An online misinformation campaign has been turning old news stories into fresh fake news, according to the threat analytics firm Recorded Future.
While the identity of those running the campaign is unknown, the group has been dubbed “Fishwrap” by Recorded Future’s chief technology officer Staffan Truvé “since it uses old news for new purposes”.
The Fishwrap campaign was discovered while monitoring social media platforms for reports of terror attacks. In the process, a network of more than 200 accounts was discovered that were talking about attacks not reported elsewhere – attacks which, on closer inspection, were supported by links to real news stores about historical attacks.
“They were talking about them as though they were new, but linking back to the old news stories,” Truvé said. “These could have all been independent, but then we found that they were all using a family of URL shorteners. And all these URL shorteners were running on an anonymous Azure service. So this made us understand that this was a larger campaign.”
The report claims: “The fact that the operation has been going on for close to a year, and that it is spending money on numerous domains on dedicated servers, leads us to believe this is not just someone running the operation ‘for the lulz’, but rather a political organisation and/or nation state with an intent to spread fear & uncertainty, and track followers of the posted links.”
The accounts shared “news” about incidents such as the 2015 Paris terror attacks but with the date and other context removed in an apparent attempt to make the news go viral a second time.
“There are two candidates here,” Truvé said. “It’s either a state-sponsored misinformation campaign, or it’s a domestic alt-right thing, because it is focused on terror events to do with Muslims. Or it could be what we call ‘operational preparedness’ – they’re up, active, creating history for themselves and their accounts, and then they want to use it in the future to spread original fake news.”
But without specific information about the users that only the social networks have access to, Recorded Future cannot be more definite in its attribution. “Whichever way this is set up – they’re not breaking any laws, they’re not breaking even the terms of use of Twitter,” Truvé said.
Misinformation campaigns, also known as “influence operations”, frequently use a combination of technical and societal factors in an attempt to spread propaganda. For instance, a computer vulnerability may be exploited to register hundreds or thousands of fake accounts, which are then deployed to influence curation algorithms and boost a particular news story or topic.
