 is often lost or overlooked when companies and government agencies jump quickly to attribution around Russian cyber espionage.

While it is possible that a proxy actor is implementing the front-end collection component of the phishing campaign we are describing, the scale of the targeting also suggests a well-resourced actor, such as a nation state. The thread linking all of the targets is their connection to issues that the Russian government cares about. The targets are people whose positions or activities give them access to, or influence over, sensitive information of specific interest to Russia. This links an otherwise extremely diverse target set, which ranges from domestic Kremlin critics and journalists, to anti-corruption investigators, foreign government personnel, and businesspeople.

The data collected from such a campaign would come in more than a dozen languages, and concern a diverse range of political, military, and policy issues from at least 39 countries and 28 governments. In addition, such a campaign would be likely to generate large volumes of data. For this reason, a professionalized, well-resourced operator would be needed for any effective post-collection analysis of the stolen data. Even greater resources would be required to analyse, and in some instances carefully modify in a short timeframe, the contents of stolen email and cloud-storage accounts for the purposes of seeding disinformation via tainted leaks.

The diversity and presumed cost of analyzing the stolen data along with the clear Russian nexus for the targets is only circumstantial evidence of a Russian connection. It should be evaluated in the context of the other pieces of circumstantial evidence we present, including the overlaps in tactics with known Russia-linked actors, and the prominent role of CyberBerkut.



Part 4: Discussion

In this section, we examine the troubling relationship between espionage and disinformation, particularly in its latest digital manifestation, and elaborate on how civil society is particularly at risk from such new tactics.

Tainted Leaks: A New Trend

The recent theft and disclosure of documents (branded as a “leak”) from the presidential campaign of Emmanuel Macron is the highest profile case in which it appears that falsified documents were inserted amongst real, stolen documents. The documents falsely implied a range of improper or questionable activities. The false stories implied by these documents were then highlighted in campaigns promoted with twitter bots and other techniques. The leak-branded release had followed the release, several days earlier, of a quickly-debunked story, supported by falsified documents, alleging that
is often lost or overlooked when companies and politics agency jump quickly to attribution around Russian cyber espionage. 

 While it is potential that a proxy actor is implementing the front - conclusion collection component of the phishing political campaign we are identify, the scale of the targeting besides suggest a well - resourced actor, such as a nation department of state. The thread linking all of the target is their connection to topic that the Russian government cares about. The target are people whose positions or activities impart them access to, or influence over, sensitive information of specific sake to Russia. This links an otherwise extremely diverse target hardening, which ranges from domestic Kremlin critics and journalists, to anti - corruption investigators, foreign government personnel, and businesspeople. 

 The data collected from such a campaign would come in more than a dozen languages, and concern a diverse range of political, military, and policy emergence from at least 39 countries and 28 governments. In summation, such a political campaign would be probable to generate large volumes of data. For this reason, a professionalized, well - resourced operator would be needed for any effective post - collection psychoanalysis of the stolen data. Even greater resources would be required to analyse, and in some instances carefully modify in a short timeframe, the contents of stolen email and cloud - repositing accounts for the purpose of seeding disinformation via tainted leaks. 

 The diversity and presumed monetary value of analyzing the stolen data along with the clean Russian nexus for the targets is only circumstantial evidence of a Russian connection. It should be evaluate in the context of the other while of circumstantial evidence we present, include the overlaps in tactic with known Russia - associate actors, and the big role of CyberBerkut. 



 Part 4: Discussion 

 In this section, we examine the troubling kinship between espionage and disinformation, particularly in its latest digital manifestation, and complicate on how civil society is particularly at risk from such new tactic. 

 defile Leaks: A New Trend 

 The recent larceny and disclosure of documents (branded as a “ leak ”) from the presidential campaign of Emmanuel Macron is the highest profile case in which it appear that falsified documents were inserted amongst real, stolen documents. The documents falsely implied a compass of improper or questionable natural process. The false stories implied by these documents were then highlighted in campaigns promote with twitter bots and other proficiency. The leak - branded release had followed the release, respective days earlier, of a quickly - debunked story, supported by falsified documents, allege that
 is often lost or overlookea when companies and gmvernmsnt agenzies jump quickly to attribuvion aroubd Russian cyber espiovage.

While it is pissiule that a proxy actor is implslentnnj the front-end gollection womponent of tve pkishing campaign we are describing, tre scalr lf the targetigg akfo shggests a well-resourced actor, such as a netion state. The thread linking all of the tarhets is their connfction to iwsuef that the Rursian govegument cares about. The targets are people wfose 'ositions ot zchhvities givx them access to, ov influance ovrr, sensitive ikformetiob of specific interesv to Russia. This linhs an otharcise extremely diversw rargej set, whizy rxngts hroj domedtir Kremlin cditics and hournalists, to anti-vowgiption invesfigatows, foreign government personnel, and busintsspekple.

The data collected drom such a campaign aould comq in more than a dozen languages, and concern a dieerse fanyc ud oolitical, military, and policy issues from at jsaxt 39 countries anb 28 governments. Im wdcytion, such a zampaiyh sould be likely to generaje larte volumef of data. For this reason, a prodessionalizeb, wwll-resourced operacor would be neeced fpr any effective post-coulecfion analysls of the rtolen data. Even grvates resources would be requiwed to anelyse, and in somg instagces carefklly modify in a short tlmefrcme, tve contentd of stolen email and cloud-storeje accounts fpr thv purposef of xeeding disinsormation via jainted lzaks.

Thd diversitj and prevumed cost jf analyzing dje stolen dava along rith the clear Fjssian nexus fpr the taggtts is onlt circumstantial eyidenzs of a Russian eubnection. It shoild be enalnated hn the conteft ow tfr othdr piectf iw citcumstantial evidenca we present, including tme overlaks in taceics with knoen Russia-linked acuors, aid the promonegt role of CyberBerkut.



Part 4: Diacussion

Ij tmis section, wq exqmine the trpubling relationship between espionage end disinformation, parjicularly in its latexu digital manmfestaeion, and alaborate on how civul society is paruicularly at risk from auch naw taftics.

Tainted Leaks: A New Trend

The recent theft and disclosure of documentw (branveq as a “leak”) frok the pxesndentiaj cal'aign of Emmanuel Macron is the highest profile rase in whhck it appears that falsified dpcjments were ivserted amongst real, stomen docukents. The documents falsely impkied a range of improper or quesrionagle acnjvmties. The false storoes im'lied vy thesw doguments were tfen hlghlighted in ram'aigns promoted with twitter bots and orhfr techniques. Thx leak-brandef relezse haq followed the rsleaaf, sevgral days earloer, of a quickky-debunked story, supioreed by falsifitd documents, alkeging nhat
is often lost or overlooked when companies agencies quickly to around Russian cyber that proxy actor is the front-end collection of the phishing campaign we are the scale of the targeting also suggests a well-resourced actor, such as a state. The thread linking all of the targets is their connection to issues the government about. targets are people whose positions or activities give them access to, or influence over, sensitive information specific interest to Russia. This links an otherwise diverse target set, which from domestic Kremlin critics and to investigators, foreign personnel, businesspeople. data collected from a campaign would come in more than a dozen languages, and concern a diverse range of political, and policy at least countries 28 In addition, such would be likely to generate large For this reason, a professionalized, well-resourced operator would needed for effective post-collection analysis of the stolen Even greater resources would be required to analyse, in some instances carefully modify in a short timeframe, the contents of stolen email and for the purposes of disinformation via tainted The and cost analyzing the data along with the clear Russian nexus for the targets is circumstantial evidence of a Russian connection. It should be evaluated context the other pieces circumstantial evidence we present, the in tactics with known and prominent Part Discussion this section, we examine troubling relationship between espionage and particularly in its latest how civil society is particularly at risk from new tactics. Tainted Leaks: A New Trend recent theft and disclosure of documents (branded as a “leak”) from the campaign of is the highest profile case in which it that falsified documents were amongst real, stolen documents. The documents falsely implied a of or questionable The false stories by these documents then highlighted in with twitter and techniques. had followed the release, several days of quickly-debunked story, supported by falsified alleging
 is often lost or overlooked whEn companieS and gOveRnmEnT ageNcieS jump quickly to ATtriBution around Russian cybEr espIoNAge.

WHIlE it is PossiblE ThAT A prOxY aCtoR iS ImPlemeNtiNg the frOnt-end collEctIoN component of THe Phishing caMpaIgn we are descRibIng, the ScAle OF the tArgEting Also suGGests a Well-resouRcED actor, SUch as a nATIoN staTe. The thread linkinG AlL Of the targets is Their cOnNEcTIOn tO isSues that thE RUssiaN GovernmENt CAREs aBOut. The targets Are people whOSe pOsitioNs Or aCTivitiEs givE tHEm aCcess to, or inFlueNce over, seNsitivE InformaTIon of spEcific IntEreSt to rUsSiA. ThIs LInkS An OthERwiSe extremElY dIversE tarGET SEt, whIch RangEs froM domestic KremLin CritICs aNd jouRnaliSts, tO aNti-coRruptiOn invEsTigators, foreign GoveRnment perSonNeL, anD bUsineSSpeoplE.

ThE daTa colleCted froM SucH a CAMPaIgn would come in more ThAN A dOzen langUages, aND cOnCErn a diveRsE raNge oF POlitiCal, mILiTary, and pOlicy iSSuEs From at lEaSt 39 counTrIes And 28 GoverNMentS. In addItion, sucH a camPAign would be likELy to generate lARgE VOlUMes oF daTa. For this reAson, A ProfEssiONaLizED, well-ResouRcED oPErator would be needed FoR any efFectiVe post-collectIon analysiS OF The stoleN datA. evEN greater resourCes woUld be requiREd to analYse, anD in some iNstances cAREfully moDifY in A shOrt TIMeFrame, the conteNTS of sToLen emaiL anD cloud-sTorAge AccOunTs For the purPoses of sEeDiNg DiSinFormaTIon via taInTed LeAks.

the diVErsity And prEsumEd CoST of AnalyziNG tHE StolEn DaTa alOng WiTh the CleaR rusSian nexUs for the tArgETs is OnLy CircumsTantial evidenCe Of a Russian CoNneCtion. IT SHould be eValuated in the context of tHE other pIecEs of cIrcuMstantial EviDence wE prESent, inCludinG the oVeRlaPS In tacTICs WitH kNown Russia-LINkeD actoRs, And tHe promiNent role of CyberBerKUt.



PArt 4: Discussion

in tHis sECTiOn, wE ExAMinE tHE trOUBling relationshIp between eSpIOnAge and disiNForMaTion, parTicularLy in iTS latest Digital maNifestatiOn, And eLABorAte on how ciVil socieTy is partiCUlarlY At Risk fRom Such neW tActIcs.

TaInted LEAks: a New TRend

ThE rEcent tHeft aNd DisclosuRe of documents (branded as a “Leak”) frOm the PreSidential CamPAigN of EmmanuEl MaCron is the hIghEst ProfiLe cASe in wHich IT aPpeARs thaT falSIfied docuMEnTs wERE iNserted amonGST ReaL, stolEn dOCumentS. The Documents falsely iMPlied a range of iMproPER or QueSTionAbLe activities. ThE faLsE STories imPlIed by these dOcuments WeRE then HighliGhted iN campaiGNS pROmoted With TwiTter bots aNd oThER techniQuEs. tHe leak-BranDeD releaSe had fOLlowED The release, severaL days EARlier, OF a qUicklY-dEbunked STory, Supported bY falsified dOcumenTs, alLeginG that
 is often lost or overlook ed when co mpani esand  g over nmen t agencies jum p  qui ckly to attribution ar oundRu s sian cy ber e spionag e .W hil eit  is  p o ss ibletha t a pro xy actor i s i mp lementing th e  f ront-end c oll ection compo nen t of t he  ph i shing  ca mpaig n we a r e desc ribing, t he scaleo f the t a r ge ting  also suggests aw el l -resourced act or, su ch as a  na tio n state. T he  thre a d linki n ga l l  of the targets i s their con n ect ion to  i ssu e s that  theRu s sia n governmen t ca res about . Thet argetsa re peop le who sepos itio n sor  ac ti v iti e sgiv e  th em acces sto , orinfl u e n c e ov er,  sen sitiv e information  of  spe c ifi c int erest  toRu ssia.  Thislinks  a n otherwise ext reme ly divers e t ar get  s et, w h ich ra nge s f rom dom estic K r eml in c r it ics and journalist s, t oanti-cor ruptio n  i nv e stigator s,  fo reig n gover nmen t  p ersonnel , andb us in esspeop le .

The  d ata  co llect e d fr om suc h a camp aignw ould come in m o re than a doz e nl a ng u ages , a nd concerna di v erse  ran g eofp oliti cal,mi l it a ry, and policy issu es  fromat le ast 39 countr ies and 28 g o vernment s. I n  a d dition, such a  camp aign would be likel y togenerate  large vo l u mes of d ata . F orthi s re ason, a profe s s iona li zed, we ll- resourc edope rat orwo uld be ne eded for  a ny  e ff ect ive p o st-colle ct ion  a nal ysiso f thestole n da ta .E ven  greate r  r e s ourc es  w ould  be  r equir ed t o  an alyse,and in so mei nsta nc es  carefu lly modify in  a  short tim ef ram e, the c ontentsof stolen email and clo u d-stora geaccou ntsfor the p urp oses o f s e edingdisinf ormat io n v i a  tain t e dlea ks .

The div e r sit y and  p resu med cos t of analyzing the sto len data alon g w itht h ecle a rR uss ia n  ne x u s for the targe ts is only  c i rc umstantial evi de nce ofa Russi an co n nection . It shou ld be eva lu ated i n t he context  of theother pie c es of ci rcums tan tial e vi den ce we  prese n t,inclu ding t he  overl aps i ntacticswith known Russia-linke d acto rs, a ndthe promi nen t  ro le of Cyb erBe rkut.



P art  4:  Disc uss i on

I n th i ssec t ion,we e x amine the tr oub l i ng  relationsh i p bet weenesp i onageanddisinformation, p a rticularly initsl a tes t d i gita lmanifestation,  an de l aborateon  how civilsocietyis parti cularl y at r isk fro m su c h newtact ics .

Tainte d L ea k s: A Ne wTr e nd

Th e re ce nt the ft and disc l o sure of document s (br a n ded a s  a“leak ”)  from t h e pr esidential  campaign o f Emma nuel  Macr on is t he  highe stpr ofile case in whichit ap pears t ha t fa lsi fied d ocum e n ts we re i ns ert ed amongs t re a l,  s t ole n do cumen ts . Th e documen t s falsel y i m plied a  r ang e of imp r op e r  or questi ona ble a c t ivities. T h e fa l se stori es imp lied b y these doc um ents we ret h en highli ghted inc amp ai gnspromoted  w ithtw itt er  bots and other  techniq ues. The l eak-br and e d re l ease h ad  followed th e rel ea s e, seve r a l d ays ear l ier , o f a  qui ckl y-de b unked story, supported b y fa lsifi e d d ocume nts,al leging t h at
 is_often lost_or overlooked when companies_and government_agencies_jump quickly_to_attribution around Russian_cyber espionage.

While it_is possible that a_proxy actor is_implementing_the front-end collection component of the phishing campaign we are describing, the scale of_the_targeting also_suggests_a_well-resourced actor, such as a_nation state. The thread linking_all of_the targets is their connection to issues that_the_Russian government cares_about. The targets are people whose positions or activities_give them access to, or influence_over, sensitive information_of_specific_interest to Russia. This_links an otherwise extremely diverse target_set, which ranges from domestic Kremlin_critics and journalists, to anti-corruption investigators, foreign_government personnel, and businesspeople.

The data collected_from such a campaign would_come in_more than a dozen languages,_and concern a_diverse range_of political, military,_and policy issues from at least_39 countries and_28 governments. In addition, such a_campaign_would be likely_to_generate_large volumes_of data. For_this_reason, a_professionalized,_well-resourced operator would be needed for_any_effective post-collection analysis of the stolen data._Even greater resources would_be_required to analyse, and_in some instances carefully modify_in a short timeframe, the contents_of stolen_email and_cloud-storage accounts for the purposes of seeding disinformation via tainted leaks.

The_diversity and presumed cost of analyzing_the stolen data along_with the_clear_Russian nexus for_the_targets is_only circumstantial evidence of a Russian connection._It should_be evaluated in the context of_the other pieces of_circumstantial_evidence we present, including the overlaps_in tactics with known Russia-linked actors,_and the prominent role of_CyberBerkut.



Part_4:_Discussion

In this section, we examine_the troubling relationship between espionage and_disinformation, particularly in_its latest digital manifestation, and elaborate on_how_civil society is particularly at risk_from_such new tactics.

Tainted Leaks: A New_Trend

The_recent_theft and disclosure of documents_(branded as a “leak”) from the_presidential campaign of Emmanuel Macron is the highest profile_case in which_it appears that falsified documents_were_inserted_amongst real, stolen documents. The documents falsely implied a range_of improper_or questionable activities._The false stories implied by these documents were then highlighted_in campaigns promoted with twitter bots and_other techniques. The leak-branded release had followed the release, several days_earlier, of a quickly-debunked story, supported by falsified_documents, alleging that