukrainian refugees• “Forecasts about the number of Ukrainian refugees and the createdburden on the budget and socio-economic infrastructure of the EU, where
there are already many refugees from the Middle East and Afghanistan”.

Economic, energy, and food-security
concerns• “...deterioration of people’s lives in the EU, in connection with the policy of
EU governments to support nationalist groups in Ukraine”.
• “The lack of protection of the capital of any state and person locatedin the Western financial and banking system” and “difficulties of the
population due to problems with energy carriers”.

Ukraine as the source of Nazism andfascist movements• “Update information about neo-Nazis in Europe, make a comparison with
Ukraine in order to show the European community how Nazism is born andask why they ban Nazis in their countries, but support them in Ukraine?
For these purposes, it is advisable to use BBC documentaries about neoNazis and Nazis (for example, “Nazis: How political marginals became theruling party”, “The Holocaust: Untold stories of survivors”, etc.)”.

Inciting distrust of Western media
Table 1: Alignment of influence narratives identified by Recorded Future and targeted actions and influence narratives proposed by the analytical note

3

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA• On April 7, 2022, RT suggested that NATO was “divided”
over countering Russia, stating that while “Poland andthe Baltic states have advocated for a total break inrelations with Moscow… ​​ Germany, France, and Turkey
have reportedly argued that Russia cannot be coerced
into peace… [and] reportedly want to continue dialogue
with President Vladimir Putin”.8

Divisions Between Western Coalition Countries
Russian influence networks are almost certainly aiming todirectly undermine and divide the Western coalition on Ukraine
by creating or exacerbating divisions between Western coalition
countries. We believe that France, Germany, Poland, and Turkey
are the primary targets of this influence narrative based on
observed influence activities. Examples of these activities
include:• Cyber Front Z, a well-documented Telegram troll farmwith a headquarters in Saint Petersburg, Russia, in
addition to many other pro-Russian Telegram sources
such as “Z Memes”,9 often aggregates, shares, and attimes likely commissions images and memes (in thecase of Cyber Front Z, very likely commissioned from
employees of the troll farm or volunteers) provoking
European disunity and declaring European self-harmthrough military aid to Ukraine and sanctions against
Russia.

• In early June 2022, Russian sources RT 1 and ​​Rossiyskaya
Gazeta2 closely covered a recent dispute between
Belgium and Latvia over the controversial World War IImonument “Latvian Beehive for Freedom” in Zedelgem,
Belgium, based on links to those it honors and theWaffen-SS.
• In late May and early June 2022, multiple pro-Russian
media sources further amplified Turkey’s security
concerns over Finland and Sweden joining NATO,noting that in order to vote in favor, Sweden and
Finland must lift arms export restrictions on Turkey,
and that both countries extradite people linked to the
Kurdistan Workers’ Party (PKK) and the Gulen movement(FETO).3 Additionally, outlets like Sputnik News, 4 Red
Spring Information Agency,5 and others 6 have covered
disagreements between Turkey and Greece, pertaining towhat Turkey refers to as the Greek “militarization” of the
Aegean Sea islands with weapons deployments.
• On May 21, 2022, RT reported on rifts between theGerman and Polish governments over Germany’s
replenishment of various Leopard-model tanks to Poland
after Poland delivered T-72s to Ukraine.7 Citing German
government spokesman Steffen Hebestreit, RT noted that
Germany was “perplexed” by Polish president Andrzej
Duda’s criticism that Germany did not fulfill its promise to
Poland over the tanks.

1 https://www.rt.com/russia/556517-latvia-belgium-monument-tensions/2 https://rg.ru/2022/06/04/v-belgii-demontiruiut-pamiatnik-latysham-iznacistkoj-vaffen-ss.html
3 https://southfront.org/turkey-spoils-the-big-nato-party/ and https://southfront.org/sweden-and-finland-almost-in-nato-but-turkey-set-conditions/and https://www.rt.com/news/556098-turkey-nato-meeting-sweden-finland/ andhttps://ren.tv/news/politika/986663-turtsiia-otkazyvaetsia-podderzhat-chlenstvoshvetsii-i-finliandii-v-nato
4 ​​ https://sputniknews.com/20220609/im-not-joking-turkeys-erdogan-threatensgreece-over-alleged-arming-of-aegean-islands-1096162407.html
5 https://rossaprimavera.ru/news/83a2cca1
6 https://tehnowar.ru/365183-Ostrova-pretknoveniya-k-chemu-privedet-sporTurcii-i-Grecii-iz-za-situacii-v-Egeyskom-more.html
7 https://www.rt.com/news/556083-germany-poland-accusations-tanks-ukraine/www.recordedfuture.com | Recorded Future ®

89https://www.rt.com/news/553462-nato-disagrees-over-kremlin-sanctions/
https://t.me/Z_memes

TA-RU-2022-0707

4

CYBER THREAT ANALYSIS | RUSSIA

Figure 1: Memes produced by Cyber Front Z and Z Memes with a Turkish focus: (left, translated): “No!” (to Finnish and Swedish NATO membership)10; (right, translated): “Host abunch of US and NATO bases”, “Don’t trust West”11

Figure 2: A meme from Z Memes, implying that the EU is harming itself in hope of helping Ukraine12

Russian influence networks are actively attempting to stoke
ethnic tension and amplify historic territorial claims between
Poland and Ukraine, most notably suggesting that Poland isplanning to use Russia’s war with Ukraine to its advantage toreintegrate historically Polish lands back under its control.
• In other recent examples, pro-Russian Telegram sources,
citing a document most likely to be a forgery, falsely
claimed on May 10, 2022 that Polish forces, along withtroops from Lithuania, were planning to invade western
Ukraine on May 22, 2022.13 Similarly, Recorded Future
has also tracked at least 1 campaign we assess islikely connected to the Russian information operation
Secondary Infektion, which revolved around alleged
leaked maps of Polish military control of Ukrainian
territory near its border region.14

10
11
12
13
14

5

https://t.me/cyber_frontZ/2606
https://t.me/Z_memes/10385
https://t.me/Z_memes/10370
https://t.me/baltnews/14510
https://archive.ph/6O6ON• Additionally, on April 28, 2022, RT posted an article
amplifying claims by the head of the Russian ForeignIntelligence Service (SVR), Sergey Naryshkin, who accused
Poland of planning to invade Ukrainian territory along thePoland-Ukraine border and annex Lviv back into Polishcontrol.15 According to our data, Naryshkin’s allegations,and similar claims of a Polish invasion of Ukraine, werespread widely on pro-Russian Telegram channels, often
citing RT directly, as well as on RIA Novosti and Russian
Ministry of Defense-owned TV Zvezda. Similar allegations
have also been echoed by the head of the Russian
Security Council, Nikolai Patrushev, as well as in sources
such as the pro-Russian Red Spring Information Agency.16

15 https://www.rt.com/russia/554671-poland-ukraine-spy-split/
16 https://ria.ru/20220531/patrushev-1792037525.html and https://rossaprimavera.ru/article/ffd57c5a

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA

Figure 3: Left: Screenshot of RT documentary “Volhynia. No Statute of Limitations”17; Right: A meme produced by Cyber Front Z, provoking the idea of a Polish invasion of Ukraine(Translation: “Poland: We will free your territory”; “Ukraine: From the Russians?”)18

Stirring Internal Discontent Toward Western Leaders

Examples illustrating this influence narrative include:

In addition to direct efforts, Russian influence networks
are almost certainly aiming to indirectly undermine and divide
the Western coalition on Ukraine. One such influence narrative
encourages targeted audiences to blame their country’s politicalleadership for not standing up to international pressure, or for
not putting domestic economic or security priorities ahead of
Ukraine. This influence narrative overlaps with other narratives
discussed later in this report, such as blaming economic, energy,
and food-security concerns on Western governments for their
negative policies toward Russia, and blaming Ukrainian refugees
for worsening living standards.

• On June 9, 2022, RT contributor Rachel Marsden
published the headline “Westerners are skeptical about
their leaders, but not their anti-Russian narratives”, inwhich she questioned why Western governments aretrusted when it comes to anti-Russian narratives, butthere is growing skepticism of Western leaders more
broadly. Marsden argues that “We’re on the verge of a
global polarization over crises like Covid and Ukraine,
as citizens around the world fall into two camps: liberal
democracies that are successfully propagandized andradicalized into believing the narratives that they’re
spoon-fed in support of a political-industrial complex
that derives benefit from mass public support orcomplacency, versus those around the world whoaren’t willing to settle for soundbites and spin lines as a
substitute for independent critical thought”.19

Attempts to stir internal discontent toward a country’s
existing leadership will very likely precede future attempts toengage in malign influence during election cycles and othertarget-specific political milestones, in hope of projecting
a candidate, party, or platform more in alignment with, or atleast less abrasive to, Russia’s strategic objectives in Ukraine.
These figures need not be aligned with the Kremlin or hold “proRussian” views but can be favored for having a set of proposed
neutral or non-interventionist policies, or any views that would
indicate an opportunity to disturb or undermine the Westerncoalition.

1718

https://rtd.rt.com/films/volhynia-no-statute-of-limitations/
https://t.me/cyber_frontZ/2786

www.recordedfuture.com | Recorded Future ®

• On June 3, 2022, Southfront contributor Eric Zuesse
argued that the US is detracting from the security of
the American people through its defense support ofUkraine, stating that “defeating Russia in Ukraine is now
the U.S. Government’s top priority, and the needs of theAmerican people are being ignored in support of that
top priority”. 20 A similar article from Southfront publishedin April suggested that German weapon shipments to
Ukraine were not in the best interests of the German
population (economically or diplomatically) and that
German chancellor Olaf Scholz maintained a posture of“passivity and silence” in defending German interests. 21
Southfront is a disinformation outlet assessed to beunder the direction of the FSB by the US Department of
the Treasury.
19 https://www.rt.com/russia/556770-west-anti-russia-propaganda/?utm_
source=rss&utm_medium=rss&utm_campaign=RSS
20 https://southfront.org/the-u-s-governments-top-priority-now-is-to-defeatrussia-in-ukraine/
21 https://southfront.org/sending-heavy-weapons-to-ukraine-in-germaninterests/

TA-RU-2022-0707

6

CYBER THREAT ANALYSIS | RUSSIA

Figure 4: (Left) A Google search shared by the Russian troll network Cyber Front Z, suggesting that searches of Ukrainian refugees primarily return negative results22; (Right)
Sample articles from Sputnik News23 and RT24 highlighting challenges in facilitating Ukrainian refugees in Europe• In May 2022, RT contributor Robert Bridge assessed that“the Swedish and Finnish people are being led down adangerous road by leaders who clearly do not have theirbest interests at heart” by their decision to end theirneutrality status and seek NATO membership. 25

Negative Portrayal of Ukrainian Refugees
Another influence narrative observed across Russian
influence networks is the negative portrayal of Ukrainian
refugees in Europe and the impact they have on their hostcountries. The negative portrayal of Ukrainian migrants almost
certainly seeks to blame Ukrainian refugees for worsening
living standards, polarize public opinion in countries that haveaccepted Ukrainian refugees, and give traction to anti-migrantpolicies often associated with both conservative political parties
and ultra-right political factions. As a result, this influencenarrative supports the objective of undermining and dividing theWestern coalition by reducing public support for pro-Ukrainian
government policies.

22 https://t.me/cyber_frontZ/3305
23 https://sputniknews.com/20220607/belgian-families-hosting-ukrainianrefugees-complain-of-exhaustion-social-worker-says-1096094438.html
24 https://www.rt.com/news/554341-germany-afghan-ukrainian-refugees/
25 https://www.rt.com/russia/555828-sweden-finland-join-nato/

7

Examples illustrating this influence narrative include:• Russian news and Telegram sources, including one
series of interviews published on June 7, 2022 withalleged Russian citizens living in Poland (unconfirmed
authenticity), are alleging that Russian citizens are being
denied access to employment opportunities, denied rent,
and are enduring “psychological pressure” from Ukrainian
refugees. 26 One individual, “Olga”, claims that Russians
were afraid of being attacked or intimidated by Ukrainian
refugees in public places.
• On June 6, 2022, several Russian-language sources
quoted Russian-favored Matteo Salvini, a senator in
the Italian Senate and former deputy prime ministerof Italy, who recently assessed that if Russia’s war
against Ukraine drags on, food insecurity and economic
instability would likely result in an additional surge of 500
million migrants into Italy and southern Europe, and that
it would be an “economic and social catastrophe”. 27

26 https://www.mk.ru/social/2022/06/07/priekhavshie-v-polshu-russkieokazalis-v-adu-strashno-razgovarivat-na-ulice.html?utm_source=yxnews&utm_
medium=desktop
27 https://t.me/amurpress/4296 and https://regnum.ru/news/3611933.html andhttps://rossaprimavera.ru/news/83d93bb2

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA• On May 12, 2022, Southfront reported a stabbingin Warsaw allegedly by 3 intoxicated Ukrainian men
who were purportedly sexually assaulting a woman. 28
The article from Southfront concluded by saying that
“Deadly drunk Ukrainians can be often seen in thecenter of Warsaw, causing discontent of local residents”.
These claims further circulated among internet users,
Russian sources, and members of the far-right Polish
Confederation Party under the assumption thatUkrainians were responsible for the attack. According
to Polish investigative outlet OKO, citing Warsaw Police
spokesperson Sylwester Marczak, there were “noindications” that the incident involved “foreigners”. On
May 20, Minister of Justice Zbigniew Ziobro announced
that authorities obtained 2 arrest warrants for 2 Polishnationals identified as suspects in the murder.

• The first image, which attempted to appear as originatingfrom AfD’s official Facebook account, shows Mykola
being detained by 2 German police officers, and he asks
“Who will help me?” The police officers reply “God will
help you. Get back in your pigsty!”• A second image, purportedly from “Deutschland”, shows
Mykola asking a taxi driver, “Who can take me to thecity center for free?” The adjoining image shows the taxi
driver driving away saying “Help, Ukrainian refugees arehitting taxi drivers again!”• The third image, manipulated to appear to originate from“Ich Liebe Germany Deutschland” shows Mykola askingfor employment, while the employment officer respondsthat they “have no vacancies for prostitutes and drug
dealers”.
• The 3 memes are accompanied by 2 additional“screenshots” showing German residents joking amongst
themselves about the memes (also likely to be fake). The
pro-Russian Telegram account, @RVvoenkor, provided
an additional generality about the German population,saying the “[Germans]... do not support the Ukrainians atall”.30

Furthermore, Recorded Future recently located a series ofmemes depicting the poor treatment of Ukrainian refugees by
their host countries. These memes involve Mykola, a cartoon
wild boar character dressed in Ukrainian colors that was recently
created by the German Association of Catholics in Business andManagement. The character is used to explain the principles
of life in Germany to Ukrainian refugee children. The memes,
written primarily in German and circulating on pro-Russian
Telegram channels, were designed to appear to originate on
German Facebook pages, including the right-wing Alternative
for Germany (AfD) political party as well as “Ich Liebe Germany
Deutschland” (I Love Germany), and “Deutschland” (Germany).
We note that there is no record of these memes appearing
on Facebook — including on any of the 3 pages mentioned
above. This indicates that these images were likely manipulated“screenshots” using image editing tools such as a Facebook post
generator, likely with the purpose of stoking negative perceptions
among Germans of Ukrainian migrants.
On June 8, 2022, multiple pro-Russian Telegram sources,
including 1 Telegram account affiliated with Russian statecontrolled media outlet RIA Novosti (@ukraina_ru), begansharing the images, claiming that Germans have “beg[u]n [sic]to cruelly ridicule Ukrainians” and that “the boar Mykola is nolonger welcome in Germany”. 29 According to Telegram statistics,
we believe that these images have been viewed more than halfa million times, primarily by Russian speakers.

28 https://southfront.org/ukrainian-refugees-reportedly-killed-a-man-inwarsaw-poland-video-18/
29 https://t.me/ukraina_ru/78338

www.recordedfuture.com | Recorded Future ®

30

https://t.me/RVvoenkor/15423

TA-RU-2022-0707

8

CYBER THREAT ANALYSIS | RUSSIA

Figure 5: Identified memes of Mykola, crafted in German and Russian, negatively depicting German sentiment toward Ukrainian migrants

Economic, Energy, and Food Security Concerns
Russian influence networks are almost certainly attempting to
exploit economic, energy, and food-security concerns stemmingfrom Russia’s war against Ukraine to indirectly undermine anddivide the Western coalition by reducing public support forWestern government policies that are negative toward Russia(such as international sanctions) and policies supportive of
Ukraine (such as providing aid).
This influence narrative very likely aims to give credence to
the Russian government’s narrative that sanctions are ineffective
and unsustainable and are causing more damage to citizens ofsanctioning countries than the domestic Russian population.
These sources also aim to shift blame from Russia to Ukraine
for high food and fertilizer prices, in addition to blockades andtheft of international grain and corn exports. As discussed, thisinfluence narrative overlaps with other influence narratives
discussed earlier, including stirring internal discontent toward
Western leaders for not putting domestic economic or security
priorities ahead of Ukraine and blaming Ukrainian refugees forworsening living conditions.

Examples illustrating this influence narrative include:• On June 3, 2022, SVR-directed outlet Strategic Culture
Foundation published an inflation-growth infographic,
using figures from Trading Economics, to present “proof”
that inflation growth began before the start of Russia’s
war against Ukraine.31 The chart attempts to shift any
blame away from the conflict but does not take into
consideration the sudden ~1-2% increases in inflationlevels in Europe from February to March 2022, coinciding
with the beginning of the war on February 24.
• On June 2, 2022, the New Eastern Outlook, an outlet also
under suspicion of being directed by the Russian SVR,
published an article stating that NATO is determined
to defeat Russia at the cost of millions of lives due tofamine.32 An additional driver, the outlet argues, is theEU’s determination to use a food crisis “to try and sway
African nations back into the fold of former colonial
powers” rather than settle for a peace agreement
between Russia and Ukraine that would prevent further
suffering.

31 https://www.strategic-culture.org/news/2022/06/03/inflation-growthacross-g7/
32 https://journal-neo.org/2022/06/02/nato-s-mission-imperative-break-russiaeven-if-millions-worldwide-perish/

9

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA• On May 30, 2022, amid the ongoing US infant formula
shortage, FSB-directed News Front accused the US
government of prioritizing support to Ukraine over theneeds of US citizens.33 The outlet cited Congresswoman
Marjorie Taylor Greene, who said, “We have $40 billion,
but there is no baby food for American mothers andbabies. There is an unknown amount of money for CIA
activities in Ukraine, but no food for American babies andmothers”.
• On May 19, 2022, Southfront accused “corrupt[Ukrainian] officials” of stealing, or planning to steal,much of the US government’s $50+ billion in military
support and aid, suggesting that these resources arewasted when the US population is in greater need offinancial support.34 The outlet states that the US has
shown “unprecedented generosity” toward Ukraine but
hesitates to “carry out critical economic stimulation
measures… at a time when inflation is reaching
unprecedented heights, fuel hits new records andgrocery prices are unaffordable”. It is likely that thisarticle intended to frustrate readers with an image
that resources were being stolen or wasted, but more
broadly to provoke distrust toward Ukrainians and theirgovernment.

Russian state media sources RT and Sputnik News bothoften cover rising inflation and effects on living expenses; thesesources aim to connect the fallout of international sanctions on
Russia, in addition to Western defense support and spending, as
key catalysts of economic strain.37 Some headlines from Russian
media sources include:• “US blames ‘global challenges’ for record inflation”• “Washington’s Ukraine Aid Spending May Affect US
Economy, Experts Warn”• “EU country calls for ‘pause’ in anti-Russia sanctions”• “One third of EU countries see double-digit inflation”

Ukraine as the Source of Nazism and Fascist
Movements
Another influence narrative indirectly supporting theobjective of undermining and dividing the Western coalition on
Ukraine portrays Ukraine as the source of Nazism and modernday fascist movements, therefore aiming to reduce Western
public support for Ukraine, including pro-Ukrainian government
policies, and influence public opinion of Russia’s war against
Ukraine favorably toward Russia.

Some of Russia’s initial justifications for its war against Ukraine
were both “to protect the people that are subjected to abuse,genocide from the [Kyiv] regime” and “demilitarize and denazify”
Ukraine. 38 In support of the latter, the Kremlin has attempted to• In a May 11, 2022 press briefing, Russian foreign minister re-emphasize Russia’s pursuit of the “denazification” of Ukraine,and portray Russia as a force against international fascism, often
Sergey Lavrov stated that Moscow’s actions “do notharkening back to the Soviet Union’s contribution to the fall of
influence… the food problems in the world”, but rather
are due to the West’s “illegitimate sanctions” and Ukraine Nazi Germany in World War II and years of Russian propaganda
echoing claims of a “Nazi Ukraine”.
mining its ports, thereby preventing food exports by
sea.35 President Vladimir Putin has also blamed the
The unverified analytical note from the Fifth Service
West’s sanctions’ pressure for further stressing countriesof the FSB, intercepted by the Ukrainian SBU, noted that
already under threat of famine, refraining from placing
Russian influence networks failed to support the concept
any blame on Russia’s full-scale invasion, most likely toof “denazification” with an emotional attachment, citing “noundermine the perspective of the Western coalition in themassive [information campaigns] about the murdered children ineyes of the rest of the world.36
the DPR [Donetsk People’s Republic] and LPR [Luhansk People’s
Republic], about the massacres of nationalists against Russians
and other information that would emotionally contribute to the
support of the special operation”. As a result, the note admitted
that “there is not enough such information even now, especiallyfrom [first-hand accounts in Ukraine]”.

33 https://en.news-front.info/2022/05/30/america-plunged-into-anunprecedented-crisis/
34 https://southfront.org/much-of-washingtons-54-billion-aid-for-ukraine-willbe-stolen-by-corrupt-officials/
35 https://news.ru/world/lavrov-nazval-prichinu-prodovolstvennyh-problem-vmire/
36 https://actualidad.rt.com/actualidad/429575-putin-sanciones-antirrusasprovocar-crisis-economica-global
www.recordedfuture.com | Recorded Future ®

37 https://www.rt.com/news/556777-white-house-inflation-blame/ and https://
sputniknews.com/20220521/washingtons-ukraine-aid-spending-may-affect-useconomy-experts-warn-1095688076.html and https://www.rt.com/russia/556377belgium-sanctions-pause-impact/ and https://www.rt.com/business/555871-eucountries-mounting-inflation/
38 https://tass.com/politics/1409189

TA-RU-2022-0707

10

CYBER THREAT ANALYSIS | RUSSIA

In support of shifting Western attitudes toward Russia’s war,and the concept of “denazification”, we have found that proKremlin influence networks seek to “educate” Western viewers
on Nazism and attempt to source the origins of modern fascist
movements back to Ukraine. 39 For example, after the May 14,2022 mass shooting in Buffalo, New York, RT and several other
pro-Kremlin influencers attempted to connect the ideology ofthe suspect with Ukraine’s Azov Battalion, noting the shared useof the Sonnenrad (Black Sun symbol) and similar “worldviews”
between the suspect and the group. 40
Often, these outlets paint Western governments as enablers
and accomplices to “Ukrainian Nazi activity”. For example:• On June 6, 2022, an article published to pro-Kremlin
amplifier Global Research argued that the US, which
once fought against Nazis in World War II, is now training
and financially supporting Nazis in Ukraine. 41• Another article, first published to The Grayzone on
May 31, 2022, and later to Global Research on June 8,
2022, suggested that the US has both “directly andindirectly trained and empowered Nazis and ultranationalists at home and abroad to fight Russians in
Ukraine”, suggesting that in doing so, it could result in
future repercussions in the US’s fight against domestic
extremism.42 The author of the article, T.J. Coles,
predicted that after the war, “American fascists [would]
return home with the potential to use [US government
military training] against domestic targets”.
• On May 21 and 23, 2022, The Unz Review and Global
Research claimed that the UK government “is fundinga Nazi regime in Ukraine rather than prioritizing its
domestic national interests”43 and that this was covered
up with lies perpetuated in British media (note thecompounding, overlapping narratives here). 44

Figure 6: (Top) A meme featured on the pro-Russian Telegram channel Cyber Army of Russia withthe caption “Biden with NATO Chief Advisor”45; (Bottom) An article originally posted to The Grayzone
and later Global Research, indicating that the alleged US-trained extremists in Russia may attempt
to attack domestic targets in the future46

39 http://thesaker.is/so-how-serious-is-ukraines-neo-nazi-romance/
40 https://www.rt.com/news/555612-buffalo-shooting-symbol-azov-battalion/
41 https://www.globalresearch.ca/us-battled-ww-ii-nazis-today-us-side-by-sideukraine/5782550
42 https://www.globalresearch.ca/new-generation-us-trained-extremistsfighting-russia-we-prepared-blowback/5782817
43 https://www.unz.com/article/ukraines-nazi-connection-and-the-britishnational-cover-up/
44 https://www.globalresearch.ca/ukraine-nazi-connection-british-nationalcover-up/5781054

11

45 https://t.me/cyberwar_world/1097
46 https://thegrayzone.com/2022/05/31/us-trained-extremists-fighting-russiablowback/

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA

Inciting Distrust of Western Media
Russian influence networks are inciting distrust in Western
media coverage of Russia’s war against Ukraine, indirectly
supporting the objective of undermining and dividing theWestern coalition on Ukraine. This narrative seeks to sow doubt
in Western audiences about the truthfulness of Western media
reporting to undermine the public’s support of Ukraine and theirtrust in reports of Russian war crimes and other activities in
Ukraine.
Though certainly not unique to Russia’s war against
Ukraine, Russian influence networks, including Russian state
media organizations, pro-Russian OSINT accounts, fake “factchecker” groups, and other “alternative theory” organizations,particularly on Telegram, are inciting distrust in Western media
coverage of Russia’s war against Ukraine. This includes Western
media investigations of Russian war crimes, status reports ofthe battlefield, and other “lies” reported by Western media. At
times, these articles will be supported through poorly-sourced
or non-verified testimonials, alleged eyewitnesses, and various
appeals to authority via proclaimed experts, usually in the field of
military affairs and geopolitics. 47 Sometimes, arguments against
Western media from known Kremlin amplifiers — particularly
The Unz Review — also engage in anti-semitic themes when
discussing Western media coverage of the war, referring to theoutlets as “Jewish-controlled” 48 and operated by “planetary
master criminals”. 49

Figure 7: Article from Southfront citing French volunteer Adrien Boquet, who told French media that
he witnessed war crimes committed by the Ukrainian military; Boquet also claimed that the Bucha
massacre was a staged event50

Figure 8: RT articles and provided article snippets criticizing Western media war coverage andsuggesting that these outlets are untrustworthy51

47 https://southfront.org/russian-special-military-operation-in-ukraine-militaryexperts-opinion-interview/
48 https://www.unz.com/article/the-jewish-hand-in-world-war-three/
49 https://www.unz.com/jfreud/putin-and-hitler-in-the-failure-of-liberalimagination-problems-of-revisionism-zelensky-and-woody-allens-zelig-orzeliginsky/
50 https://southfront.org/french-volunteer-outraged-by-lies-of-western-mediarevealed-truth-about-war-crimes-in-ukraine/www.recordedfuture.com | Recorded Future ®

51 https://www.rt.com/news/555639-reuters-ukraine-war-paintball/ and https://www.rt.com/news/555144-ukraine-javelin-nlaw-mariupol/

TA-RU-2022-0707

12

CYBER THREAT ANALYSIS | RUSSIA

Figure 9: Known elements of Russia’s propaganda and disinformation networks often target Western media as biased and untrustworthy (Source: Recorded Future)

According to Recorded Future data, Russian influence
networks often discredit Western media coverage of Russia’s war
against Ukraine, citing anti-Russian bias, allegations of purposefulhysterical, sensationalist, or provocative works, and even claimingthat these outlets serve as mouthpieces for Western intelligence
services and foreign governments. 52 It is not uncommon for thesesources to engage in projection, accusing credible news sourcesof attempting to “brainwash”, confuse, or outright lie to theiraudiences; these opinions are also often reflected in memes andother visual works to reinforce those beliefs.

Figure 10: (Left)53 Strategic Culture Foundation contributor Finian Cunningham alleged that the goal of “corporate-owned media” is “the brainwashing of the public”; (Right)54 A similar narrative in ameme produced by Z Memes suggests that Western audiences are manipulated into certain buckets of thought — note that the pendulum changes from an image of George Floyd, to COVID-19, to avaccine, and finally to the colors of Ukraine’s flag

52
53
54

13

https://www.globalresearch.ca/us-state-affiliated-newsguard-targets-consortium-news/5782607
https://www.strategic-culture.org/news/2022/04/14/war-ukraine-really-about-us-pursuing-regime-change-in-russia-bruce-gagnon/
https://t.me/Z_memes/944

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA

Outlook
Attempts by Russian influence networks to undermine anddivide Western unity and support of Ukraine are very likely to
be a persistent challenge far beyond the end of Russia’s war
against Ukraine. In the immediate future, we expect to continue
observing many influence activities aligned with the influencenarratives illustrated in this report.
It is almost certain that Russian influence networks,
unchanged from years of prior narratives, will continue to incite
distrust of Western media, specifically promoting the view that
Western media’s coverage of Russia’s war against Ukraine isincorrect, biased, or untruthful.
In addition, Russian influence networks will likely attempt
to pivot to a more positive outlook on Russian occupation andmilitary activities in Ukraine, directly appealing to emotion(something the Fifth Service of the FSB claimed influence
networks failed at initially, per the unverified analytical note)with “heartwarming” reports from Ukraine, and later shifting
to positive — though likely heavily misleading — messaging ofreconstruction and infrastructure development of “liberated”
territories.
Though the Western coalition on Ukraine currently remains
united in its resolve against Russia’s war against Ukraine, theKremlin is likely expecting its information operations to yield
results in the long term. As the war persists, the impact of Russia’s
war against Ukraine, including blowback from sanctions, is likely
to further strain the relationship between Western populations
and their governments. Over time, this will likely result in a natural
dwindling of support for the Western coalition, resulting fromboth exhaustion with the war and a lack of appetite for longterm economic pain. It is almost certain that Russian information
operations would further attempt to exploit this opportunity toswing international opinion in their favor. As this scenario seems
more likely with Russia preparing for a long war, a “whole-ofcommunity” response to effectively identify, isolate, inform, andcounter Russian direct and indirect attempts to undermine anddivide the Western coalition on Ukraine will be required.

www.recordedfuture.com | Recorded Future ®

TA-RU-2022-0707

14

CYBER THREAT ANALYSIS | RUSSIA

Appendix A: Translated Analytical Note

• lack of a confident description of the positive postwar future of the liberated territories, explanation of
resources for their development, vision of the place androle of new territories in the system of socio-economic
regional and international relations[Beginning of Translated Document]
Analytical Note

It is advisable to switch the information agenda to a confident
For the purposes of organizing ideological work in the postdiscussionof projects for post-war socio-economic development
war period, it is necessary to take into account a number ofoftheliberated
territories.
problems of information and propaganda support of the special
operation in Ukraine, which are currently identified:• insufficient evidence that a military measure was the
only possible one. Since the beginning of the special
operation, people have not understood and continue notto understand the reasons and goals that we want toachieve;• the beginning of the special operation and the conceptof “denazification” was not supported by an emotional
background, there was no massive stuffing of emotional
information about the murdered children in the DPR
and LPR, about the massacres of nationalists against
Russians and other information that would emotionallycontribute to the support of the special operation. Thereis not enough such information even now, especially“from the first mouth” of people living in Ukraine;• the absence of massive information in the media andnew media about the support of the special operation
among the citizens of Ukraine, which creates a favorable
environment for the dissemination of information about
Russia-the aggressor and invader;

For the purpose of post-war support, it is recommended to
implement the following areas of work already now:
1. develop and present projects for the future developmentof the liberated territories of Ukraine, include large
business and business circles, large public organizations,associations, unions, movements, university centers in
the development and discussion;
2. will focus on four contours of working with public
opinion: public opinion inside Russia, in Ukraine, in the
post-Soviet countries (where the idea that Russia is anaggressor can also act with us is already being discussed
by nationalist groups), public opinion of Westerncountries;
3. identify significant segments of society that doubt thecorrectness of Russia’s actions more than others, andpurposefully work with them (in particular, young people);
4. to use not only mass media, new media, but also civil
networks on the ground for information work, to form
networks of propagandists;• distrust of a part of the population of the Russian media,
5. implement special projects that form a positive opinion
insufficiency in the information field of new persons about the actions of Russian troops in Ukraine.
newsmakers, especially reference persons, presented
on the Internet today, They do not appear on TV shows,
Taking into account different motives and instruments ofbut their opinion is significant for a part of the population
negativization of Russia by forces of different countries and(primarily those who doubt the correctness of Russia’sgroups, it is proposed to organize targeted actions.
actions).
• speeches by well-known representatives of showbusiness, scientists, etc., against the special operation,
create the impression that the Russian elite is split andthe situation inside the country is destabilizing;• some citizens consciously look for and compare
information in foreign and Russian media and come to theconclusion that there is a complete lack of support for
Russia abroad. There is a need to strengthen work withjournalists and media experts from foreign countries (notonly Western, but also in the Arab world, Central Asia,
China, India, etc.);

15

On the territory of the DPR, LPR, Ukraine

To begin work on the discussion of programs and projectsof peaceful life in the post-war period, namely:• to activate the work of large public organizations in thisdirection - the Chamber of Commerce and Industry, theAssociation of Small and Medium-sized Cities of Russia,
the Union of Russian Cities, the Volunteers of Victory
movement, etc.
• start discussing new laws related to social programs andeconomic development of the territories of the DPR and
LPR;

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA• to start projects of humanitarian assistance to persons
affected by the actions of nationalists and other radicalgroups that have received weapons from Westerncountries (according to their statements, as victims);• interviews and videos about the support of Russian
actions inside Ukraine itself from residents of Ukraine.
Video stories, interviews, support (videos about rescued
children, reunited families, happy released, etc.);• start negotiations with the heads of local authorities on
infrastructure development and post-war reconstruction
programs;• appeals of stars of art, sports, prominent figures ofscience, education in support of Russian actions andthe Russian army. It is recommended to place special
emphasis on young stars from the show “The Voice” andother projects;• to form and start discussing projects for the constructionof infrastructure, schools and strengthening thepersonnel potential of universities of the DPR and LPR.
To consolidate the image of the Russian warrior-liberator,
in particular:• use the successful image of “polite people” in 2014(videos, photos with rescued animals, for whichchildren were worried; photos with veterans crying withhappiness of reunion, etc.);• videos of soldiers who bring peace to people (in the formof new textbooks to schools, medical equipment, etc.),
which will consolidate the image of “soldiers of peace”;• video of common actions of Russian and Ukrainiansoldiers against Ukrainian Nazis and gangs.
To strengthen the arguments of the special operation toorganize:• numerous appeals of Ukrainian and Russian veteranswith a request to stop fascism in Ukraine and prevent
it in Russia and in the world. Stories about insults andreprisals against veterans in Ukraine in recent years andnow:• to carry out work with persons who are in contact with alarge number of people by their occupation. Especially teachers, taxi drivers, salon staff, etc.;• in the conditions of the ban on Russian broadcasting,launch new media projects and real networks of agitators
The work on the formation of the morale of Russians andpro-Russian citizens of other countries, their mobilization should
be no less powerful than that of Ukrainian nationalists. Currently,social networks are full of anti-Russian songs, jokes, mobilizing
poems about the protection of the Motherland-Ukraine.
Alternative products should be prepared and distributed.
Inside Russian Society
In order to consolidate Russian society, it is advisable tostrengthen support for Russian actions in Ukraine:www.recordedfuture.com | Recorded Future ®

• interviews with disappointed fans of artists who did notsupport Russia’s position, disclosure of the facts of theirforeign assets and personal interests;• massive interviews with foreign stars, politicians, experts,
telling about the real goals of the West in relation to
Ukraine and Russia;• numerous interviews of experts from Ukraine and othercountries, the opinion of the military and leaders of the
DPR, LPR, Not only Russian experts should be in theinformation field. To strengthen the coverage by foreign
journalists of what Russia is doing in foreign media(accordingly, to strengthen the work with journalists inforeign national media who prepare programs on politics
and international relations);• interviews and videos about the economic situation andprospects from the heads of major Russian organizations- Gazprom, Norilsk Nickel, VTB and others. One of
the tasks is to explain the dependence of the world’s
economies on Russian resources, to show Russia’s
capabilities for retaliatory sanctions;• interviews and videos from foreign experts about thedependence of the world on Russia’s position, about thegoals and objectives of Russia in Ukraine;• organize the collection of humanitarian aid from Russian
citizens (street and Internet projects),
In relation to the post-Soviet space:• to begin preparations for the International Anti-Fascist
Congress to coordinate the efforts of countries in
opposing Nazism in the modern world. Activate (create)anti-fascist organizations in the territories of post-Soviet
states;• to organize a League of anti-fascist states in theneighborhood belt;• to spread opinions from friendly countries (experts andprominent figures of culture, science, education, sports)
in support of the residents of the DPR, LPR and theactions of Russian troops;

TA-RU-2022-0707

16

CYBER THREAT ANALYSIS | RUSSIA• to start discussing economic integration projects with
the DPR and the LPR, mutually beneficial economic
partnerships within the framework of the EAEU, CIS, SCO
and other formats, it is recommended that the initiatorsof the projects be Russian big business and business
partners of post-Soviet countries.
With regard to the European Community:• To start a massive stuffing of information about the facts
and forecasts of the deterioration of people’s lives in theEU, in connection with the policy of EU governments to
support nationalist groups in Ukraine, to provoke internal
public pressure on the governments and political elites ofWestern countries.
• To form a negative attitude of the inhabitants ofEuropean countries to the policy of their state toward
Russia. Attention should be focused on the deteriorationof life in the EU and around the world in the long term.
Arguments:• arming Ukraine at the expense of European
taxpayers, and at the same time closing somesocial programs within the EU, increasing the shareof the poor in a number of countries;• forecasts about the number of Ukrainian refugees
and the created burden on the budget and socioeconomic infrastructure of the EU, where there are
already many refugees from the Middle East andAfghanistan;• difficulties of the population due to problems withenergy carriers;• the lack of protection of the capital of any stateand person located in the Western financial andbanking system.
• Update information about neo-Nazis in Europe, make acomparison with Ukraine in order to show the European
community how Nazism is born and ask why they ban
Nazis in their countries, but support them in Ukraine? For
these purposes, it is advisable to use BBC documentaries
about neo-Nazis and Nazis (for example, “Nazis: howpolitical marginals became the ruling party”, “The
Holocaust. Untold stories of survivors”, etc.).

17

Recommendations:
1. Clearly indicate the requested position: the neutral
status of Ukraine, enshrined in the updated Constitution,
the withdrawal of the Armed Forces of Ukraine
from the territory of the L/DNR, the disarmamentof national battalions, the holding of a referendum
under international control in the remaining notunder the control of the L/DNR regarding their status(legitimization: no referendum was held in these
territories in 2014).
2. To voice the topics of losses and prisoners more clearly
from our side. Otherwise, the enemy will “ride” the topic.
This is already happening with blatant hyperbolization.
3. To involve Ukrainian speakers more actively in the antiwar discourse, who will be able to explain that they are
not for the defeat of the country in the war, but for aneutral status, renewal, rejection of extreme nationalism,in which Russia helps. Such speakers should have acertain fame beyond the “emigration” in Moscow, not beperceived as a “restoration of Yanukovych” and “former”
4. Saturate the information space with a large number ofsuccess stories. Oti has opened a water supply channel
to the Crimea, the Russian military does not suppress
rallies (Berdyansk is a plus, Ukrainians did not allow such“tolerance” in Donbas), coordination with the mayors ofliberated cities, ordinary people in villages and cities, theimage of a “soldier with a girl”.
5. Identify the objectives of the operation as clearly as
possible, going beyond the discursive framework of thetwo processes: “suppression of military infrastructureand denazification.” Neutralize local Ukrainian TV
channels and start broadcasting around the clock in the
territories taken under the control of the Armed Forcesof the Russian Federation. Once again to focus theattention of Ukrainians on the thesis “Russia does not
occupy the territory. Russia will leave, but only when thelocal Ukrainian new government is established.” Highranking speakers of Russia are faced with the task of
breaking the stereotype of the aggressive nature of thewar, shifting the emphasis to the liberation one: “We arefighting for you, so that you can transfer these territories
to you.”6. To spread narratives about the atrocities and crimes ofnationalist battalions as much as possible through theproper channels on the network, where the hatred ofnationalists for Russians as a people, and not only thestate and the army, will be clearly indicated.

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | RUSSIA

7. To reduce the accusatory heat within the country on“traitors”. There are a lot of conditional pacifists among
young people and students, It is necessary to explain
to them that they become “useful idiots”, victims of theinformation war, On the contrary, to widely introduce
into circulation “victims” - students, tourists who stayedabroad because of sanctions, to intensify the campaign
for their return. Russia has not forgotten you! The Westdoes not think about democracy, sanctions are notagainst Putin, but against ordinary people! Scientists,
athletes, academics, and doctors, Focus on curtailinghumanitarian projects of the West because of Ukraine.
Valery Gergiev is a clear example of this!
8. [Insikt Group notes that the #8 entry is absent in the
body of the document, and this paragraph is noted as#9.] While maintaining a respectful attitude toward theenemy, emphasize that there are a lot of lost people
there, they repent and are ready to accept the new
Ukraine.
[End of Translation]www.recordedfuture.com | Recorded Future ®

TA-RU-2022-0707

18

CYBER THREAT ANALYSIS | RUSSIA

About Insikt Group®
Insikt Group is Recorded Future’s threat research division, comprising analysts andsecurity researchers with deep government, law enforcement, military, and intelligenceagency experience. Their mission is to produce intelligence on a range of cyber andgeopolitical threats that reduces risk for clients, enables tangible outcomes, and prevents
business disruption. Coverage areas include research on state-sponsored threat groups;
financially-motivated threat actors on the darknet and criminal underground; newly
emerging malware and attacker infrastructure; strategic geopolitics; and influence
operations.

About Recorded Future®
Recorded Future is the world’s largest intelligence company. Recorded Future’s
cloud-based Intelligence Platform provides the most complete coverage acrossadversaries, infrastructure, and targets. By combining persistent and pervasive
automated data collection and analytics with human analysis, Recorded Future provides
real-time visibility into the vast digital landscape and empowers clients to take proactive
action to disrupt adversaries and keep their people, systems, and infrastructure safe.
Headquartered in Boston with offices and employees around the world, Recorded
Future works with more than 1,400 businesses and government organizations acrossmore than 60 countries.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

19

TA-RU-2022-0707

Recorded Future ® | www.recordedfuture.com