Putin really wants Trump back in the White House

Russia really wants Donald Trump to be the next US President, judging by reports from American government agencies and now Microsoft's threat intelligence team.

Based on Redmond's latest research on foreign trolls' election interference efforts, the Kremlin has shifted its focus to fake news aimed at discrediting Vice President Kamala Harris and her run for the presidency now that incumbent Joe Biden has bowed out of the race.

In late August and September, two Moscow-aligned groups began pumping out phony video content "designed to discredit Harris and stoke controversy around her campaign," according to Microsoft's September 17 report [PDF].

Storm-1516, a Putin-backed online troll farm known for its "outlandish fake videos and scandalous claims," produced said video content, with two pieces reaching a vast audience. 

One purports to show alleged Harris supporters attacking a Trump rally attendee. "Storm-1516 intended this video, which received millions of views, to inflame political divides by stirring racial and political tensions," the threat intel unit reported.

The second video uses an actor to amplify false claims that Harris paralyzed a girl in a hit-and-run accident. This one was distributed through a fake website purporting to be a legit local San Francisco news outlet. 

Meanwhile, Storm-1679, another Kremlin-linked crew, after focusing on the Paris Olympics for months, changed course to spread disinformation about Harris. Two of its videos spread conspiracy theories and false claims about her policies. 

One of these that received more than 100,000 views on X just four hours after being posted on Telegram showed a phony New York City billboard promoting made-up policies.

"MTAC has observed, in three consecutive US presidential elections, synchronized shifts by all Russian influence actors to focus on denigrating the Democratic candidate in the final 90 days before election day," Redmond asserts. "MTAC assesses this synchronization on themes and messages results from top-down direction from the top of the Kremlin."

Additionally, a Russian group led by a Federal Security Service (FSB) officer that Microsoft tracks as Ruza Flood — the US government calls this disinformation effort Doppelgänger, and earlier this month seized 32 internet domains owned by this crew — doesn't show any signs of slowing down its cyber-influence operations.

"In the days following the US government's seizures of Ruza Flood's web domains, we observed this actor moving media outlets from seized domains to new ones, where content can again be readily accessed," Microsoft wrote.

This gang uses typosquatted domains – sites with names that are close to legitimate ones — such as washingtonpost.pm rather than the real washingtonpost.com – to trick viewers into believing they are reading and watching content produced by reputable journos.

One of Doppelgänger's schemes to get Trump back in the White House, as detailed in a 277-page affidavit [PDF] used to obtain a warrant to seize the 32 websites, is called the Good Old USA Project [PDF]. 

"It makes sense for Russia to put a maximum effort to ensure that the US Political Party A point of view (first and foremost, the opinion of Candidate A supporters) wins over the US public opinion," according to this project. 

While the candidates' names and political parties have been redacted, the rest of the document makes it clear that Party A is the Republican Party and Candidate A is Trump.

The goal of the plan outlined in the doc is: "To secure victory of a US Political Party A candidate (Candidate A or one of his current internal party opponents) at the US Presidential elections to be held in November of 2024."®