Ben Gilbert describes himself on Bluesky, the social media app, as an “economist, lit and guitar nerd, rugby fan, owner of excessive pets.” A professor at the Colorado School of Mines, he rarely posts, but when he does, the subjects reflect his expertise in natural resources.
So it was odd when a video purporting to be a news report appeared on his account last month, blaming France’s financial and political support for Ukraine for police staff shortages at home.
Without his knowledge, Mr. Gilbert said, he had fallen victim to Russia’s latest tactic to try to spread its propaganda in the West.
His account, like hundreds of others on Bluesky, had been hijacked and used to post fake news articles, according to the company and researchers at Clemson University working with a collective of internet monitors who track Russian influence operations and call themselves the dTeam.
The compromised Bluesky accounts included those of people who are influential in their fields, though perhaps not famous. They were journalists and professors, a pollster in Texas, an anime artist and a filmmaker in Hollywood, whose account posted a video doctored by artificial intelligence to impersonate a Canadian police official criticizing France’s president, Emmanuel Macron.
The campaign, which the researchers at Clemson linked to the Social Design Agency, a company in Moscow, shows how Russia continues to seek new ways to erode public support for Ukraine, which Russian forces invaded in 2022.
Bluesky has grown more prominent as a rival platform to X since X’s owner, Elon Musk, threw his political support behind President Trump before the 2024 election. With 42 million users, though, Bluesky trails far behind X’s nearly 600 million.
While Russians have long flooded social media platforms with fake accounts and content, hacking into real accounts appeared to be a novel strategy.
“They are clearly still experimenting,” said Darren L. Linvill, a director of Clemson’s Media Forensics Hub. “They’re always experimenting.”
Bluesky has been tracking the activity and removing the posts — as many as a couple of thousand. They came in waves beginning in April and continuing until at least last week.
In a statement, the company called Russian influence operations “an industrywide problem.” “We dedicate significant resources toward detecting and disrupting coordinated inauthentic campaigns,” the statement said.
Mr. Gilbert of the Colorado School of Mines, a public research university near Denver, learned of the post on his account when The New York Times contacted him. “I just deleted it,” he wrote in an email.
In other cases, Bluesky has suspended accounts until the owners stepped forward to reset them. Many targets learned of the hacking only when they were locked out of their accounts. One of them was Pamela Wood, a political reporter at The Baltimore Banner.
She was on vacation on April 28 when her account was suspended after it posted a short video with a caption that said The New York Post had linked Ukraine to the man charged with trying to assassinate Mr. Trump last month at the White House Correspondents’ Association dinner.
“Bluesky didn’t provide much information but suggested that my account may have been hacked or compromised,” Ms. Wood said. “My account is rather vanilla — just posting my stories, pretty much — and I hadn’t posted or even looked at Bluesky in a few days, so getting hacked made the most sense.”
Clemson attributed the Social Design Agency’s campaign to a Kremlin influence operation that researchers have called Matryoshka, after the Russian nesting dolls.
The operation, which emerged in 2024, specializes in creating fake articles that look as if they were from real news organizations like Reuters or France 24. The goal seems to be to spread the claims by encouraging fact checkers to debunk them.
Russian news outlets also cite these fabricated posts, falsely suggesting that the content, mostly in English, originated in the West. The Social Design Agency did not respond to a request for comment.
Russian propaganda on Bluesky first became notable during Germany’s elections last year, when the Kremlin sought to bolster Germany’s far right, led by the Alternative for Germany party, known as AfD.
Joseph Bodnar, a researcher with the Institute for Strategic Dialogue, an international organization that has also tracked Russian disinformation, said the hijacking of individual accounts on Bluesky had “a level of sophistication beyond what we usually see.”
“What we usually see is using hijacked accounts on X, but those are random, obscure accounts with crazy avatars,” said Mr. Bodnar, who was not involved in the Clemson research. “They’re not trying to get someone moderately known or respected.”
Ukraine is almost always the main target of Matryoshka’s operations, but previous campaigns also tried to discredit preparations for the 2024 Summer Olympics in Paris and the Trump administration’s dismantling of the U.S. Agency for International Development.
The latter was one of Russia’s most successful disinformation operations, Mr. Linvill said. It featured videos of fabricated news reports suggesting that U.S.A.I.D. had paid celebrities, including the actor Ben Stiller, to travel to Ukraine. Millions of people saw those posts.
Although Mr. Trump was a subject of the recent posts on Bluesky, most showed Russia’s preoccupation with France, which has emerged as the leader of European efforts to bolster Ukraine in the war, and Armenia, a former Soviet republic that elections next month could move further from Moscow’s orbit.
“They just have to get lucky a couple of times for this to be worth it,” Mr. Linvill said.
Leave a Reply