The “ghost writer” crusade consisted of replacing real stories with stories on news sites in Poland and Lithuania.
According to a new report, hackers “aligned with Russian security interests” have embarked on a sustained crusade to compromise news sites in Poland and Lithuania in order to sow counterfeits intended to discredit NATO.
Part of the crusade – titled “Ghostwriter” – was referring to news site publishing systems, suppressing stories and replacing them with fake news that sought to delegitimlate the transatlantic alliance.
In one example, a Lithuanian news page compromised last September and a fake article inserted into his archives falsely claiming that German infantrymen serving in NATO had desecrated a Jewish cemetery.
In May this year, a number of Polish sites were attacked and articles with false quotes attributed to the commander of the US army in Europe, in which he allegedly ridiculed the polish army’s ability.
Emails were then sent that were supposed to come from a local press service with links to counterfeit goods to the media and public establishments with the aim of spreading the counterfeits and giving them more credibility.
Lithuanian sites were attacked again in January, with a false story that the first case of Covid-19 in the Baltic country came here from an American officer, a component of the permanent deployment in the country of the Russian raid.
Researchers in Mandiant, a cybersecurity firm, have rebuilt what had been reported as 14 remote incidents and say they are from a broader anti-NATO crusade that has been taking a stand since at least March 2017.
Attribution of hacking attacks is notoriously difficult, however, the research company said it was transparent that the arguments presented were “aligned with Russian security interests,” and that since none of the culprits had been detected without delay, this would mean that “the crusaders are relatively well funded.”
John Hultquist, senior director of intelligence research at Mandiant, said, “The approach of hacking media sites to drive fabricated narratives is powerful,” adding that he hoped he would return to Europe and the United States “as a way to replace perception. “That’s it.”
Fake news was part of a broader misinformation operation that also included articles posted on internet sites that accepted user-generated content with the same anti-NATO narratives. Several pieces were written through a “Rod Renny” and have been published on the pro-Russian Duran online page in English.
There is an example where a non-content site was targeted. In April, a made-up letter gave the impression on the Polish Academy of War Studies’s online page, supposedly written through its commander, and calling on Polish troops to combat “American occupation,” an obvious reference to the NATO Defender Europe 20 exercise.
Also in April, an email saying that NATO would withdraw its troops from Lithuania due to the coronavirus crisis sent to the media, based on a false letter allegedly sent through Secretary-General Jens Stoltenberg to the country’s defense minister.
NATO said it might not comment on the investigation, but aware that it is the goal of misinformation. The army organization was careful to blame Russia, and only said it was the target of “a series of express disinformation attacks” in a report released this month.
Instead, he made more familiar accusations, according to the foreign media in Russia, Russia Today and Sputnik, of spreading news that mixes “true and false elements, which circumvent people’s herbal filters to stumble upon misinformation,” and Russian actors to spread fake accounts on social media. lies online.