Aleksandra Atanasova (Reset.Tech), Amaury Lesplingart (CheckFirst), Francesco Poldi (CheckFirst), Guillaume Kuster (CheckFirst) Published in June 2024 under the CC BY-SA licence.

“This report exposes a large-scale, cross-country, multi-platform disinformation campaign designed to spread pro-Russian propaganda in the West, with clear indicators of foreign interference and information manipulation (FIMI). The narratives promoted by the actors are aligned with Russian interests, which is a hallmark of FIMI. At the time of writing, this operation is still ongoing. Operation Overload’s primary objective is to target fact-checkers, newsrooms, and researchers globally with the aim of depleting their resources and exploiting credible information ecosystemsto disseminate the Kremlin’s political agenda. The actors operate through a coordinated email campaign, orchestrated networks of Telegram channels, a network of inauthentic accounts on X (formerly Twitter), and an ecosystem of Russia-aligned websites, including the newly discovered Pravda2 network. A key feature of the operation involves flooding media organisations with anonymous emails containing links to fake content and anti-Ukraine narratives, particularly targeting France and Germany. Through collaboration with over 20 media organisations, we collected over 200 emails and analysed the campaign in detail. Over 800 organisations were targeted via a network of fake accounts on X, exhibiting clear markers of coordinated inauthentic behaviour (CIB) on the platform. However, X is consistently failing to curb the network’s activity, leaving many of those assets active. The actors employ a tactic we dubbed “content amalgamation”, blending various content types and formats to create a credible, multi-layered story. This story is then strategically amplified across platforms, instilling a false sense of urgency among journalists and fact-checkers. Other notable tactics, techniques and procedures (TTPs) include impersonating legitimate media and individuals and exploiting real-world events. The operation serves both domestic propaganda and FIMI purposes. While our report mainl concentrates on the latter, it is essential to acknowledge that the considered fake content originates on Russian social media platforms and spreads on Russian-language websites and blogs, including state media outlets, with the manifest aim to promote the Kremlin’s military agenda to local audiences. The report underscores the remarkable coordination and sophistication of Operation Overload. The campaign is still ongoing, expanding in scope, and evolving new TTPs over time. Media organisations will hopefully find this report a valuable guide for recognising such campaigns and protecting themselves from their elaborate stratagem.”