2 December 2024

Moscow-based company linked to new influence campaign targeting Ukraine and Western allies


Moscow-based company linked to new influence campaign targeting Ukraine and Western allies

A Moscow-based company sanctioned by the US authorities earlier this year has been involved in another covert influence operation aimed at undermining Ukraine and weakening Western support. The campaign, known as Operation Undercut, has been active since at least December 2023, according to findings from Recorded Future's Insikt Group.

The operation, orchestrated by the Social Design Agency (SDA), uses artificial intelligence (AI)-enhanced videos and fake websites impersonating trusted news outlets to spread disinformation. The campaign has primarily targeted audiences in Ukraine, Europe, and the US.

Recorded Future describes Operation Undercut as part of a larger Russian strategy, running parallel to other campaigns like Doppelganger. These efforts aim to erode trust in Ukraine’s leadership, question the efficacy of Western aid, and exacerbate socio-political divisions.

“This operation, running in tandem with campaigns like Doppelganger, seeks to discredit Ukraine's leadership, question the effectiveness of Western aid, and stir socio-political tensions,” the cybersecurity firm said.

Operation Undercut also shapes narratives around geopolitical conflicts, such as the ongoing Israel-Gaza crisis, and attempts to influence the 2024 US elections.

The campaign shares infrastructure with Operation Overload (also known as Matryoshka and Storm-1679), another Russia-aligned influence operation. Overload has targeted the 2024 French elections, the Paris Olympics, and the US presidential election through fake news websites, falsified fact-checking portals, and AI-generated audio content.

Operation Undercut uses AI-powered videos and imagery mimicking reputable media brands, as well as a network of at least 500 social media accounts across various platforms. It also exploits trending hashtags to increase visibility.

The campaign has also promoted content from CopyCop (also known as Storm-1516) to further its objectives.

The Social Design Agency and its founders were sanctioned by the US in March 2024, alongside Structura, another Russian entity involved in influence operations. Both companies have been linked to earlier disinformation efforts, such as Doppelganger.

Back to the list

Latest Posts

Cybersecurity Week in Review: January 24, 2025

Cybersecurity Week in Review: January 24, 2025

In brief: SonicWall SMA zero-day exploited in attacks, hackers are exploiting older Ivanti flaws, and more.
24 January 2025
AIRASHI DDoS botnet exploits a zero-day vulnerability in cnPilot routers

AIRASHI DDoS botnet exploits a zero-day vulnerability in cnPilot routers

The attacks have been active since June 2024.
23 January 2025
SonicWall SMA zero-day exploited in attacks

SonicWall SMA zero-day exploited in attacks

SonicWall has released a patch in version 12.4.3-02854 and higher versions to address the issue.
23 January 2025