Impact of Information Operations in Russia-Ukraine Crisis and Possible Implications for Asia Pacific

The recent episodes of Russian aggression towards Ukraine, manifested by Russia’s full-scale invasion, has triggered a disinformation campaign promoted by a full spectrum of threat actors. There is a rapid proliferation of information operations, ranging from cyber-enabled information operations to campaigns leveraging coordinated and inauthentic networks of social media accounts to promote fabricated content and desired narratives across various platforms, websites, and forums.

Since October 2021, Mandiant Intelligence has observed and documented multiple Information Operations (IO) that leveraged complex tactics and narratives, intended to cause panic, spread confusion and evoke chaos on Ukraine by Russian state-backed operatives. Interestingly enough, these IO campaigns are conducted alongside other destructive and disruptive cyber incidents on Ukrainian targets.

These information campaigns promoted narratives which are supportive of Russian national interests, referencing content since the initial troop build-up around Ukraine in late 2021, and eventually the ensuing conflict across multiple channels such as social media and blog sites.

Since January this year, Mandiant has documented several information operations that leveraged bolder tactics, including manipulation of a TV broadcast and dissemination of a deep fake video impersonating the Ukrainian president, and provocative narratives, such as false claims of Ukraine's surrender. Several of these incidents included disruptive elements and coincided with additional destructive and disruptive incidents.


The text used in the defacement of Ukraine 24's website matches the text used to deface the Ukraine 24 news broadcast as shown in the video included in the Stratcom Centre UA tweet (top right). An enlarged image of the news ticker from that broadcast (bottom) shows a portion of that text and highlights the segment of the text in the website defacement with which it corresponds. Additionally, the image of Zelensky used in the defacement appears to be a screenshot from a promoted "deepfake" video of him.

In addition, Mandiant observed, on other platforms, multiple narratives to support the Russian invasion. Some observations include:
• Twitter network operating in support of Russian political interests and promoting content pertaining to the war. This observation displayed similar behavior and content against other pro-Russia Twitter networks that Mandiant have previously identified.
• Observed Ghostwriter activity continued to target audiences in Lithuania, Latvia, and Poland with anti-North Atlantic Treaty Organization (NATO) narratives, though with increased mentions of Ukraine.
• Activity conducted by an entity calling itself "Cyber Front Z" appears to be newly established in March 2022, though the operators reportedly may have ties to the Internet Research Agency (IRA). The organizing Telegram channel has called for like minded volunteers to promote its posts and has advertised paid positions.

Implications for Asia Pacific

Given the vast geographical distance of Asia Pacific countries from the physical conflict, one might think that these IO campaigns do not affect local communities in Asia Pacific.However, Mandiant has observed multiple pro-China and pro-Iran information operations campaigns promoting narratives critical of the United States, NATO, Europe, and Israel in their responses to the Russian invasion of Ukraine.

Mandiant notes that these operations appear to be intended to undermine the U.S. and sow division between the U.S., NATO, Europe, and their allies. An example would be China’s foreign ministry spreading falsehoods echoing Russian claims that US had biological weapons in Ukraine.

Other observations include:

• Pro-China DRAGON BRIDGE campaign that is promoting narratives critical of the U.S. and its actions relating to heightened tensions between Ukraine and Russia, including claims that the U.S. lied multiple times about alleged dates for a Russian invasion of Ukraine and a claim that the U.S. is instigating a war in Ukraine to advance its own interests.
• Additionally, these accounts claim that the solution to the Russia-Ukraine conflict is to revert to the starting point of the new Minsk Agreement (Minsk II). Minsk II is a multilateral agreement intended to broker a ceasefire and provide a political path forward for conflict resolution in eastern Ukraine upon their implementation; a key facet required that Ukraine conduct constitutional reform to give the regions of Donetsk and Luhansk special status as sub national entities within Ukraine, a stipulation promoted by Moscow. However, on Feb. 21, 2022, Russia recognized Donetsk and Luhansk as "independent," functionally undermining the Minsk agreements as a conflict resolution path.

According to the New York Times, India’s social media users are one of the key drivers of influencing public opinion of the war in Ukraine across countries outside of the conflict zone globally. Indian users made up nearly 11 percent of the #IStandWithPutin hashtag trend in the two weeks after the invasion. Just 0.3 percent were from Russia and 1.6 percent from the United States during that time.

The report also suggested that these Indian accounts may be inauthentic, but there wasn’t enough evidence to demonstrate that this was a coordinated influence campaign aimed at shifting sentiment about the war in India.

It is also noted that there is a very distinct split of public opinion in India. While some people have vehemently opposed the war, others have vocally backed Russia and held marches to show support. While there is insufficient evidence to prove a direct relation between these marches and successful IO campaigns on Indian audiences, there is still a possibility of it happening.

Looking Ahead

Mandiant anticipates that pro-Russian IO campaigns will continue to actively promote content that supports Russian government interests and is critical of Ukraine, NATO, the U.S., and other nations or organizations perceived as supporting Ukraine in the conflict.

In addition, we anticipate that Ukrainian government and media organizations will face the most significant risks of compromise in support of IO campaigns and we also note the potential for these incidents to coincide with or support significant disruptive or destructive attacks.

We also judge that high-profile public events or announcements such as ceasefire negotiations between Russia and Ukraine or speeches by Ukrainian officials, or developments regarding potential NATO membership expansion could also be events that can be leveraged by IO actors to insert their narratives.