Bear Necessities: Google on The Russian Sphere of Influence

Beyond the rugged Siberian ranges, an information war is brewing.

The pro-Russia influence engine, initially designed to support its frontline objectives in Ukraine has seen expedited development of “multiple, expansive, covert” information operations (IO), says the Google Threat Intelligence Group (GTIG) in its blog titled The Bear Necessities: A Look at the Drivers, Dynamics and Applications of the Pro-Russia Influence Ecosystem.

With the war in Ukraine offering a feedback loop for testing its IOs, the European Union, NATO states and the US are once again becoming key targets, particularly during elections and major geopolitical events.

Modern Russian information operations are rooted in Soviet-era “active measures” but have evolved into a highly coordinated digital strategy. 

The report highlights Russia’s continued interest in exploiting international crises. 

From the COVID-19 pandemic to sporting events such as the Olympics, influence campaigns frequently adapt to emerging news stories that offer opportunities to shape public opinion or deepen existing divisions.

AI reshapes information warfare

One of the report’s most significant findings is the growing use of generative AI throughout the influence lifecycle.

GTIG has observed AI to support all phases of the IO lifecycle covering planning, research and content creation.

This allows influence actors to produce convincing narratives that hijack “existing ideological and emotional fissures within a society” to tailor messages to specific audiences and boost engagement.

Pro-Russia actors continue to refine established techniques that maximise credibility and reach of their propaganda.

These techniques range from impersonating legitimate news organisations, creating fake media outlets, distributing messages through email and messaging platforms and exploiting existing political or ideological tensions to make false narratives appear more believable.

An intertwined ecosystem of influence 

GTIG pins Russia’s influence ecosystem as a connected network of entities that operate as a cohesive unit.

State media organisations, intelligence agencies, cyber espionage groups, hacktivists and proxy organisations frequently reinforce each other’s activities. 

Information stolen through cyberattacks may later appear in disinformation campaigns, while state media can amplify narratives first introduced through covert channels.

When individual campaigns or infrastructure are exposed, operators often adapt quickly by creating new domains, adopting different tactics or shifting activity to alternative platforms. Through this, they form a remarkably resilient ecosystem.

While not always directly controlled by the Russian state, pro-Russia hacktivist groups also support Kremlin objectives by launching disruptive cyberattacks, promoting propaganda or amplifying strategic messaging. 

The nature of such groups often provide covert shelter to the Kremlin, helping it maintain plausible deniability while contributing to wider influence efforts.

Understanding dynamics 

GTIG’s research identifies ten defining characteristics that explain why Russia's influence ecosystem continues to be effective. 

Researchers note that large-scale information operations now form a permanent capability than one-off temporary campaigns, with new operations replacing older ones as strategic priorities evolve.

Persistence is another defining feature. Even after infrastructure is exposed or disrupted, operators frequently recycle domains, create mirror websites and continue using compromised assets to maintain momentum.

The report also highlights the growing convergence of cyber operations and influence campaigns. Stolen data is increasingly weaponised through so-called “hack and leak” operations, while cyberattacks are often accompanied by coordinated disinformation designed to maximise psychological impact.

Hacktivist groups have become a central part of the ecosystem. Groups claiming responsibility for distributed denial-of-service attacks and network intrusions frequently use these incidents to amplify pro-Russia narratives, intimidate targets and attract media attention, regardless of the actual impact of the attacks.

Another notable finding is the close relationship between overt and covert operations. Russian state media does not simply broadcast government messaging. According to GTIG, it also helps seed narratives that covert actors later amplify across social media, fake news sites and messaging platforms. 

In parallel, the Kremlin increasingly relies on contractors and proxy organisations to develop tools and execute campaigns, allowing operations to scale while maintaining plausible deniability.

Taken together, these findings demonstrate that Russia's influence ecosystem is no longer a loose collection of disconnected campaigns.

It has matured into an adaptable, interconnected network capable of responding rapidly to geopolitical events while continuously refining its tactics through experience and emerging technologies.