GTIG observed multiple pro‑Russia information operations rapidly promoting narratives to deflect blame for the Sept. 9–10, 2025 Russian drone incursion into Polish airspace and to undermine Polish and NATO responses. These campaigns—including Portal Kombat, Doppelganger, and Niezależny Dziennik Polityczny (NDP)—amplified messaging that questioned Russian culpability, blamed NATO/Poland, and aimed to erode domestic and international support for Ukraine. #PortalKombat #NiezależnyDziennikPolityczny
Keypoints
- GTIG tracked multiple pro‑Russia IO actors rapidly leveraging the Sept. 9–10, 2025 drone incursion into Polish airspace to push coordinated influence narratives.
- Primary influence objectives included denying Russian culpability, blaming NATO/Poland, undermining Polish domestic confidence, and reducing international support for Ukraine.
- Portal Kombat (aka “Pravda Network”) published articles claiming the drones could not reach Poland, alleging videos were fake, and suggesting the incident was used to derail U.S.–Russia negotiations.
- The Doppelganger actor deployed inauthentic custom media brands (e.g., Polski Kompas, Deutsche Intelligenz) publishing Polish‑ and German‑language pieces that cast Poland/NATO as provocative and overstating the threat.
- NDP (Niezależny Dziennik Polityczny) amplified narratives of “war hysteria,” alleged pre‑warning to Poland, and framed NATO responses as destabilizing and politically motivated.
- These examples illustrate how long‑standing pro‑Russia influence infrastructure can be rapidly repurposed around emerging geopolitical events to manipulate public opinion.
- GTIG emphasizes ongoing monitoring and content enforcement across Google surfaces and notes Poland and NATO members remain high‑priority targets for Russia‑aligned influence activity.
MITRE Techniques
- [T1609] Deception and Influence Operations – Use of inauthentic media brands and persona networks to spread narratives around the drone incursion, e.g., “Portal Kombat…acting as amplifiers of content seeded within the broader pro‑Russia ecosystem” [‘…acting as amplifiers of content seeded within the broader pro‑Russia ecosystem…’]
- [T1589] Gather Victim Identity Information – Creation and use of suspected inauthentic personas as editors/contributing authors to lend credibility and target Polish audiences, e.g., “suspected inauthentic personas as editors or contributing authors” [‘…suspected inauthentic personas as editors or contributing authors…’]
- [T1591] Aggregate Publicly Available Information – Leveraging publicly visible events (the drone incursion) and media artifacts (videos, reports) to craft and amplify narratives, e.g., articles claiming “videos of the drones shown in the Polish media are fake” [‘…videos of the drones shown in the Polish media are fake…’]
- [T1604] Disinformation – Publishing false or misleading narratives to shift blame and erode trust (denying Russian culpability, accusing NATO/Poland), e.g., articles reframing events to accuse Poland or NATO of manufacturing pretext [‘…reframing of the events to serve Russian strategic interests, effectively accusing either Poland or NATO of manufacturing pretext…’]
- [T1598] Phishing for Influence (Social Media Manipulation) – Use of branded social media assets to amplify targeted narratives and shape opinion, e.g., “content promoted by NDP branded social media assets that referenced the drone incursion” [‘…content promoted by NDP branded social media assets that referenced the drone incursion…’]
Indicators of Compromise
- [Domains] Domains used as amplifier networks and inauthentic media brands – examples: Portal Kombat domain network (amplifier subdomains), PolskiKompas domain for Doppelganger and DeutscheIntelligenz domain for Doppelganger (examples of brand domains)
- [Publication Names / Media Brands] Inauthentic outlets and campaign names used to disseminate narratives – examples: Niezależny Dziennik Polityczny (NDP), Portal Kombat, Polski Kompas, Deutsche Intelligenz
- [Persona Accounts] Suspected inauthentic personas and branded social media assets used to promote content – examples: NDP attributed personas on social platforms, Doppelganger custom media personas