It’s truly unsettling to witness how even seemingly innocuous corners of the internet can become battlegrounds for information warfare. The story of Ben Gilbert, an economist and professor at the Colorado School of Mines, perfectly illustrates this. Ben, as described on his social media, is a man of diverse interests – an intellectual, a dog lover, and a rugby fan. He’s not someone you’d expect to find at the center of a geopolitical propaganda campaign. Usually, his few posts on Bluesky, a social media platform, revolve around his academic expertise in natural resources. Yet, one day, a video mysteriously appeared on his account, not of a rare mineral or an economic trend, but a fabricated news report. This video was designed to blame France’s support for Ukraine for police shortages at home – a blatant piece of Russian propaganda. Ben, utterly unaware, had become an unwitting pawn in Russia’s latest strategy to manipulate public opinion in the West. His experience wasn’t isolated; hundreds of other Bluesky accounts, from journalists and professors to artists and filmmakers, suffered the same fate, all hijacked to spread fake news.
This coordinated effort, identified by the researchers at Clemson University, reveals a worrying escalation in Russia’s ongoing attempts to destabilize Western support for Ukraine. The “dTeam,” a collective of internet monitors tracking these influence operations, linked this campaign to the Social Design Agency in Moscow. Bluesky, for all its growing prominence as an alternative to X (formerly Twitter), where Elon Musk’s political leanings have reshaped its landscape, is still a considerably smaller platform with 42 million users compared to X’s nearly 600 million. While deep-seated Russian disinformation campaigns have long plagued social media with fake accounts, this new tactic of hacking into genuine users’ accounts signifies a more sophisticated and insidious approach. Darren L. Linvill, a director of Clemson’s Media Forensics Hub, aptly points out, “They are clearly still experimenting. They’re always experimenting.” This constant evolution of tactics underlines the persistent threat of online disinformation and the need for vigilance. Bluesky itself has been working diligently, tracking and removing thousands of these malicious posts that appeared in waves since April, acknowledging that such Russian influence operations are “an industrywide problem” that demands significant resources for detection and disruption.
Many victims, like Ben Gilbert, only discovered they were compromised when contacted by news outlets or were suddenly locked out of their accounts. Pamela Wood, a political reporter at The Baltimore Banner, experienced this firsthand while on vacation. Her account was suspended after it posted a video alleging a link between Ukraine and the man accused of attempting to assassinate Donald Trump. The irony, as Ms. Wood described, is that her account was “rather vanilla,” primarily used for sharing her stories. The idea of her meticulously curated professional identity being exploited for such a purpose underscores the indiscriminate nature of these attacks. Clemson’s analysis further attributes this campaign to a larger Kremlin operation known as Matryoshka, named after the iconic Russian nesting dolls. This operation, active since 2024, specializes in producing highly convincing fake articles designed to mimic legitimate news sources like Reuters or France 24. The unsettling goal behind this is not just to spread the initial false claims, but to encourage fact-checkers to debunk them, giving the propaganda even more visibility and legitimacy. Then, Russian news outlets frequently cite these fabricated posts, deceitfully suggesting that the Western-created content supports their narrative, blurring the lines of truth and further muddying the already murky waters of online information.
What makes this particular campaign so alarming is its “level of sophistication beyond what we usually see,” according to Joseph Bodnar, a researcher with the Institute for Strategic Dialogue. He notes that while hijacking accounts on X is common, those are typically “random, obscure accounts with crazy avatars.” In contrast, the Matryoshka operation specifically targeted “moderately known or respected” individuals on Bluesky, leveraging their credibility to lend an air of authenticity to the fabricated content. While Ukraine remains the primary target, these campaigns also serve broader Russian geopolitical interests. Past operations have attempted to undermine the preparations for the 2024 Summer Olympics in Paris and discredit the Trump administration’s dismantling of the U.S. Agency for International Development. The latter, featuring fabricated videos of celebrities like Ben Stiller ostensibly being paid by USA.I.D. to travel to Ukraine, was one of Russia’s most successful disinformation campaigns, reaching millions of viewers and highlighting the immense impact of such manipulations.
The recent Bluesky incidents, though touching upon Donald Trump, primarily reveal Russia’s intense focus on France and Armenia. France, under President Macron, has emerged as a vocal and active leader in bolstering European support for Ukraine, making it a prime target for undermining. Armenia, a former Soviet republic, is also in Russia’s crosshairs, as upcoming elections could further distance it from Moscow’s influence. This strategic targeting demonstrates Russia’s multifaceted approach to destabilizing regions and manipulating international relations through disinformation. It’s a game of probabilities for the perpetrators, as Mr. Linvill succinctly puts it: “They just have to get lucky a couple of times for this to be worth it.” This outlook highlights the scale of the challenge we face in combating such campaigns. Even if only a fraction of their efforts succeed in swaying public opinion or sowing discord, the cumulative impact can be significant, reinforcing the urgent need for robust cybersecurity measures, critical media literacy, and collective efforts to protect the integrity of information in our increasingly interconnected world.