This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.
Meet the Dark Lady
Most of the non-Russian-language accounts involved in the Russian information operation were burner accounts created to post a single article and then abandoned. A few, however, were used repeatedly, especially when they posted about Russia’s foreign policy interests.
One of the most significant was the persona variously called “Dama Mroczna” (Polish for “the Dark Lady” or “the Gloomy Lady”) and “Anna Mroczna.” This account is of particular interest because its activity shows that the operation has been ongoing for a number of years, with a focus on advancing Russia’s geopolitical interests.
In the first indication that this persona was part of the operation, a Facebook page that claimed to be Irish — now identified as a Russian asset — shared a Medium article one of the Mroczna personas claiming that the United States had staged Armenia’s 2018 political revolution.
Of course, the fact that a known Russian operation shared an article need not mean that the operation created the article. Other indicators suggest that it did, however. First, the Dama Mroczna account made this sole post on Medium on April 30, 2018, and then abandoned the platform, exactly as the Russian operation did.
Second, the same day, a user account called “Anna Mroczna” posted an identical article to conspiracy forum beforeitsnews.com, a site that the Russian operation used repeatedly. The account used the same profile picture as “Dama Mroczna.”
The profile picture was of low quality, but a reverse search confirmed it was taken from a poster, shared on Pinterest, for Spanish black-and-white movie “Blancanieves” (Snow White) by Pablo Berger.
Unlike the Medium variant, “Anna Mroczna” posted nine times on beforeitsnews.com. Its most recent post, dated to March 1, 2019, was a share of the Russian operation’s claim that the United States was planning a false-flag chemical attack in Venezuela. This provides another indication that the Dark Lady was part of the operation.
Triggering Trump
An earlier article, posted on June 21, 2018, alleged that controversial Ukrainian doxxing site Myrotvorets (literal translation: “Peacemaker”) had blacklisted U.S. President Donald Trump for his stance on Crimea. The only piece of evidence provided was a screenshot attributed to a Google translation of the Myrotvorets site, with the comment, “At the time of this article’s publication all records with Donald Trump were deleted from the ‘Peacemaker’ website, however a screenshot is still available.”
The image closely matched the layout of the genuine Myrotvorets page. Language clues are less relevant here, as the post was allegedly machine translated, leaving little internal data to confirm whether the screenshot was genuine.
External clues, however, indicate that this was a forgery. First, Google searches for the phrases “Ukraine puts Donald Trump on blacklist” and “Peacemaker puts Donald Trump on blacklist” only returned one relevant hit, discussed below. It would be implausible to suggest that genuine outlets would have ignored such a shocking story if it was authentic, given the reputations of Myrotvorets and of Trump himself.
Second, the one relevant hit was an article posted on Medium on June 20 with the exact same headline as the “Anna Mroczna” piece, and the exact same text. Rather than “Dama Mroczna,” though, it was attributed to “Mike Davidson,” an account that only posted the one article and whose profile picture was a reversed shot of American artist Michael Bond.
Although it did not show up in the Google search, the English article appeared in one other location: the forum homment.com, where it was attributed to “MiDavid.” An ostensibly Irish account that Facebook identified as “emanating from Russia” also shared the article.
Finally, a Spanish translation of the article surfaced on June 21 on at least three different forums: globedia.com, taringa.net, and entornointeligente.com. A Facebook account that the platform later took down as part of this operation then shared the Spanish-language version of the article.
The DFRLab repeatedly observed this operation’s use of Medium, homment.com, and beforeitsnews.com to amplify false stories. The amplification by an English-language account known to be part of the operation reinforces the attribution. The simultaneous posting in Spanish, as well as the amplification by yet another operation account, confirms it.
This appears to have been an attempt — albeit an unsuccessful one, as most of this operation’s attempts were — to spread a story discrediting Ukraine and raising the tensions between Kyiv and the White House.
Buzzing Buzzfeed
Two other articles posted by “Anna Mroczna” deserve attention. Both were dated to late 2017, showing that this operation was of some duration. The longer of the two articles, posted on December 26, 2017, dealt with the relationship between the United States and Ukraine in wholly negative terms.
It began with a reference to Ukraine’s 2013–14 Maidan Revolution: “So-called Ukrainian ‘maidans’ have bored the world community to death.” It continued with a lengthy conspiracy about a turf war between the U.S. Federal Bureau of Investigation and the Central Intelligence Agency in Ukraine:
A never-ending internal fighting in the American national security environment has become the talk of the town being eventually accreted with new dirty wash.
Most of the amplification of this article was typical of this network, using single-use accounts to post it on different platforms. The English-language article popped up the same day on three other forums: Medium, justplainpolitics.com, and homment.com. The first two attributed it to a user called “Mark Kravets,” while homment.com simply attributed it to “homment.” The account on justplainpolitics.com was created the same day, and did not return to the site after it made its one post. Three weeks later, on January 15, 2018, a user called “Sergei Zelenetskiy” posted the Russian translation of the article, sourced to the Medium post, on a number of forums, including aftershock.news and kont.ws.
Most strikingly, however, the Dark Lady’s original article gave a hyperlink to its source: a post on Buzzfeed attributed to one “Mark Kravets.”
The Buzzfeed link was broken, and it remains unclear whether the post ever actually made it onto the site or whether the Russian operation created a false URL to make it look as if it had. If the operation did manage to post its content under the Buzzfeed domain for any length of time, it would mark one of its greatest observed successes to date.
Killing Kim
The Dark Lady’s most outlandish article was also its earliest, posted on November 20, 2017. Headlined “Attempted Assassination of Kim Jong-un scenery” — was the last word meant to be “scenario”? — it pointed users to an article on homment.com with the teaser comment, “This article looks like conspiracy, but I thought it might be true.”
The homment.com story was posted on November 10, 2017, and did not name an author. Yet again, its language and syntax featured errors characteristic of native Russian speakers. The DFRLab included multiple quotes here out of sheer fascination with the errors littering the language of a self-proclaimed American journalist.
“As the saying runs, there is a shard of truth in every joke.”
“After mentioning the North Korean dictator, one the soldiers who came for lunch approached us and asked whether I was an American. Having a positive reply he energetically told that his brother was one of the ‘three thousand’…”
“I did not dare to ask more for fear to be taken for a spy. The same matter stopped me from addressing the US Command. It is one thing to give coverage to everyday life in training military units. But it is totally different to query about the future combat operation. I was lucky enough to meet too boastful military man (which is common among the far eastern people) and to hear more than I should to.”
As well as homment.com, the story turned up on two other sites on November 10, 2017. One was Medium, which the operation used with especial frequency. The username there was “MilitaryObserver”; this was its only post.
The other site was Reddit. The user had the same name as on Medium — “Military Observer” — and only posted this one article to two subreddits, r/news (where it simply posted the Medium link) and r/korea (the full article).
In the following days, the article appeared in French and Ukrainian translations. The French version was posted to a video-games forum, jeuxvideo.com, by an account called “riu128,” that only posted this one piece. The Ukrainian version surfaced on blog site politiko.ua, again posted by a single-use account.
A French user posted the only reaction to the article, replying, “That was riu128, live from South Korea for Google Translate.” The Korean conspiracy piece is noteworthy as an early attempt to spread a fake through multiple language environments using burner accounts, not because it was a success.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).
Kanishk Karan is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).
Eto Buziashvili is a Research Assistant with the Digital Forensic Research Lab (@DFRLab) based in Tbilisi, Georgia.
Follow along for more in-depth analysis from our #DigitalSherlocks.
