Operation Overload: how pro-Russian actors flood newsrooms with fake content and seek to divert their efforts

The graffitis, videos or screenshots sent to newsrooms are fake and were fabricated for the purpose of diverting journalist’s ressources, or even try to have their narratives amplified by getting fact-checkers to publish debunks. Operation Overload, as we dubbed the action, is detailed in our latest report, led with the support of Reset.Tech and 20+ fact-checking entities, which shared content they had received.

This operation is remarkable for its scale, the elaborate tactics it employs and the quality of the fake content produced. We uncovered and traced coordinated action on Telegram and X to create artificial dissemination of fake content, as well as on a network of websites controlled by the perpetrators. This content amalgamation technique aims at creating a false sense of a wide online presence of fakes. The next step are the coordinated email campaigns, pointing fact-checkers and journalists at the manipulated images or videos through links to social media and the controlled websites.

This investigation was triggered by the publication of AFP and Antibot4Navalny’s coverage of the operation Martryoshka, reporting about a part of this campaign that unfolded on X. Matryoshka ended up to be only the tip of the iceberg. As Amaury L., CTO of CheckFirst, puts it: “Overload is ‘Matryoshka’ on steroids”. Indeed, the numbers are staggering. Our research shows that more than 800 organisations have been targeted by nearly 2400 tweets. 200+ targeted emails were sent to newsrooms across Europe and beyond. The undertaking achieved its goals in its first months, since we found 250+ articles of fact-checks or debunks mentioning the fake assets created for Operation Overload.

Operatives seek to create divisions between societies. Four countries are the main targets: France, Germany, Italy and Ukraine. The perpetrators time their efforts to coincide with major events, such as the Paris Olympics. The tactics employed clearly attempt to overload the global disinformation research and fact-checking community, causing experts to work extra hours to verify and debunk false content that has been created and distributed specifically to target them. As we show in the report, another stated goal is to attempt to use these professionals to amplify the operation’s false claims and reach a wider audience.

“The actors aim to introduce their narratives to European audiences using innovative methods. They target fact-checkers and media organisations, prompting them to publish debunks or news stories about these narratives. They create an alternate reality, claiming, for instance, that photos of fake graffiti are gaining viral traction on X, or featuring “a video published by DW” and appearing on “many websites,” when in truth, all such content is fabricated by the same actor.”

Guillaume Kuster Co-Founder of Check First 

Our investigation aims to dismantle the fake news environment created by the perpetrators. In this report, we focus on the emails used to target fact-checkers, researchers and newsrooms. We also examine the techniques used to create a false sense of omnipresence of this manipulated content online. The final part of the report analyses the impact of the campaign on the fact-checking community as a whole. 

We would like to extend our gratitude for his assistance in our research to Dr. Hannes Mareen, researcher at IDLab-MEDIA, Ghent University – imec (Belgium), specialised in media forensics, as well as the COM-PRESS project for providing image manipulation analysis. We also wish to thank the following media organisations for sharing assets with us: AAP, Bufale, Butac, CORRECTIV, Detector Media, Dogrula, EFCSN, EFE, Faktabaari, Faktisk, Gwara, Källkritik Byrån, Lakmusz, Les vérificateurs, Pravda, Raskrikavanje, Re:Baltica and Tjekdet. Thanks also to EU Disinfo Lab for having coordinated collaboration between the authors and above listed organisations.

For Media Inquiries:
Sophie Bonnevialle-Chesneau
sophie@checkfirst.network