Inauthentic personas have been generating fake news and documents targeting three countries with anti-NATO narratives, according to security researchers.

An influence campaign has been detected in Lithuania, Latvia, and Poland, involving narratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, occasionally leveraging other themes such as anti-US and also COVID-19-related issues as part of the broader anti-NATO agenda.

The campaign, aligned with Russian security interests, has been ongoing since March 2017, and appears to have leveraged website compromises or spoofed email accounts to disseminate fabricated content. The latter includes falsified news articles, quotes, correspondence and other documents designed to appear as coming from military officials and political figures in the target countries.

This falsified content has been referenced as source material in articles and op-eds authored by at least 14 fake personas posing as locals, journalists and analysts within the target countries. The articles and op-eds, primarily written in English, have been consistently published to a core set of third-party websites that appear to accept user-submitted content, most notably OpEdNews.com, BalticWord.com, and the pro-Russian site TheDuran.com, among others, as well as to blogs suspected to be affiliated with the masterminds of the campaign.

Some of the engineered incidents and personas have received public attention from researchers, foreign news outlets or government entities in Lithuania and Poland, but have not been tied to a broader activity set. Others have received little attention and thus remain relatively obscure.

The researchers analyzing this influence campaign—from Mandiant Threat Intelligence—have named it ‘Ghostwriter’ because the identities of the fake news writers have not been established. However, the researchers have independently matched several Ghostwriter personas with certain documented incidents, which have been reported with moderate confidence as part of the Ghostwriter campaign.

Additionally, Mandiant’s researchers believe Ghostwriter to be a part of a larger, concerted and ongoing influence campaign.