An Archaeology of Russian Information Operations
Tags: Propaganda, Disinformation, Russia, Cybersecurity, Journalism

Another curiosity I came across was CyberGuerrilla.

The site, which was registered in late 2010, was and remains vintage Anonymous — an untidy mess of colorful rainbows, Matrix-style cascading green code, and red anarchist circle-As. Early posts revolved around support for the Arab Spring, solidarity with WikiLeaks and fighting censorship on Facebook and elsewhere.

One of CyberGuerrilla’s homepages

But in 2013 the site saw a sudden surge in Russia- and Ukraine-focused activity. At least three Fancy Bear targets appear to have had their emails dumped to the site, among them Ukrainian lawmaker Serhiy Leshchenko, who played a key role in exposing the secret payments made to former Donald Trump campaign manager Paul Manafort. Kyiv mayor Vitali Klitschko was targeted at one point, as was Ukrainian parliamentarian Irina Lutsenko, this time by a group calling itself UkrLeaks or UkroLeaks.

A mess of other groups appear to have been active on CyberGuerrilla, including CyberBerkut, Anonymous Ukraine and the CyberMilitia of Donetsk, Lugansk and Kharkiv (“КиберОполчение Донецкой, Луганской и Харьковской областей.”) Some, like CyberBerkut, are still active. Others, like CyberMilitia or UkroLeaks, appear to be defunct. There was even a comparatively smaller group of anti-Russian hackers that posted to the site, including a gang that published copies of the text messages stolen from Manafort’s daughters.

A post to CyberGuerrilla announcing the creation of the CyberMilitia hacktivist group in 2014

Sifting through the hacktivist haystack to the find state-sponsored needles is difficult, especially at several years’ remove. Even at the time, CyberGuerrilla’s posters traded accusations of impersonation. For example, when a poster claiming to represent Anonymous Ukraine published a call on November 21, 2013 to “topple down the existing regime” — the government of Russia-friendly President Viktor Yuschenko — another poster fired back just over an hour later:

Hello citizens of the world, We’re the REAL Anonymous Ukraine. […] It seems that Western intelligence agencies used our brand name to promote EU and NATO interests to transform Ukraine into a raw material donor to Europe. […] We’ve pwned the European Investment Bank, Estonian Ministry of Defense, a number of Russian and Polish websites and NATO Cooperative Cyber Defense Centre of Excellence. But we’ve never attacked Ukrainian web-resources or Ukrainian citizens. Our goal is to promote independence of Ukraine from other countries and organizations.

The poster embedded a video calling for #OpIndependence — marketed as a campaign to keep Ukraine independent both from Europe and from Russia.

A YouTube video promoting #OpIndependence

The confusion persisted as Yuschenko was toppled and Russia-backed forces overran Crimea and eastern Ukraine. In March of 2014 someone on CyberGuerrilla claimed that Anonymous Ukraine had stolen emails that revealed an American plot to stage attacks in Ukraine and create “favorable conditions for Pentagon to act.” But the emails in question were forged and Anonymous Ukraine — or someone claiming to be them —later told a Russian publication they had nothing to do with the stunt. “This is the work of the FSB,” they were quoted as saying.

More forgeries followed. A faked July 1, 2015 letter from Senator Dick Durbin appeared to show the senior American politician dictating Ukrainian cabinet positions to then-Prime Minister Arseniy Yatsenyuk. A few weeks later the site hosted bogus screenshots purporting to show that Haaretz had censored news that Ukrainian far right activists were planning to assassinate President Petro Poroshenko. Another letter, ostensibly addressed to then-Assistant Secretary of State Victoria Nuland on March 10, 2016, carried a plea to postpone the Dutch referendum on the EU-Ukraine association agreement — then seen as an important barometer of relations between Kyiv and Brussels. (In an embarrassment for Ukraine, the agreement was decisively rejected the following month.)

CyberGuerrilla says it was well aware of the mischief raging across its site and says it always believed intelligence services were involved. I recently spoke to one of the site’s administrators, who asked me not to divulge their identity. My questions are in bold. Their responses are in italics.