The fake personas have been used to post articles and op-eds referencing the fabrications as source material to a core set of third-party websites. The issue has been picked up in a new Mandiant Threat Intelligence report.
The report reveals that the Ghostwriting appears to be aligned with Russian security interests. The operations, according to the report, have primarily targeted audiences in Lithuania, Latvia, and Poland with anti-North Atlantic Treaty Organization (NATO) narratives. Much of the material appears to take the form of false COVID-19-related materials also included falsified correspondence from military officials.
In relation to the Russian influence, some aspects of Ghostwriter operations, such as the occasional use of fabricated official documents and correspondences, shows some resemblance to “aspects of the ongoing suspected Russian influence campaign referred to as “Secondary Infektion,” which was first publicly exposed by the Atlantic Council’s Digital Forensics Research Lab“, as the report details.
As an example, a quote was, according to the research, “falsely attributed to the commander of the NATO eFP Battle Group”. This quotation was used to push a narrative that Canadian soldiers stationed in Latvia had been diagnosed with COVID-19. The intention appears to be to cause disruption within the West.
The report cautions that while the operations to date have targeted the above set of countries, the reprotcautions that the same tactics employed in the Ghostwriter campaign can be readily repurposed and used against other target geographies, especially as elections near in countries like the U.S.
Commenting on the report for Digital Journal, John Hultquist, Senior Director of Analysis, Mandiant Threat Intelligence explains the impact of the Ghostwriter campaign beyond Eastern Europe: “Ghostwriter is an information operations campaign designed to attack the NATO alliance in Poland and the Baltics. These stories are designed to undermine the alliance’s forward deployed troops, portraying them as thieves and anti-Semites who hit kids with their vehicles and have carried COVID-19 into the country. US, Canadian, and German soldiers have all been the subject of these narratives.
Hultquist adds: “Doctored photos and documents, subsequently planted in fake stories on compromised media websites are used to create stories that look genuine. By hacking and then leveraging these sites to host their stories, the actors behind this campaign instantly imbue them with the legitimacy of the hosting media organization.
Hultquist concludes by noting: “Ghostwriter is already targeting the West, but the methods associated with it will be seen more and more in Europe and the US as a means to alter perception there. The method of hacking media sites to push fabricated narratives is a powerful one, and we suspect that we will see more of it, possibly prior to the upcoming elections.”
The report is titled “‘Ghostwriter’ Influence Campaign: REPORT Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned with Russian Security Interests”.
