Tracking Pro-Kremlin Hidden Connections Reveals Nefarious Online Narratives
At approximately 10:07 AM EST on May 22, 2023, U.S. equity markets sold off rapidly in just a few minutes. The cause was a falsified image of billowing smoke in front of a building with versions of the caption “Explosion Near the Pentagon,” that went viral, with financial news outlets and accounts picking up the story, causing investors to panic. However, users on social media quickly realized that the image circulating was certainly altered or created by a generative AI model leading to a rapid recovery in the market; by 10:10 AM EST, the S&P was being bid again, and by 10:13 AM EST, it was as if nothing had ever happened.
While the financial ramifications of the event were short-lived, it was a showcase of what many have warned about as the barrier to using generative AI models has gotten lower and lower in the past six months. There is no doubt that AI can pose a danger in the wrong hands, but AI can also be used to combat the weaponization of our information environment as well. At Accrete, we are using AI for just that, to bring to light bad actors trying to spread mis, dis, and malinformation. To reveal what’s hidden with disguised cyber connections, Accrete has mapped a revealing network of Kremlin-aligned Twitter accounts that compellingly identifies where pro-Kremlin information is coming from and why they manipulated the U.S. stock market.
The sources of this potentially catastrophic misinformation campaign are very telling. The earliest mentions of an explosion at the Pentagon first appeared on Twitter between 8:30 AM EST and 9:00 AM EST from user @CBKNEWS121. It is difficult to pinpoint exactly who started the narrative and when because users, including @CBKNEWS121, have deleted their posts about the explosion. Over the next hour, the narrative began to take hold and came to a head just before 10:00 AM EST. We identified ten accounts on Twitter that shared the fake image with the incendiary caption in that timeframe, with six of them posting between 9:57 AM EST and 9:59 AM EST. By 10:03 AM EST, the Russian news outlet RT shared the information and financial news accounts, like ZeroHedge, which intelligence officials have warned is known to spread Russian propaganda, followed shortly, including a Twitter account that has since been suspended with the name @BloombergFeed, which was verified to look like an official financial news account and without a doubt contributed to the initial panic.
Scrolling through the ten accounts that posted between 9 AM and 10 AM EST to learn more about them and what they post is possible, but having a full picture about the accounts, any leanings or affiliations they may have, and where they get their information from gets unwieldy and time-consuming quickly. Nebula Social, our powerful social media intelligence AI tool, efficiently discovers and understands all that information.
We initially started with ten accounts, along with four additional accounts that had also spread the disinformation. Nebula Social identified that the accounts are getting substantial amounts of information from pro-Kremlin and even official Kremlin sources and are connected to an extensive number of accounts doing the same. For example, a significant proportion of the seeded and grown network is connected to TASS, the Russian state-run news organization and former President/current Deputy Chairman of the Russian Security Council, Dmitri Medvedev; RT is also one of the most connected news organizations in the network.
Additionally, using network analytics, Nebula Social found connections to numerous accounts with significant reach that are known for spreading information of question legitimacy, such as KimDotcom, Mike Wallace, Jimmy Dore, and Max Blumenthal/Grayzone News. Nebula Social found other accounts with smaller reach that were still central (i.e., well-connected) to the network. While these accounts share a multitude of mutual acquaintances, what is just as vital is that they share a strong affinity for narratives that echo Kremlin talking points. For example:
- The idea that the United States was behind the destruction of the Nord Stream pipeline;
- That sending aid to Ukraine is a waste of United States taxpayer’s money when there are significant gaps in spending on social policy domestically, a known disinformation campaign intended to undermine U.S. support for the war in Ukraine;
- That the war in Ukraine is actually a war of NATO expansion and aggression;
- Broadly anti-NATO rhetoric, particularly as it relates to NATO’s hypocrisy about Ukraine given its previous engagements in the late-20th and early-21st century;
- Russia is warranted in fighting a war in Ukraine to “de-Nazify” the country, one of Russia's justifications for war;
- Speculation that Russia destroyed an American-provided Patriot missile battery with a Kinzhal hypersonic munition, with many focusing on it being an embarrassment to the United States and the manufacturer of the battery as evidenced by its falling share price; and
- The Russian force’s “liberation” of Bakhmut and Ukrainian leadership’s hesitation to acknowledge a loss in the battle.
The timing for this deliberate disinformation campaign has yet to be discussed and is key to understanding why it occurred. Overnight EST into May 22, The Free Russian Legion, a volunteer unit of Russian nationals fighting with Ukraine against Russia, crossed the border and raided the Russian region of Belgorod. By all accounts, the fighters made significant headway, causing the Russian forces to evacuate tactical nuclear munitions from a base approximately 10 km from the border. It took several hours for the Russian military to regain control of towns along the border, at which point many of the accounts in the network posted content highlighting Russian forces successfully pushing opposition forces, “invaders” in their words, out of Belgorod.
The timing of the disinformation about an explosion at the Pentagon is suspicious for two reasons: first, it was pushed out as the U.S. east coast, the center of the financial markets, was waking up to the news of a successful incursion by Ukrainian forces into Russia; undoubtedly embarrassing for Russia. Second, the disinformation campaign was timed with the U.S. market open, providing a high likelihood that it would move markets. Our network analytics show that the group of accounts we’ve identified as having a history of pro-Kremlin support posted messaging that was laudatory of the Russian military’s performance in defeating the raiding force later in the day on the 22nd. The breadth and depth of our information lead us to conclude that Kremlin-run or aligned accounts deliberately spread disinformation about an explosion at the Pentagon. The disinformation campaign was intended to buy time for Russian forces to regain control of Belgorod and shape the narrative in favor of Russian interests.
Fortunately, the image was low enough fidelity that it was quickly identified as false, so the market impact was minimal. But it achieved its intended effect of showcasing the potential dangers of AI-generated content. Ultimately, while AI has the potential to do significant damage when used for nefarious purposes, we can fight fire with fire by using AI to combat mis, dis, and malinformation to keep the information space as accurate and identifiable as possible. Using our social media intelligence platform, Nebula Social, we now have a mapped network of Kremlin-aligned Twitter accounts that we can closely monitor to understand the next narrative that Russia wants to promote. With our deep knowledge of this network, we can accurately and quickly track pro-Kremlin narratives to be better informed about who is targeting us with strategic misinformation and assess the best way to respond.