Pierluigi Paganini
October 23, 2024
Resecurity has detected a substantial increase in the distribution of political content related to the 2024 US elections through social media networks, particularly from foreign jurisdictions. Social media can create echo chambers where users are exposed primarily to information that reinforces their existing beliefs. This phenomenon can polarize public opinion, as individuals become less likely to encounter opposing viewpoints. Such environments can intensify partisan divides and influence voter behavior by solidifying biases.
For example, on October 5, 2024, Resecurity identified multiple accounts for sale on Telegram that were impersonating government entities, including the White House, the FBI and the CIA, as well as popular media outlets such as CNN and the Washington Post. One of the accounts impersonating Donald Trump, ‘DonaldTrump_feedback,’ was also put up for sale. The accounts were offered for sale on Fragment, a marketplace for Telegram accounts. Multiple Telegram accounts with the U.S. elections narrative have been identified; they have been registered and offered for sale between 10 TON ($51) and 2028 TON ($2290). Such accounts will be of great interest to political consultancies and foreign adversaries aiming to target a specific segment of the audience.
Currently, the accounts spread content designed to shape negative opinions about political candidates and discredit U.S. elections. One of the foreign adversaries’ critical goals is to plant social polarization and distrust in electoral integrity. This is a crucial component of these campaigns. Often, these campaigns promote and discourage both candidates, as they do not intend to promote one candidate over the other. They plan to sow distrust in the election process and encourage animosity among the constituents of the losing candidate against the winning candidate and their supporters. Similar identified accounts are being used to target Volodymyr Zelenskyy, the President of Ukraine, and Maia Sandu, the President of Moldova. Notably, the Telegram account designed to discredit Moldova’s incumbent president, Maia Sandu, who supports the country’s integration with Europe, appeared one month before the referendum.
Resecurity identified several associated groups promoting the “echo” narrative – regardless of the main profile of the group. For example, a group that aims to support the Democratic Party contained content of an opposite and discrediting nature. Notably, most user profiles identified in such groups contain vague descriptions and patterns characteristic of ‘troll factories’.Resecurity has observed notable activity of a similar nature originating from the Vkontakte (VK) social network. The company has assigned the codename “Psy Ops, Inc.” to this activity, which is the name of one of the accounts identified earlier that was involved in planting such content online. Resecurity identified several clusters of accounts with patterns of a ‘troll factory’ that promotes negative content against the U.S. and EU leadership via VK, written in various languages including French, Finnish, German, Dutch, and Italian. The content is mixed with geopolitical narratives of an antisemitic nature, which should clearly violate the existing Terms and Conditions of the network. The identified accounts remain active and constantly release updates, which may highlight the organized effort to produce such content and make it available online.
A month ago, the United States Department of Justice charged threat actors working for a foreign state-controlled media outlet (RT) in a $10 million scheme to create and distribute content to U.S. audiences with hidden Russian government messaging.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, 2024 US elections)
