Mandiant Details How Russia’s Influence Network Is Expanding Beyond Ukraine
Summary
Google Threat Intelligence Group says Russia’s influence ecosystem is shifting back toward global targets while continuing to focus on Ukraine, using interconnected actors, persistent campaigns, cyber-enabled operations, and increasingly generative AI.
Key points
- Russia’s influence operations are broadening beyond Ukraine, with the United States, Europe, NATO, the EU, and Russia’s near abroad among key targets.
- The ecosystem spans government communications, overt media, covert operations, hacktivists, and other aligned actors, whose connections make it resilient to disruption.
- Actors use tactics including media impersonation, direct messaging, narrative manipulation, and generative AI for planning, research, and content creation.
- Cyber activity can support influence goals through destructive attacks, website defacements, hack-and-leak operations, and claims intended to intimidate or shape public perceptions.
- Pro-Russia hacktivists use claimed or actual activity to attract attention, amplify narratives, and sometimes provide cover for state-linked operations.
- Campaigns and infrastructure often persist after exposure or disruption, adapting tactics and mobilizing around new strategic or geopolitical events.
Article Details
- Publisher
- Google Threat Intelligence Group (GTIG)
- Scope
- The pro-Russia influence ecosystem, including its objectives, targeting, tactics, components, and dynamics.
- Key Statistics
- The report identifies five categories of strategic influence objectives.
- State-owned media produce content intended for populations across six continents.
- GTIG identifies six core components of the ecosystem.
- The report distills 10 key ecosystem dynamics.
- Recommendations
- Review Mandiant's guidance on understanding and acting on intelligence about information operations.
- Apply proactive preparation and hardening to protect against destructive attacks.
- Use Linux endpoint hardening guidance to protect against malware and destructive attacks.
- Apply distributed denial-of-service (DDoS) protection recommendations.
- Consider Advanced Protection Program for high-risk users and Project Shield for campaign websites.
People
Threat Actors
APT44Russian government-sponsored threat actor referenced in connection with hacktivist personas and activity supported by the GRU.COLDRIVERIdentified as an alias of UNC4057, which used stolen data in a 2022 hack-and-leak operation.JokerDNRHacktivist persona reported to have amplified the APT44-linked persona Solntsepek.NoName057(16)Self-proclaimed hacktivist group reported to conduct DDoS attacks and network intrusions, primarily targeting Ukraine and its partners and allies.PalachProSelf-proclaimed hacktivist group that claimed in February 2026 to have accessed a Ukrainian government portal; the Ukrainian government said the portal did not store the type of data claimed to have been compromised.RaHDitSelf-proclaimed hacktivist group that reportedly interacted with RT employees and claimed collaboration with multiple pro-Russia hacktivist groups.SolntsepekAPT44-linked persona amplified by JokerDNR, including when it began claiming cyber espionage activity.UNC4057Used data stolen from espionage targets in a 2022 hack-and-leak operation. The report identifies COLDRIVER as an alias.UNC5101Hybrid espionage and influence actor reported to have registered domains and conducted influence operations targeting Russian opposition voters ahead of the March 2024 presidential election.XakNet TeamGRU-sponsored hacktivist persona cited as an example of persistent pro-Russia influence activity.
Products
Advanced Protection ProgramExamples include protecting accounts from targeted attacks with Advanced Protection Program and safeguarding campaign websites from DDoS attacks with Project Shield.Project ShieldExamples include protecting accounts from targeted attacks with Advanced Protection Program and safeguarding campaign websites from DDoS attacks with Project Shield.
Countries
FranceGermanyIt has targeted high profile events, such as the Milano Cortina Winter Olympics, institutions like the French National Assembly, and critical infrastructure and transportation targets in Germany.Polandevents, such as when Portal Kombat briefly promoted narratives about a Russian drone incursion into Poland concurrently with other covert pro-Russia influence activity.RussiaFour years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset.UkraineFour years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset.United KingdomUnited StatesThe United States and Europe: The Kremlin has long viewed the West as a top adversary of Russia.