The recently released joint Cybersecurity Advisory, titled “State-Sponsored Russian Media Leverages Meliorator Software for Foreign Malign Influence Activity,” sheds light on a concerning development in the realm of cybersecurity and information warfare. This advisory, co-authored by the U.S. Federal Bureau of Investigation (FBI), Cyber National Mission Force (CNMF), the Netherlands General Intelligence and Security Service (AIVD), the Netherlands Military Intelligence and Security Service (MIVD), the Netherlands Police (DNP), and the Canadian Centre for Cyber Security (CCCS), aims to alert social media companies about the sophisticated tactics employed by Russian state-sponsored actors to manipulate public opinion on a global scale. The document highlights the covert use of Meliorator, an advanced AI-enhanced software package, by affiliates of RT (formerly Russia Today) to create and manage fictitious online personas for disseminating disinformation.
Meliorator, a covert software tool, has been identified as a key instrument in the Russian government’s toolkit for foreign malign influence activities. According to the advisory, this software allows its operators to generate highly realistic social media personas en masse, which are then used to spread disinformation across multiple platforms. The advisory notes that, while Meliorator has so far only been identified on X (formerly known as Twitter), there is strong evidence suggesting that its developers intended to expand its functionality to other social media networks, including Facebook and Instagram. This expansion would potentially increase the scope and impact of their disinformation campaigns.
The advisory provides detailed insights into the technical capabilities of Meliorator, which include creating authentic-looking social media profiles, deploying content similar to that of genuine users, mirroring disinformation from other bot personas, perpetuating existing false narratives, and formulating messages tailored to specific archetypes of the bots. The software’s administrator panel, Brigadir, serves as the main user interface, allowing operators to manage the bots and control their activities. Brigadir includes features for creating and managing “souls,” or false identities, and “thoughts,” which are automated scenarios or actions that the bots can perform.
Taras, the backend component of Meliorator, is responsible for executing the commands and scenarios created in Brigadir. It uses highly decentralized code, stored in .json files, to control the bots’ behavior on social media platforms. These files need to be combined with other tools and databases to achieve the desired functionality, making the software both flexible and powerful. The advisory includes technical diagrams and code snippets to illustrate how Meliorator aggregates and deploys these tools, providing a comprehensive overview of its inner workings.
One of the most concerning aspects of Meliorator is its ability to create highly sophisticated bot personas that can evade detection by blending seamlessly into the social media environment. The advisory describes three different archetypes of bot personas created by Meliorator. The first archetype includes complete profiles with AI-generated photos, biographical data, and political leanings, making them highly effective in spreading disinformation. The second archetype consists of minimal profile information and is primarily used to “like” and share existing content. The third and most sophisticated archetype uses data from webcrawlers and other repositories to create highly realistic personas that generate significant activity and followers, further amplifying the disinformation.
To avoid detection, Meliorator incorporates several obfuscation techniques. These include auto-assigning proxy IP addresses based on the bot’s assumed location, bypassing dual-factor authentication, and changing the user agent string to mask the bot’s identity. The advisory provides detailed examples of these techniques, highlighting the lengths to which the developers have gone to ensure the bots remain undetected.
The joint Cybersecurity Advisory urges social media companies to take proactive measures to counter this threat. It recommends implementing robust account verification processes to ensure that accounts are operated by real humans who comply with platform terms of use. Additionally, it advises upgrading authentication and verification methods, identifying and reviewing suspicious user agent strings, and making user accounts secure by default with settings that enhance privacy and remove unauthorized personally identifiable information.
For those seeking further information, the advisory directs readers to additional resources such as the U.S. Department of Justice press release on the disruption of a Russian government-operated social media bot farm and the FBI’s Protected Voices initiative. These resources provide valuable guidance on combating foreign malign influence and securing election infrastructure against disinformation tactics.
Overall, the advisory serves as a crucial warning to social media platforms about the sophisticated tools and techniques employed by Russian state-sponsored actors. By leveraging advanced AI-enabled software like Meliorator, these actors can significantly influence public opinion and exacerbate discord in target countries. The detailed technical information and recommended mitigations provided in the advisory are essential for social media companies to enhance their defenses and protect the integrity of their platforms from such malicious activities.