Ben Gilbert describes himself on Bluesky, the social media app, as an “economist, lit and guitar nerd, rugby fan, owner of excessive pets.” A professor at the Colorado School of Mines, he rarely posts, but when he does, the subjects reflect his expertise in natural resources.
So it was odd when a video purporting to be a news report appeared on his account last month, blaming France’s financial and political support for Ukraine for police staff shortages at home.
Without his knowledge, Gilbert said, he had fallen victim to Russia’s latest tactic to try to spread its propaganda in the West.
His account, like hundreds of others on Bluesky, had been hijacked and used to post fake news articles, according to the company and researchers at Clemson University working with a collective of internet monitors who track Russian influence operations and call themselves the dTeam.
The compromised Bluesky accounts included those of people who are influential in their fields, though perhaps not famous. They were journalists and professors, a pollster in Texas, an anime artist and a filmmaker in Hollywood, whose account posted a video doctored by artificial intelligence to impersonate a Canadian police official criticizing France’s president, Emmanuel Macron.
The campaign, which the researchers at Clemson linked to the Social Design Agency, a company in Moscow, shows how Russia continues to seek new ways to erode public support for Ukraine, which Russian forces invaded in 2022.
Bluesky has grown more prominent as a rival platform to X since X’s owner, Elon Musk, threw his political support behind President Donald Trump before the 2024 election. With 42 million users, Bluesky trails far behind X’s nearly 600 million.
While Russians have long flooded social media with fake accounts and content, hacking into real accounts appeared to be a novel strategy.
“They are clearly still experimenting,” said Darren L. Linvill, a director of Clemson’s Media Forensics Hub.
Bluesky has been tracking the activity and removing the posts — as many as a couple of thousand. They came in waves starting in April and continuing until at least last week.
The company called Russian influence operations “an industrywide problem.” “We dedicate significant resources toward detecting and disrupting coordinated inauthentic campaigns,” the statement said.
Gilbert of the Colorado School of Mines, a public research university near Denver, learned of the post on his account when The New York Times contacted him. “I just deleted it,” he wrote in an email.
In other cases, Bluesky has suspended accounts until the owners stepped forward to reset them. Many targets learned of the hacking only when they were locked out of their accounts. One of them was Pamela Wood, a political reporter at The Baltimore Banner.
She was on vacation April 28 when her account was suspended after it posted a short video with a caption that said The New York Post had linked Ukraine to the man charged with trying to assassinate Trump last month at the White House Correspondents’ Association dinner.
“Bluesky didn’t provide much information but suggested that my account may have been hacked or compromised,” Wood said. “My account is rather vanilla — just posting my stories, pretty much — and I hadn’t posted or even looked at Bluesky in a few days, so getting hacked made the most sense.”
Clemson attributed the Social Design Agency’s campaign to a Kremlin influence operation that researchers have called Matryoshka, after the Russian nesting dolls.
The operation, which emerged in 2024, specializes in creating fake articles that look as if they were from real news organizations like Reuters or France 24. The goal seems to be to spread the claims by encouraging fact checkers to debunk them.
Russian news outlets also cite these fabricated posts, falsely suggesting that the content, mostly in English, originated in the West. The Social Design Agency did not respond to a request for comment.
PREVIOUS ARTICLE