Google: Kremlin Expands AI-Backed Influence Campaigns Across Europe, US
Google Threat Intelligence reports Russia is expanding AI-enabled influence operations beyond Ukraine to target the EU and NATO, leveraging proxy networks and hacktivists.
Russia's information warfare efforts have expanded beyond Ukraine, with the Kremlin now focusing on influence operations across the European Union and NATO countries, according to new research from Google Threat Intelligence. While traditional cyberattacks related to the war continue, Moscow has significantly amplified its disinformation campaigns aimed at undermining Western cohesion and asserting global dominance, while simultaneously seeking to maintain regime stability at home.
Recent pro-Russian influence operations reveal an evolution in tactics, particularly the increasing adoption of cost-effective generative artificial intelligence (GenAI) tools. These AI technologies are being employed to accelerate propaganda efforts, streamline planning and research, and enhance content creation, making campaigns more efficient and harder to attribute. Google notes that as Russia seeks to overcome international isolation, there's a concurrent focus on pre-war pro-Russia influence objectives.
Historically, Russian state media outlets like RT and Sputnik have been primary conduits for these influence campaigns. However, sanctions and distribution restrictions imposed by the U.S., EU, and other nations following Russia's election interference and invasion of Ukraine have severely limited their international reach. In response, Russia is increasingly relying on networks of covert operators, proxy organizations, and cyber-enabled campaigns to circumvent these restrictions and reach foreign audiences.
Threat actors are also impersonating legitimate news organizations by mimicking established media brands or creating convincing fake outlets to lend credibility to their propaganda. Google's analysis highlights that the targeting scope of these operations, both current and historical, exposes both the Kremlin's global ambitions and the practical limitations of its power projection capabilities.
The conflict in Ukraine has served as a crucial testing ground for Russia to refine its influence tactics, including the integration of AI. Google reports that large language models, such as Gemini, have been utilized to build obfuscation infrastructure, generate decoy malware code to evade detection, and automate content creation. In the Russia-aligned influence campaign known as Operation Overload, AI was instrumental in producing synthetic images, videos, and deepfakes at scale, thereby lending an air of credibility to fabricated narratives.
These influence operations are increasingly coinciding with cyberattacks. Actors have been observed pairing wiper malware, designed to permanently destroy or corrupt data, with website defacements that carry false surrender messages. Additionally, stolen or manipulated data is being disseminated through fake online personas. Pro-Russia hacktivism has evolved into a significant component of this influence ecosystem, blending state-backed actors using hacktivist tactics with a growing cohort of third-party actors who support Russia's geopolitical interests.
Google explains that while custom tool development aids operators across all phases of the influence operation (IO) lifecycle, Russian government actors can flexibly leverage different models for outsourcing campaign execution based on their specific needs, while proxy actors can provide plausible deniability. An example is the self-proclaimed hacktivist group NoName057(16), which has operated since 2022, launching denial-of-service attacks against government, media, and private sector websites in Ukraine and Western countries supporting Ukraine, often in collaboration with groups like Killnet.
Collaboration is a key feature of this ecosystem, with threat actors sharing toolkits to mutual benefit. For instance, the cyberespionage group Gamaredon offered its malware downloader to fellow Russian state-sponsored actor Turla, facilitating the deployment of Turla's backdoor and the maintenance of footholds. Through these interconnected efforts, the Kremlin fosters cross-component links that strengthen the overall utility of this ecosystem as a versatile tool of state influence.