What do fake news on Ukrainian First Lady Olena Zelenska's multimillion-euro sports car purchase and made-up offers of money to vote for President Emmanuel Macron in the French snap elections have in common?
They were all cooked up by the Kremlin in what is an ongoing all-out assault on French public opinion, researchers claim.
Scores of freshly registered websites, some made to look like mainstream outlets, have been publishing everything from deepfakes — near-seamless videos created using the latest technology to convince the viewer of the most outlandish claims — to generative AI writing impassionate fringe content and reports on real-world acts of subversion in a massive-scale hybrid strategy to disorient and confuse those unsure of who to support in the French electoral double-header.
"The Russian-linked entities have been taking newspapers websites and mocking them up to have slightly different headlines where you don’t know whether the information you’re looking at is real or not," Ross Burley, co-founder of the Centre for Information Resilience, told Euronews.
"And that’s not necessarily to fool people to think, ‘Oh look, I’m reading the New York Times’ because people are not stupid. It’s more around diluting the information space and creating so many different versions and so many different variations of what you think is real."
"It confuses you so you don’t actually engage with the actual, real content because you’re not 100% sure as to whether what you’re looking at is in fact the real version. So that’s the aim here," he explained.
Spoofing legitimate outlets to gain trust
On 9 June, the French far-right National Rally trounced Macron's party in elections for the European Parliament. The party formerly known as National Front has historically pursued a subtle policy of being friendly with the Kremlin: since taking the helm in 2011, its leader Marine Le Pen has cultivated ties to Russian President Vladimir Putin and supported Moscow's illegal annexation of Crimea from Ukraine in 2014.
Its leading contender for prime minister, Jordan Bardella, has said he opposes sending long-range weapons to Kyiv.
For the Kremlin, both Le Pen and Bardella were a much more palatable choice in France than Macron, who is a staunch supporter of Kyiv in its attempts to defend itself from Russia's ongoing full-scale invasion — and Moscow might have tried to sway the vote in their favour.
The Kremlin did so by furthering the goals of its disinformation campaign dubbed Doppelgänger, meant to change the public opinion against Ukraine, to outright social engineering in the heart of Europe by means of encouraging and fuelling the extremes.
"It's classic Russian malign activity, taking something which is divisive in society," Burley said, "and needling away and pouring vinegar on the wound of the issue to deepen those divisions and then put it on social media so people get angry about it and use your network of accounts that can amplify each other," Burley said.
And according to him, it's working.
"This stuff is cheap and it’s effective, it’s not a huge endeavour like having to go and spend millions on a digital marketing campaign. It's a lot cheaper than that."
"In terms of bang for buck, this is a really cheap way for Russians to subvert a key democracy in NATO and the EU."
In more than 4,400 posts gathered since mid-November by antibot4navalny, a collective that analyses Russian bot behaviour, those targeting audiences in France and Germany predominated. The number of weekly posts ranged from 100 to 200 except for the week of 5 May, when it dropped to near zero, the data showed. That week, as it happens, was when Russia celebrates Victory Day — a major public holiday.
The content observed shifted focus to the European elections and continued after Macron called the surprise legislative elections with just three weeks to spare. Three-quarters of posts from the week ahead of the 30 June first-round legislative vote directed toward a French audience focused on either criticising Macron or boosting the National Rally, antibot4navalny found.
AFP news agency, BFMTV, and Le Point magazine have all been spoofed as a way to legitimise criticism of Macron and make it seem like a mainstream point of view.
"Our leaders have no idea how ordinary French people live but are ready to destroy France in the name of aid for Ukraine," read one headline on 25 June.
Another site falsely claimed to be from Macron's party, offering to pay €100 for a vote for him — and linking back to the party's true website.
And still, another inadvertently left a generative artificial intelligence prompt asking AI to re-write an article "taking a conservative stance against the liberal policies of the Macron administration," according to findings last week from Insikt Group, the threat research division of the cybersecurity consultancy Recorded Future.
Stars of David, bloody hand prints and coffins at the Eiffel Tower
Macron's dissolution of the parliament and call for surprise elections only made worse what was already in motion.
French authorities have been increasingly warning this might happen as they have observed the escalation first-hand for months.
The Russian campaigns sowing anti-French disinformation began online in the early summer of last year but first became tangible last October when more than 1,000 bots linked to Russia relayed photos of graffitied Stars of David in Paris and its suburbs.
A French intelligence report said the Russian security agency FSB ordered the tagging, as well as subsequent vandalism of the Wall of the Righteous, a memorial to those who helped rescue Jews from the Holocaust, with at least two dozen red hand prints meant to imply Jewish blood on French hands.
Then, in early June, five coffins were discovered at the foot of the Eiffel Tower, filled with plaster and covered with a French flag bearing the words "French soldiers of Ukraine," according to domestic outlets.
The three men arrested in connection with the stunt were in contact with a man suspected to have been a part of the group behind the bloody hand prints, a document from the local security directorate for the Paris agglomeration (DSPAP) revealed, according to Le Monde.
Photos from these events were amplified on social media by fake accounts linked to Russian disinformation sites, cybersecurity experts said.
In the meantime, French intelligence has implicated Sergei Kiriyenko, a ranking Kremlin official, as the person in charge of the operation.
The idea behind the stunts was to antagonise and enrage the average citizen: as the Israel-Hamas war kicked off following the latter's terrorist attack on 7 October, the culprits banked on fears of a spike in antisemitism by drawing Stars of David on walls just like Nazi brownshirts did in the 1930s.
However, the October graffiti attack inevitably pointed back at Russia, being highly reminiscent of Stars of David suddenly popping up on facades across then-West Germany in the 1950s.
The plot was tracked down to the Russian intelligence agency KGB: the Kremlin had its people tag the walls in the Federal Republic of Germany to spook the West into thinking that Nazis were back, derailing the government in Bonn amid its economic miracle.
Paris up in arms
Meanwhile, Paris has warned many times that what it was dealing with in 2024 was again coming from Moscow.
In February, French Foreign Minister Stéphane Séjourné said in a public video address posted on X that a French state agency had discovered a network of 193 Russian websites, spreading propaganda before the 6-9 June European elections.
Then, in April, Minister for European Affairs Jean-Noël Barrot warned that the country was "being overwhelmed with propaganda and disinformation" ahead of the vote.
Last month, the Bureau of Investigative Journalism (TBIJ) and the Tow Center revealed another Kremlin-associated influence operation, outing a French-language website, Verite Cachee, as a source of Russian-style deepfake videos and other content meant to sway the French opinion against Ukraine.
One deepfake in particular showed Ukraine's Zelenska supposedly buying a brand-new Bugatti Tourbillon sports car for €4.5 million. The video and the alleged proof of purchase Verite Cachee published proved to be false.
Russian state-owned media and affiliated outlets have repeatedly accused Zelenska and her husband, Ukrainian President Volodymyr Zelenskyy, of frivolous spending habits and amassing immense wealth. None of the allegations were ever proven to be true.
This site and another called France en Colere were established less than two weeks after Macron announced the snap elections.
The barrage of fake news has also targeted the French army and the country's strong links with Ukraine, claiming it was endangering public safety, such as causing an alleged tuberculosis epidemic, with the illness being brought over by Ukrainians coming to France.
However, all of this turned out to be a part of a much larger plot to poison the well across Europe by flooding its online information space with swaths of disruptive content ranging from conspiracy theories to attacks on Kyiv-friendly leaders.
More platforms, more problems
In March, Czech authorities imposed sanctions on the Prague-based website Voice of Europe for spreading Kremlin propaganda. The site allegedly used the influence of mostly far-right, pro-Russian European Parliament members who engaged with the outlet. Two of the channel's executives, including Viktor Medvedchuk, a longtime ally of Russian President Vladimir Putin, were also hit with sanctions.
The fallout from the scandal, dubbed "Russiagate", saw German far-right AfD kicked out of the Identity and Democracy (ID) European Parliament group, while the party dropped now-former MEP Maximilian Krah as its lead candidate in the run-up to the European elections.
Following Brussels' own sanctions against Voice of Europe, social media companies like Meta and Google have removed its channels from their platforms.
However, the network remains active on platforms such as Telegram and X and has even managed to restore its website. And in the meantime, it has found other ways of publishing and peddling its wares.
Russian-made platforms Telegram and VKontakte — the Russian version of Facebook — are commonly used to propagate and give velocity to disinformation, further pointing to Moscow's involvement.
Telegram has been heavily criticised for opening itself up to extremist content, with the Anti-Defamation League labelling it a white supremacist "safe haven".
X has seen a spike of malign content ever since Elon Musk bought and rebranded the platform formerly known as Twitter. Despite demands from Brussels to improve its content moderation, especially in the EU, Musk has repeatedly defended X's policies of allowing questionable content as "free speech".
According to Burley, the lack of desire of Big Tech companies to put their foot down against the Kremlin's campaigns has further encouraged Moscow, and turned spreading malign content on social media into a "small industry" in its own right.
"The way both Meta’s evolving and the way that X has already got there in terms of the monetisation of anger and angst makes it a really easy thing to do," he said.
"And not only does it get you your primary goal in terms of making people angry and upset, but also you make money out of it, which means you can put your money into digital marketing and do the whole thing again."
