https://secondaryinfektion.org/report/the-techniques/

The breakdown of platforms varied between languages. Secondary Infektion posted to the largest number of platforms in Russian, choosing not just Russian-based platforms, but forums across the former USSR, such as stena.ee (Estonia), amigos.lv (Latvia), dosug.md (Moldova), and yvision.kz (Kazakhstan). Its English-language choices were slightly more restricted but ranged from global giants to fringe forums such as dover.co.uk (Dover, in England), cssforum.com.pk (the Pakistani civil service), and ozpolitic.com (Australia). In Spanish, the operation only used a few platforms, notably Reddit and burbuja.info (ostensibly dedicated to real estate).

https://secondaryinfektion.org/report/executive-summary/

“Secondary Infektion” is the name given to a long-running Russian information operation, encompassing multiple campaigns on social media run by a central entity, which was already active in 2014 and that was still running in early 2020.

Secondary Infektion targeted countries across Europe and North America with fake stories and forged documents. Its focus and areas of interest were often of a diplomatic and foreign policy nature: it appeared primarily aimed at provoking tensions between Russia’s perceived enemies, and its stories typically concerned relationships between governments and often specifically focused on government representatives. It is also notable for launching smear campaigns against Kremlin critics, and for targeting presidential candidates in 2016 in the U.S., in 2017 in France, in Germany, Sweden and elsewhere.

Little is yet known about the central entity behind the operation: its identity is the single most pressing question to emerge from this study.[1] The Facebook security team uncovered a small cluster of accounts run by the operation for the first time in May 2019 and provided the original attribution to actors based in Russia. This in turn enabled others to identify related clusters and stories linked to Secondary Infektion in late 2019 and early 2020. From November 2019 to May 2020, the Graphika team uncovered over 2,500 pieces of content that Secondary Infektion posted across six years, seven languages, and more than 300 platforms and web forums, from social media giants such as Facebook, Twitter, YouTube, and Reddit to niche discussion forums in Pakistan and Australia, providing an unprecedented view of the operation’s breadth and depth.

This report is the first systematic examination of Secondary Infektion’s campaigns. It reveals the most comprehensive picture yet of this actor’s strategic objectives and tactical priorities across the years.

The scale of the operation is impressive, but the range of topics it focused on was relatively small. In descending order of frequency, the operation posted about nine main themes:

Ukraine as a failed state or unreliable partner
The United States and NATO as aggressive and interfering in other countries
Europe as weak and divided
Critics of the Russian government as morally corrupt, alcoholic, or otherwise mentally unstable
Muslims as aggressive invaders
The Russian government as the victim of Western hypocrisy or plots
Western elections as rigged and candidates who criticized the Kremlin as unelectable
Turkey as an aggressive and destabilizing state
World sporting bodies and competitions as unfair, unprofessional, and Russophobic