Vulkan Files
Secret documents expose how NTC Vulkan, a defense contractor in Moscow, aided Russian intelligence agencies in enhancing their capabilities for cyberattacks, disinformation campaigns, and internet surveillance. The investigation revealed NTC Vulkan's connections to "Sandworm" and "Cozy Bear," and provided details about the software systems employed to disseminate and coordinate online disinformation.
Publications
Background
It is a known fact that the Russian state engages in large-scale disinformation campaigns. The Vulkan Files investigation allows for the first time a peek into the capabilities and infrastructure of the Russian disinformation machinery.
Over 50 journalists worked together to comb through a leak of over 1000 documents, thousands of pages of project plans, user manuals, and e-mails. What we found sheds light on NTC Vulkan, a supplier of disinformation software for Russian security services.
Under the name Amezit, NTC Vulkan develops tools for disinformation purposes. Its capabilities are, among others:
- Automatic creation of accounts on multiple platforms
- Large-scale posting of messages and replies to other posts
- Multiple campaigns that operate in parallel
We developed methodologies, wrote custom software, and produced dozens of spreadsheets to track down traces of the Amezit disinformation networks in the real world and attribute them to the #VulkanFiles.
We found around a thousand accounts that can be associated with the #VulkanFiles and engaged in disinformation campaigns – some were software tests, but many touched on real-world events. Those campaigns push Russian state narratives within its sphere of influence and beyond.
One campaign pushed a screenshot of a forged letter, allegedly written by the German Consul in Donetsk, urging NATO to exclude Russia from UEFA and the Eurovision. They belittled the victory of Conchita Wurst 2014 and claimed it was a response to the annexation of Crimea.
Another campaign shared a screenshot of a fake USAID email claiming that the US is meddling in Armenia’s election. This email has been debunked. (DFRLab)[https://medium.com/dfrlab/fakes-bots-and-blockings-in-armenia-44a4c87ebc46] already reported on this earlier.
Ruthless was the campaign that denied civilian casualties in Syria due to Russian airstrikes. This narrative is cynical and wrong as the (Syrian Archive)[https://syrianarchive.org/en/datasets/russian-airstrikes] has conclusively shown. It denies victims of the Syrian war any justice.
The #VulkanFiles spotlighted NTC Vulkan, a supplier of tools and infrastructure that allows Russian intelligence services to engage and improve their disinformation capabilities. Sadly, there is no sign that the Russian state will soon disarm.
Recent technological developments will only improve the means and methods with which Russia and other bad actors, private or state, will engage in disinformation campaigns. Journalists and civil society must develop more tools and new strategies to combat those in the future.