Russian Intelligence Created Tool to Flood Social Media with Coordinated Inauthentic Behavior, Researchers Find

US media report­ed last month that Rus­si­a’s domes­tic intel­li­gence agency FSB cre­at­ed a tool known as “Fron­ton,” which allows for “coor­di­nat­ed inau­then­tic behav­ior on a mas­sive scale.” Accord­ing to a report by CyberScoop:

May 19, 2022 In March 2020, a Russ­ian hack­tivist group pub­lished a dozen doc­u­ments show­ing that the Russ­ian Fed­er­al Secu­ri­ty Ser­vice was seek­ing tech­nol­o­gy to cre­ate an Inter­net of Things bot­net capa­ble of tem­porar­i­ly dis­abling the inter­net in entire coun­tries.  A flur­ry of news sto­ries cov­ered the doc­u­ments that the hack­ing group call­ing itself “Dig­i­tal Rev­o­lu­tion” released, which exposed a project known as “Fron­ton” that was an alleged tool for car­ry­ing out mas­sive dis­trib­uted denial-of-ser­vice (DDoS) attacks that flood tar­get­ed net­works or com­put­ers with pho­ny traf­fic to ren­der them inac­ces­si­ble.  But DDoS was actu­al­ly just one of sev­er­al func­tions of the tool, researchers with cyber intel­li­gence firm Nisos said in an analy­sis pub­lished Thurs­day, not­ing that the tool also allow for “coor­di­nat­ed inau­then­tic behav­ior on a mas­sive scale” through an online dash­board called SANA that enabled users “to for­mu­late and deploy social media events en masse.”  A live instance of the SANA appli­ca­tion appears to still be online, the researchers said, host­ed by 0day tech­nolo­gies, one of the orig­i­nal devel­op­ers involved in the project. The instance is pos­si­bly a test­ing or demo site, and is like­ly not in use by the Fed­er­al Secu­ri­ty Ser­vice (FSB), they note.

Read the rest here and the Nisos analy­sis here.

The Glob­al Influ­ence Oper­a­tions Report has exten­sive­ly cov­ered Rus­si­a’s attempts to manip­u­late and spread dis­in­for­ma­tion on social media through coor­di­nat­ed inau­then­tic behav­ior and bots. Recent GIOR report­ing has included:

• In May, we report­ed that the Russ­ian troll farm “Cyber Front Z” has tar­get­ed some of the world’s most promi­nent elec­tron­ic musi­cians to spread war mis­in­for­ma­tion and sup­port for Putin’s inva­sion of Ukraine.

• In March, we report­ed that Rus­sia was like­ly behind a viral Twit­ter thread claim­ing to show Ukraini­ans tor­tur­ing each other.

• In Feb­ru­ary, we report­ed that Face­book had tak­en down 40 pro­files tied to a Russian/Belarusian dis­in­for­ma­tion oper­a­tion, say­ing the pro­files were a small part of a larg­er per­sona-build­ing oper­a­tion that spread across Twit­ter, Insta­gram, Telegram, and Russ­ian social networks.