France uncovers major Russian disinformation campaign

French Foreign Minister Catherine Colonna said on Tuesday that France had prevented a hybrid digital attack on her ministry's website, likely carried out by Russian state actors, as well as attacks on other government websites and French media sites.

Colonna also said France believed there was a broader campaign to spread disinformation in France by Russian protagonists.

"This campaign is notably based upon creating fake internet pages to hack into the identity of national media and government websites, as well as by creating fake accounts on social media networks," she said in a statement.

Western states have been acutely concerned about an intensification of Russian-led disinformation campaigns, as Moscow seeks to influence public opinion across the world over its invasion of Ukraine.

"The campaign is a new illustration of the hybrid strategy that Russia is implementing to undermine the conditions for peaceful democratic debate and therefore undermine our democratic institutions," Colonna said.

However, Colonna insisted that "no attempt at manipulation will deter France from supporting Ukraine in the face of the Russian war of aggression."

Who ran disinformation campaign?

France has for several years sounded the alarm over alleged Russian disinformation campaigns in areas of Francophone Africa, particularly those where the Russian mercenary group Wagner has been active.

The campaign was carried about by "Russian actors" with "state entities or entities affiliated to the Russian state," such as Russian embassies and cultural centres, then had "actively" participated in amplifying its impact, according to Colonna.

"This campaign is based in particular on the creation of fake web pages impersonating national media and government sites as well as the creation of false accounts on social networks," she said.

The campaign is believed to involve techniques including producing fake articles on a page identical in all respects to those of the legitimate sites of media organisations, but with a different domain names — for example .ltd instead of .fr.

Who was affected by campaign?

At least four French daily newspapers — Le Parisien, Le Figaro, Le Monde and 20 Minutes — were victims of the operation. Other major Western media were also targeted, particularly German ones including Frankfurter Allgemeine Zeitung, Der Spiegel and Bild.

The French foreign ministry itself foiled an attempt to create a fake reproduction of its own website, Colonna said.

The operation uncovered by the French government is "the second phase" of a campaign that had already come to light in 2022 "but with more sophisticated modes of action intended to circumvent countermeasures and be less visible", a security source who asked not to be named said.

This so called "Doppelgaenger" operation had been documented in 2022 by the organisation EU Disinfolab, and Meta, the parent company of Facebook.

"Meta hoped that its report would put an end to the operation. This was not the case," said the security source.