CheckFirst and Filigran connect the Pravda network to OpenCTI
Meet the CheckFirst Import Connector, our new connector ingesting our data from our investigation into the Pravda network.
Having conducted many investigations into information manipulation campaigns, we know that they do not operate isolated. The same state actors that conduct cyber espionage also orchestrate disinformation campaigns; we demonstrated it multiple times in our research into the Pravda network, or else the GRU’s Information Operations Troops. Infrastructure overlaps (shared hosting, coordinated domain registration, bot networks) make it impossible to analyze one threat without the other.
Defenders need a single operational platform that bridges Cyber Threat Intelligence (CTI) and FIMI analysis, and they need structured, actionable data to feed it. Enter OpenCTI: developed by Filigran, it is the only open-source threat intelligence platform purpose-built to handle both CTI and FIMI workflows. VIGINUM’s April 2025 doctrine explicitly recommends OpenCTI as the platform for capitalizing on information threat knowledge, using STIX 2.1 as the common language.
Structuring knowledge on the Pravda network
The CheckFirst Import Connector provides access to the CheckFirst Pravda Network Feed, a complete database of over 7 million articles published by the Pravda network since its inception. New articles from the network are detected and ingested every day, ensuring your knowledge base stays current. Each article’s structure follows state-of-the-art recommendations for identifying, modeling, storing and enriching threat knowledge. The connector offers a ready-to-deploy external import connector that handles API authentication, pagination, state persistence and batch ingestion automatically.
The CheckFirst Pravda Network Feed is available on an annual subscription basis, with progressive tariffs depending on the nature of the client. All tiers include full access to the historical archive (7M+ articles), daily data updates, OpenCTI connector with technical documentation, and email-based technical support. If you’re interested, please contact us at info@checkfirst.network.
Filigran, a cybersecurity company founded in 2022, offers open-source, AI-powered solutions covering end-to-end threat intelligence management, attack simulation, and security posture validation.
Founded in 2020, CheckFirst is committed to protecting the online information landscape from online harms through tailored products and services.
Indeed!, the CheckFirst Newsletter
Discover Indeed! our homemade newsletter delivered straight in your inbox with all the updates from Check First and it’s projects!
Subscribe
“Pravda” Network: Worldwide Expansion and LLM, Wikipedia Pollution
CheckFirst, in partnership with DFRLab, shows how the Russian propaganda and disinformation “Pravda” network extended its coverage and aims (and succeeds) at polluting large language models (LLMs) and Wikipedia. Lastly, we demonstrate the inability of X’s Community notes to aptly address the spread of “Pravda” content on the platform.
Decoding Secrets Through Symbols: How Military Insignia Revealed Russia’s Hidden SIGINT Network
Sometimes the best intelligence comes from the most unexpected sources. Our latest investigation proves this by using Russian online military insignia stores to map one of the FSB’s most secretive units.
A collective approach to documenting the supply chain of disinformation
Together with EU DisinfoLab, Viginum, Cassini, the Auswärtiges Amt, the EEAS and the DFRLab, we decided that it was time to organise our shared knowledge for the benefit of the community, using the Viginum-developed Information Manipulation Set (IMS) framework.
Understanding Your New Rights Under the EU’s Digital Services Act: A User’s Comprehensive Guide
New EU regulations are reshaping internet user’s social media experience and how online advertisements impact them. This article aims at pointing out what changes the Digital Services Act (DSA) already caused on many platforms you may use. The legislation is targeting Very Large Online Platforms (VLOPs) and search engines (VLOSs). Let’s dive in to understand what these changes mean for the users of those platforms.