Russia’s Online Operations Focus on Ukraine Aid and Are Harder to Detect

Russia has intensified its online efforts to derail military funding for Ukraine in the United States and Europe, largely by using harder-to-trace technologies to amplify arguments for isolationism ahead of the U.S. elections, according to disinformation experts and intelligence assessments.

In recent days, intelligence agencies have warned that Russia has found better ways to hide its influence operations, and the Treasury Department issued sanctions last week against two Russian companies that it said supported the Kremlin’s campaign.

The stepped-up operations, run by aides to President Vladimir V. Putin and Russian military intelligence agencies, come at a critical moment in the debate in the United States over support for Ukraine in its war against Russia. While opposition to additional aid may have started without Russian influence, the Kremlin now sees an opportunity.

Russian operatives are laying the groundwork for what could be a stronger push to support candidates who oppose aiding Ukraine, or who call for pulling the United States back from NATO and other alliances, U.S. officials and independent researchers say.

Investigators say that firms working in the “Doppelgänger” network — and Russian intelligence agencies duplicating the tactics — are using the techniques to replicate and distort legitimate news sites in order to undermine continued aid to Ukraine.

These techniques are subtle and far more skillful than what Russia attempted in 2016, when it made up Facebook posts or tweets in the names of nonexistent Americans, and used them to fuel protests over immigration or other hot-button issues.

The loosely linked “Doppelgänger” creates fake versions of real news websites in the United States, Israel, Germany and Japan, among other countries. It often promotes websites previously associated with Russia’s military intelligence agency, known as the G.R.U.

The result is that much of the original speech is First Amendment-protected — say a member of Congress declaring that resources being sent to Ukraine should instead be used to patrol the southern border of the United States. But the amplification is engineered in Russia or by Russian influencers.

Mr. Putin has given responsibility for a growing number of influence operations to a key lieutenant, Sergei Kiriyenko, according to American and European officials. The Treasury Department last Wednesday imposed sanctions on people associated with Mr. Kiriyenko’s operations.

Researchers at Alethea, an anti-disinformation company, have identified a group affiliated with the G.R.U. that is using hard-to-detect techniques to spread similar messages on social media. A report by Alethea echoed a recent assessment by American intelligence agencies that said Russia would continue to “better hide their hand” while conducting influence operations.

“The network demonstrates an evolution of Russian objectives with their information operations,” Lisa Kaplan, the firm’s founder and chief executive, said in an interview. “Where the Russians previously sought to sow chaos, now they appear to be singularly focused on influencing democracies to elect candidates that do not support sending aid to Ukraine — which in turn supports isolationist, protectionist candidates and policies.”

“This long-term strategy, if effective, would result in reduced support for Ukraine globally,” she said.

American officials note, however, that these techniques make identifying — and calling out — Russian operations particularly difficult.

In the 2016 election, the Internet Research Agency, a Russian troll farm that waged information warfare against the United States, spewed out thousands of social media posts, pretending they were from Americans. By the 2020 election, the National Security Agency learned how to disrupt the operations inside Russia.

Moscow moved to shut down the Internet Research Agency after its founder, Yevgeny V. Prigozhin, staged a short-lived mutiny against the Russian military last year. People affiliated with the group remain active. But U.S. officials and experts say it is no longer the main Russian influence effort.

“The Internet Research Agency in many ways was just a place holder for what became a much more expansive information effort in traditional media and social media,” said Clint Watts, the general manager of Microsoft’s Threat Analysis Center.

The latest efforts are more directly controlled by the Kremlin. Before the Treasury sanctions last week, the State Department outlined what it said were efforts by the two Russian companies, the Social Design Agency, a public relations company, and Structura National Technologies, an information technology firm, to create disinformation campaigns.

American intelligence agencies do not believe the Kremlin has begun its full-bore influence effort. Mr. Putin will probably shift at some point from the anti-Ukraine messaging to influence operations that more directly support the candidacy of former President Donald J. Trump, the presumptive Republican nominee.

Mr. Putin is not likely to order a major effort in the presidential election until after the party conventions this summer, officials and experts said.

“What we’ve observed is the Russians, and a number of other adversarial countries, thinking about how and when they might influence the election,” said Jim Himes, Democrat of Connecticut and a senior member of the House Intelligence Committee.

Mr. Putin argues that the United States has sought to influence Russian politics, including the presidential election this month, in which he was, unsurprisingly, re-elected by an overwhelming margin. It is not clear how much Mr. Putin regards U.S. sanctions issued after the death of the opposition leader Aleksei A. Navalny as a kind of interference in his politics.

“Putin believes in his heart that we meddle in his elections,” Mr. Himes said. “Things like contact with dissident groups or amplifying Navalny’s message. Putin sees all of that as interference on the part of the U.S. He regards things like senators and congressmen criticizing his election as election interference.”

The Russian activity captivating American attention is not limited to influence operations. Russia’s S.V.R., the intelligence agency that was most active in the 2016 election and that was behind the “SolarWinds” hack that gained entry to scores of government agencies and major American companies, has been in a monthslong attack on Microsoft. The effort appears aimed at gaining access to emails and corporate data.

And U.S. officials say that ransomware attacks continue to surge from Russian territory.

A wave of such attacks prompted President Biden and Mr. Putin’s only leader-to-leader summit, in 2021. An effort to work together on stemming those attacks collapsed as Russia’s invasion of Ukraine began the next year. Today, the hacking campaigns reap millions of dollars for criminal groups, while often serving the Kremlin’s agenda of disrupting American health care, government services and utilities.

In their annual threat assessment, the intelligence agencies said that Russia was trying to sow discord among voters in the United States and its allies around the world, and that the war in Ukraine “will continue to feature heavily in its messaging.”

“Moscow views U.S. elections as opportunities and has conducted influence operations for decades,” the intelligence report said. “Russia is contemplating how U.S. electoral outcomes in 2024 could impact Western support to Ukraine and probably will attempt to affect the elections in ways that best support its interests and goals.”

Russia is likely to be the most active foreign power seeking to influence the presidential election, though China and Iran have also stepped up their efforts, Mr. Himes said.

“It’s important to remember that the nature of election meddling is very different when you’re talking about the Russians,” Mr. Himes said. “The Russians are orders of magnitude more intense and more focused on what we’ve seen from the Chinese, Iranians and others.”