Russia has fully pivoted its disinformation efforts to focus on Vice President Kamala Harris, releasing several fake, widely-seen videos designed to harm her campaign.

Microsoft published a new report on Tuesday warning that two Russian groups have used X (formerly Twitter), Telegram and several fake news websites to disseminate controversial and fictitious videos about Harris.

Clint Watts, general manager at the Microsoft Threat Analysis Center (MTAC), said a Russian government-aligned troll farm produced and spread two fake videos of Harris being involved in a hit-and-run accident and another of her supporters attacking a Trump fan.

Both of the fake videos garnered millions of views and the video of the fake hit-and-run was spread on several social media sites through a fictitious San Francisco media outlet that had been created days before. 

“Storm-1679, a newer group reportedly aligned with the Kremlin, pivoted its focus from producing content about the 2024 Paris Olympic Games to publishing false videos discrediting Vice President Harris,” Watts added.

“One of the videos, which was shared on X shortly after it was published to Telegram, depicted a fake New York City billboard advancing false claims about Harris’ policies. The X post received more than 100,000 views in the four hours after it was published on Telegram.”

Watts noted that the disinformation from Russia was part of a wave of attempts by foreign countries to influence the election. 

Microsoft and several other tech companies previously confirmed that Iranian actors attempted cyberattacks on members of both presidential campaigns and Watts added that they have now seen Chinese actors create short videos criticizing President Joe Biden and Harris’ campaign. 

“While most [Chinese-linked influence actors] personas masquerade as conservative US voters voting for Trump, a handful of accounts also create anti-Trump content and use political slogans and hashtags associated with American progressive politics,” Watts said.

MTAC added that it saw Chinese actors repeatedly share fake information following the first assassination attempt on former President Donald Trump. They repeatedly shared content attempting to implicate Democratic officials in the attempt and replied to dozens of comments on videos hoping to stoke resentment. 

Volga Flood

The MTAC report on Tuesday explained that for the last three presidential election cycles, it has witnessed synchronized shifts by all Russian influence operations to denigrate Democratic candidates in the three months before election day. 

The video of the alleged hit-and-run previously drew scrutiny on Twitter after it was immediately identified as fake. Microsoft confirmed that it was intentionally spread by Russian groups, who used an actor to claim Harris paralyzed a girl in a 2011 car accident. 

The report also covers several Russian proxies that run a web of social media accounts spreading videos of Harris intended to criticize her policies or exaggerate her stances on issues. 

One Russian operation, which Microsoft called Volga Flood, has several accounts branded as grassroots military bloggers that purport to spread information obtained from hack-and-leak operations. 

“Volga Flood’s leadership — which includes EU-sanctioned Mikhail Zvinchuk — consists of former employees of the Russian Ministry of Defense and the late Yevgeny Prigozhin’s Patriot Media Group,” MTAC said. 

“Volga Flood has previously worked for Russian state corporation Rostec and, MTAC assesses, receives some of its resourcing from the Russian Presidential Administration. Volga Flood is among the leading Russian actors leveraging AI to scale its operations beyond the capabilities of its teams that include regional analytics, illustration, mapping, and foreign language expertise.”

Microsoft noted that Volga Flood played a role in amplifying both real and fake videos connected to the recent race riots in the United Kingdom. 

Several other disinformation outfits, including Ruza Flood, have connections to entities that were sanctioned by the Justice Department earlier this month, including ANO Dialog. In response to the indictments, YouTube and other social media sites have sought to ban accounts pushing Russian-promoted content. 

Microsoft noted on Tuesday that it also suspended more than 20 active Microsoft email accounts created by ANO Dialog but warned that the actors are already “attempting to create new infrastructure, with one threat actor already having moved media outlets from seized websites to new ones.”