WRLD

Search

#ForgedDocuments
Krzysztof Graj 15h

Operation Dark Clark – Russia built a real organisation around a false identity Most influence operations create fake people, fake websites or fake news stories. Operation Dark Clark appears to have gone considerably further: Russian operators built what looked like a functioning research organisation in Latin America, employed real people to produce genuine research and concealed from those employees who was ultimately directing their work. OpenAI disclosed the operation on 8 October after banning a cluster of accounts originating in Russia. The actors used ChatGPT while targeting countries across Latin America, principally to damage Ukraine’s reputation, manipulate domestic political debates and manage a self-described research organisation called the Social Research Center, or SRC. OpenAI assessed Dark Clark as Category Five on the six-level Breakout Scale, the first operation it has disrupted since beginning its influence-operation reporting to reach that level. A front organisation with real employees The SRC presented itself as a research platform studying subjects including Latin America’s relationship with India and the Indian diaspora. OpenAI found more than 60 articles on its website, most of them apparently original rather than plagiarised. Internal reports produced by the Russian operators discussed hiring, dismissals, salary scales, staffing and unfinished research projects, strongly suggesting that the operators controlled the organisation rather than merely collaborating with it. At the centre of the structure was “Mia Clark”, a fictitious identity reportedly used to manage social-media activity and communicate with staff. According to OpenAI, the available evidence indicates that employees working for SRC in Latin America were probably unaware that the organisation was being directed by Russian actors. They interviewed experts, conducted research and wrote papers in what appears to have been good faith. The deception therefore existed primarily at the organisational level: much of the work was real, but the identity and strategic purpose of the institution commissioning it were not. OpenAI This is one reason Dark Clark differs from the familiar model of a troll farm. A reader encountering an SRC paper might be looking at research genuinely written by a Latin American employee based on genuine interviews. The manipulation lies further upstream, in who built the institution, selected its direction and controlled its infrastructure. From forged emails to real events The operation also appears to have attempted something more ambitious than online persuasion: inducing real people to produce events that could later be turned into propaganda. In May 2026, according to the operators’ internal reports, they created an email address impersonating Lima’s regional education authorities and instructed schools to organise activities about Ukraine for a cultural-diversity event. The instructions included references to Stepan Bandera, whose historical legacy remains particularly contentious in Poland and parts of Eastern Europe. The operators claimed that some schools complied, replied to the false address and sent photographs of the events. OpenAI could not independently verify every claim contained in the operators’ reports. It did, however, find Peruvian reporting matching the story, followed by publications in Poland and an English-language outlet in Hungary. Some coverage included comments from a Polish MEP calling for people displaying what he described as anti-Polish attitudes to be declared persona non grata. OpenAI therefore concluded that the fabricated starting point appears to have entered genuine political debate across national borders. The mechanism is unusually effective because the final photographs need not themselves be fabricated. If people can be tricked into staging a real event on the basis of a forged instruction, the operation creates authentic visual evidence of something that was artificially initiated. The same method in Ecuador and Bolivia Dark Clark’s internal reports describe similar efforts elsewhere. In Ecuador, the operators claimed they used a fake education email to encourage schools to stage ceremonies involving President Daniel Noboa and Erik Prince, the former head of Blackwater. Ecuadorian media subsequently covered a matching controversy, and the country’s education minister issued a detailed denial. Other Ecuador-focused material included fabricated audio attributed to Ukraine’s consul and a false television report alleging that Noboa’s government was recruiting Ecuadorians to fight in Ukraine. Local fact-checker Lupa found that the supposed Teleamazonas report had never been broadcast, that images had been taken from Instagram, that the audio was AI-generated and that a company named in a supposed recruitment contract did not exist in Ecuador’s corporate registry. In Bolivia, an internal report described a fake audio recording supposedly made by an employee of state water company EPSAS during anti-government protests. It claimed that water supplies to La Paz would be cut and a state of emergency declared. The allegation produced a fact-check and an official denial. OpenAI says the operators explicitly described their objective as worsening the political crisis surrounding the demonstrations. Possible links to the post-Wagner influence machine Dark Clark did not emerge in a vacuum. The operators repeatedly asked ChatGPT about Politology and La Compania, names associated in previous investigations with the Russian influence apparatus that developed from structures once connected to Yevgeny Prigozhin. Forbidden Stories and its partners obtained 1,431 pages of internal documents describing a network known as “The Company”, which they reported had grown to almost 100 operatives and was conducting influence projects across roughly 30 Global South countries. Their investigation found that the organisation moved under the supervision of Russia’s Foreign Intelligence Service, the SVR, after Prigozhin’s death. Its documented budget for ten months of activity in 2024 was approximately €7.3 million. Two older Argentina campaigns claimed in Dark Clark’s internal reports — a false story about Javier Milei buying Cartier collars for his dogs and the staging of anti-Milei graffiti — had already been independently attributed by investigative journalists to Politology/La Compania. That is significant corroboration, but it is not enough to prove that every Dark Clark activity was run by the same organisational structure. AI was the back office, not the mastermind Perhaps the most important finding concerns artificial intelligence itself. In most documented cases, the Russians were not using ChatGPT to generate the propaganda seen by the public. Their principal use was administrative: drafting reports for an unknown superior, summarising operations, translating material and recording the supposed success of campaigns. Those reports also expose a weakness in the operators’ own measurement. OpenAI found instances in which they tried to claim credit for developments they had probably not caused, suggesting that they were not only attempting to manipulate Latin American audiences but also presenting an inflated picture of their effectiveness to whoever was supervising them. Dark Clark nevertheless broke further into the real world than any influence operation OpenAI had previously disrupted. Under the Brookings framework, Category Five means that an operation has escaped its original network and been amplified by high-profile individuals such as politicians. Dark Clark crossed that threshold because fabricated narratives appear to have provoked governmental denials, mainstream reporting and political comment in several countries. Its most important innovation was therefore not a particularly convincing deepfake. It was the construction of a partly genuine institution around a concealed foreign controller. The research could be real. The employees could be real. The interviews could be real. What was false was who they were ultimately working for. Sources OpenAI — Disrupting AI-enabled “false front” operations https://openai.com/index/disrupting-ai-enabled-false-front-operations/ Forbidden Stories — Propaganda Machine: Russia’s foreign influence strategy across three continents https://forbiddenstories.org/propaganda-machine-secret-documents-reveal-russias-foreign-influence-strategy-across-three-continents/ Forbidden Stories — Ghost Journalists, Cash and Kremlin Scripts: Argentina https://forbiddenstories.org/ghost-journalists-cash-and-kremlin-scripts-how-russian-operatives-tried-to-influence-argentinian-media/ openDemocracy — Russian influence operation in Bolivia https://www.opendemocracy.net/en/russia-bolivia-south-america-putin-evo-morales-wagner-prigozhin-covert-operations-propaganda-disinformation-foreign-interference/ Lupa Media — Fake Teleamazonas report about recruiting Ecuadorians for Ukraine https://lupa.com.ec/verificaciones/noboa-mercenarios-ucrania-ecuador/ Brookings Institution — The Breakout Scale https://www.brookings.edu/articles/the-breakout-scale-measuring-the-impact-of-influence-operations/ Keywords: #DISINFORMED #Episode17 #OperationDarkClark #DarkClark #Russia #LatinAmerica #RussianInfluence #RussianDisinformation #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #FalseFront #FrontOrganisation #FakeInstitution #SocialResearchCenter #SRC #ArtificialIntelligence #AI #GenerativeAI #ChatGPT #OpenAI #NarrativeManipulation #SourceLaundering #InstitutionalManipulation #ForgedDocuments #FakeAudio #PoliticalInfluence #CovertInfluence #Peru #Ecuador #Bolivia #Argentina #Ukraine #Politology #LaCompania #TheCompany #SVR #WagnerLegacy #PropagandaMachine #GlobalSouth #BreakoutScale #OSINT #MediaManipulation #WRLD

80
Krzysztof Graj 3w

The Ghosts of Zaolzie – how a cyberattack tried to manufacture a conflict between Poland and Czechia At around 5pm on 16 August 2026, an alarming article appeared on the website of Radio PiK, a genuine Polish regional broadcaster. Its headline claimed that Poland was preparing to seize Czech territory and that the Czech Foreign Ministry had received a document outlining Warsaw's demands. Radio PiK had published no such story. An attacker had compromised an employee's credentials, gained access to the station's content management system and replaced a legitimate article with fabricated material. The newsroom quickly removed it and informed the authorities. But the intrusion was only one element of a much larger operation. Investigators subsequently uncovered forged diplomatic documents, accounts impersonating Polish and Czech officials, a cloned Czech news site, AI-generated material, a fictitious local activist and advertising for a demonstration that apparently did not exist. Together, these elements attempted to manufacture the appearance of a new territorial conflict between Poland and Czechia over Zaolzie. A false crisis built around a real territorial issue The operation worked because it did not start entirely with fiction. Poland and Czechia do have an unresolved technical issue concerning approximately 368.44 hectares of territory, originating in post-war changes to the Polish-Czechoslovak border. It is commonly described as the Czech “territorial debt” to Poland. But this is not a Polish claim to Zaolzie and there is no evidence that Warsaw is seeking to annex Czech territory. The operation fused this real issue with a much more powerful historical memory. Zaolzie – the part of Cieszyn Silesia west of the Olza River – was disputed by Poland and Czechoslovakia after the First World War. In 1938, during the crisis created by the Munich Agreement, Poland seized the territory from Czechoslovakia. The manipulation therefore followed a simple logic: a real territorial debt became an alleged Polish territorial demand, which was then transformed into a supposed attempt to reclaim Zaolzie. Fake accounts impersonating Poland's Deputy Foreign Minister Artur Harazim and Czech ambassador Břetislav Dančák helped reinforce the story. Fabricated diplomatic documents circulated alongside them. One early version referred incorrectly to 638.44 hectares; the fake Harazim account then “corrected” the number to the genuine figure of 368.44 hectares. It was an effective form of reverse fact-checking: correcting one false detail could make the larger fabrication appear authentic. Fake media – and one real newsroom The operators also created a website designed to resemble Czech public broadcaster iRozhlas. It published material supporting the same narrative, including claims that Czech residents near the border were becoming concerned about Polish intentions. The result was a manufactured information loop. Forged documents could support fake media reports; impersonated officials could comment on those reports; social-media accounts could then cite both as confirmation. But the Radio PiK hack added something much more valuable: the credibility of a real media organisation. Instead of merely cloning a newsroom, the attackers briefly inserted their fabrication into an authentic one. A familiar domain, logo and established broadcaster could therefore appear to confirm a story manufactured elsewhere. The cyberattack was not simply an accompanying technical incident. It was part of the information operation itself – a way of manufacturing credibility for false information. From a synthetic activist to a real demonstration The operation then attempted to move from the digital world into the physical one. A Facebook account under the name “Adam Sikora” promoted a demonstration in the Czech border city of Třinec under slogans including “Cieszyn Silesia is Czech” and “Here we live, here we stay”. Paid Facebook advertising was reportedly used to promote the event. Yet Třinec authorities said no demonstration had been properly notified. Promotional material used the logo of the Czech KOVO trade union, which denied any involvement. Investigators also identified indications that Sikora's profile photograph and other imagery were AI-generated. The persona even advertised a supposed house for sale in the border region, reinforcing the impression that frightened residents wanted to leave because of Polish territorial ambitions. The property could not be verified and its images also showed signs of artificial generation. This reveals the architecture of the operation: forged document → fake official → cloned media → compromised real media → synthetic local activist → advertised protest → appearance of social tension. The final stage is particularly significant. Had real people attended the demonstration, photographs of an authentic crowd could potentially have been presented as evidence that Czech citizens genuinely feared Polish territorial ambitions. A fabricated online conflict could therefore have begun generating real-world evidence of its own existence. Why Zaolzie? Historical grievances are valuable material for influence operations because the underlying facts are real. Poland and Czechoslovakia genuinely disputed Cieszyn Silesia. Poland genuinely occupied Zaolzie in 1938. A Polish minority genuinely lives in Czechia. And the 368.44-hectare territorial issue genuinely exists. The operator did not need to invent that history. It only needed to suggest that the history was repeating itself. PISM assessed that the operation sought to revive the image of Poland as a revisionist state willing to challenge European borders. Such a narrative could serve a broader purpose: damaging Polish-Czech relations, weakening confidence between NATO and EU allies and portraying Central Europe as a region where historical territorial conflicts remain unresolved. Russia is the leading attribution – but not a proven one The attribution requires more caution than the mechanics of the operation. PISM assessed Russia as the most likely perpetrator, while NASK identified similarities between the campaign and previously observed Russian influence methods. Russian-linked information infrastructure had also shown earlier interest in the Polish-Czech territorial issue. The techniques are familiar: cloned media, forged documents, impersonated officials, synthetic identities, historical grievances and the combination of cyber intrusion with information manipulation. But these indicators are not the same as definitive attribution. As of mid-September 2026, no publicly disclosed forensic evidence had conclusively connected the Radio PiK compromise, fake domains, accounts and financing to a specific Russian intelligence service, government organisation or contractor. Russia can therefore reasonably be described as the leading analytical attribution, but claims that the operation was definitively conducted by the GRU or another named Russian structure go beyond the publicly available evidence. The operation failed. The model remains important The campaign did not create a Polish-Czech diplomatic crisis. Both governments rejected the narrative, the fictitious protest was exposed, journalists reconstructed much of the operation and Radio PiK detected the intrusion quickly. Its observable impact appears to have been limited. But Zaolzie illustrates a broader evolution in information warfare. Modern operations do not have to rely on a single viral fake. They can construct an entire artificial information environment in which different elements appear to confirm one another. A forged document creates the claim. A fake diplomat authenticates it. A cloned newsroom reports it. A hacked real newsroom lends it credibility. An AI-generated citizen reacts to it. Advertising creates the appearance of a grassroots movement. And if real people eventually respond, fiction begins producing genuine events. The objective is no longer simply to persuade people that something happened. It is to create the conditions in which something real starts happening because enough people believed that it did. Sources: Polish Institute of International Affairs (PISM) https://pism.pl/publikacje/dezinformacja-o-relacjach-polsko-czeskich Euronews Polska — Radio PiK cyberattack https://pl.euronews.com/2026/08/20/polska-planuje-zajecie-terytorium-czech-wlamali-sie-na-strone-radia-i-opublikowali-falszyw Demagog https://demagog.org.pl/na-biezaco/skoordynowana-operacja-uderza-w-polsko-czeskie-relacje-czy-stoi-za-nia-rosja/ Robert Lansing Institute https://lansinginstitute.org/2026/08/27/zaolzie-as-an-instrument-of-influence-an-attempt-to-revive-a-polish-czech-territorial-conflict/ Institute for European Security Studies (IESS) https://www.iess.org.ua/analytics/ghosts-of-zaolzie iDNES.cz https://www.idnes.cz/ostrava/zpravy/tesinsko-kampan-lzi-demonstrace-trinec-primatorka-palkovska.A260826_963356_ostrava-zpravy_jog Radio Zachód / PAP https://zachod.pl/1539751/niedzielny-atak-hakerski-na-radio-pik-redaktor-naczelny-podjelismy-niezwloczne-dzialania/ Euronews — territorial debt / NASK assessment https://de.euronews.com/my-europe/2026/08/21/polen-plant-besetzung-tschechischen-gebiets-fake-news TVP World https://tvpworld.com/95036191/-warsaw-warns-against-division-amid-czech-border-disinformation Keywords: #DISINFORMED #Episode5 #GhostsOfZaolzie #Zaolzie #Poland #Czechia #CieszynSilesia #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #Cyberattack #CyberSecurity #HybridWarfare #FakeNews #MediaImpersonation #FakeMedia #ForgedDocuments #DigitalImpersonation #ArtificialIntelligence #AI #Deepfakes #SyntheticMedia #Astroturfing #RussianInfluence #Propaganda #OSINT #NATO #CentralEurope #MediaManipulation #WRLD

1273