Full Report
By focusing on its strengths and pooling information, the west can disrupt Russia’s war machine – but there’s no time to loseRussia is a “mafia state” trying to expand into a “mafia empire”, the foreign secretary, David Lammy, told the UN, nailing the dual nature of Vladimir Putin’s political model. On one hand Russia represents something very old – a world of bullying empires that invade smaller countries, grab their resources and indoctrinate their people into thinking they are inferior. But it is also something very new, weaponising corruption, criminal networks, assassinations and tech-driven psy-ops to subvert open societies. And if democracies don’t act to stop it, this malign model will be imitated across the globe.Ukraine is resisting the older, zombie imperialism every day on the battlefield, and democracies will have to arm Ukraine and ourselves to constrain Russia properly. But how should we fight the more contemporary tools of political warfare that Russia pioneers? These are becoming ever more prevalent. Globalisation was meant to make us all so integrated that it would diminish the risk of wars. Instead, the free flow of information, money and people across borders also made subversion easier than ever. At the Labour party conference, Lammy indicated that democracies need to work together to stop Russia: “Exposing their agents, building joint capability and working with the global south to take on Putin’s lies.”Do you have an opinion on the issues raised in this article? If you would like to submit a letter of up to 250 words to be considered for publication, email it to us at [email protected] Continue reading...
Analysis Summary
# Threat Actor: Russian State/Associated Networks (General Malign Influence Operations)
## Attribution & Identity
The summary discusses operations attributed to **Russia** operating as a "mafia state" under Vladimir Putin, expanding into a "mafia empire." The activities involve a blend of traditional geopolitical aggression and modern, tech-driven political warfare. Associated entities mentioned include **RT** (state media) and the **Tenet Media** company.
## Activity Summary
The activities detailed focus on malign influence, subversion, and political warfare, rather than a singular cyber operation:
* **Disinformation & Influence:** Using state media (like RT) to spread narratives, fund secret payments to influencers (e.g., paying YouTubers up to \$100,000 per video via Tenet Media) to smear Ukraine, and undermine open societies.
* **Election Interference:** Spending significant funds (e.g., \$100M estimated in Moldova) to subvert elections and referenda (like the EU entry vote in Moldova) by confusing voters and spreading fear of war.
* **Historical Revisionism:** Pushing propaganda (movies, TV shows, maps) in specific regions like Odesa to undermine connection to the sovereign nation (Ukraine) and prepare the ground for potential future takeover (the "Russian world" narrative).
* **Criminal Operations:** Involvement in money laundering and cyber "incidents" against Canadian infrastructure, often linked to RT's activities.
* **Supply Chain Disruption:** Acquiring CNC tools necessary for Russian weapon production, indicating efforts to sustain the war machine despite sanctions.
## Tactics, Techniques & Procedures
- Weaponizing corruption and criminal networks.
- Assassinations and political warfare.
- Tech-driven psychological operations (psy-ops).
- Financial exploitation (money laundering, paying influencers).
- Planting dummy candidates in elections to confuse voters.
- Creating and disseminating pro-Russian cultural products (movies, TV shows) to weaken national identity (Reputational Security offense).
- Exploiting historical, anti-Western, and anti-colonial sentiment in target regions.
- Covert military supply chain procurement (acquiring CNC tools).
- **Associated Cyber TTPs (Implied):** Involvement in cyber "incidents" against infrastructure.
## Targeting
- **Sectors:** Media/Information Space, Political Systems (elections), Global Supply Chains (military-related).
- **Geography:** Global scope, with specific mention of Ukraine (Odesa), Moldova, Africa, the Middle East, US, and Europe.
- **Victims:** Open societies, democratic institutions, specific nations (Ukraine), and audiences susceptible to anti-Western sentiment.
## Tools & Infrastructure
- **Malware Families Used:** Not specified, but general cyber incidents linked to state actors are implied.
- **Infrastructure:**
- **RT (Russia Today):** Public-facing media platform used for covert activities.
- **Tenet Media:** A "Maga-media company" used as a conduit for covert funding to influencers.
- **Networks of Troll Farms, Hackers, Mercenaries, and Criminal Gangs.**
## Implications
The primary implication is the dual nature of Russian malign influence: combining traditional "bullying empire" tactics with sophisticated, contemporary techniques of subversion. If unchallenged, this "malign model" risks being imitated globally by other authoritarian actors. The efforts severely challenge democratic stability, electoral integrity, and supply chain security supporting Western defense efforts.
## Mitigations
- Building joint capabilities and exposing agents involved in influence operations.
- Taking concrete legal action against criminal elements tied to influence operations (e.g., money laundering indictments).
- Improving democratic communication strategies ("reputational security") focused on specific audiences and utilizing cultural figures rather than adopting Russian tactics like troll farms.
- Mapping critical supply chains (e.g., industrial machinery like CNC tools) to identify vulnerabilities and disrupt Russia's war machine through surgical sanctions or company cessation of business.
- Activating "democratic networks" (researchers, activists, media, treasury departments) to coordinate countermeasures against coordinated authoritarian networks.