Documented cases
Five publicly attributed operations, summarised as forensic profiles. Each profile keeps to the public domain: established facts, the principal technique, institutional attribution, sources. The full technical reconstruction and the unpublished analyses appear in the manuscript.
These profiles contain neither original indicators of compromise, nor a complete mapping of infrastructure, nor as-yet-unpublished analyses. For each case, they point to the first-hand institutional reports.
Portal Kombat
- Identification
- February 2024
- Attribution
- Viginum (SGDSN) · DFRLab
- A structured, coordinated network of portals disseminating content favourable to Russian positions, identified by Viginum in February 2024.
- Automated aggregation and republication of content from pro-Russian sources and state media.
- Multilingual variants and geographic targeting, with portals dedicated to different countries and regions.
- The network, built around an ecosystem of "pravda" sites, was the subject of later investigations showing its extension worldwide.
A network of portals carrying out massive, automated republication, organised to saturate the local information space rather than to convince directly.
Viginum published a report on the Portal Kombat network in February 2024. The Digital Forensic Research Lab (DFRLab) documented the international extension of the "pravda" network in 2025.
The case is analysed in Chapter 4 from the angle of the industrialisation of dissemination and the logic of saturating the information space.
Matriochka
- Identification
- June 2024
- Attribution
- Viginum (SGDSN)
- A pro-Russian campaign identified by Viginum in June 2024, targeting news outlets and the fact-checking community.
- A two-stage architecture, "sower" accounts disseminating content, "relay" accounts amplifying it.
- Direct solicitation of newsrooms and verification desks, on X and by email, to push them to address fabricated content.
- Recurring targets: France 24, RFI, AFP and named journalists.
- A reflexive logic: the campaign seeks to mobilise the attention of verification itself as a vector of exposure.
Organised solicitation of fact-checking: pushing verifiers to devote time and visibility to content fabricated for the occasion.
Viginum publicly documented and attributed the campaign in a June 2024 report devoted to the Matriochka operation.
The case is treated in Chapter 4 as an illustration of the reflexive exploitation of verification, a mechanism taken up in the typology of resonators.
Doppelganger / RRN
- Identification
- June 2023
- Attribution
- Viginum (SGDSN)
- An information-manipulation campaign active since 2022, publicly identified by Viginum in June 2023.
- Creation of domains impersonating leading French media outlets, Le Monde, Le Figaro, Le Parisien, 20 Minutes, through typosquatting.
- Publication of fake articles imitating the visual identity of the cloned titles, then relayed on social networks.
- Setting up of ad hoc pseudo-news sites, including the "RRN" (Reliable Recent News) portal.
- Narratives centred on the erosion of Western support for Ukraine and on divisive domestic themes.
- Documented persistence of the infrastructure despite successive sanctions and reports.
Domain impersonation and the cloning of legitimate media, combined with amplification through coordinated inauthentic behaviour on the platforms.
Viginum documented the campaign in a technical report of June 2023 and linked it to Russian entities. The European Union adopted sanctions targeting individuals and entities involved (July 2023). EU DisinfoLab maintains ongoing monitoring.
The case is analysed in Chapter 4 (forensic analysis of the corpus), where it serves as a study of the infrastructural persistence of an operation despite its public designation.
2024 legislative elections (France)
- Identification
- Summer 2024
- Attribution
- Viginum, 2024 activity report
- A convergence of FIMI activity around the French electoral sequence of summer 2024, the dissolution of parliament and the snap legislative elections that followed.
- Reactivation of already-documented modes of operation (site cloning, fake content) on electoral themes.
- Documented adjacent activity: the Russian Storm-1516 operation (fake whistle-blowers, deepfakes, invented outlets) targeted the sequence, including a fake "ensemble-24.fr" site spreading the false €100 "Macron bonus", laundered via the CopyCop network (Viginum technical report, 7 May 2025).
- Dissemination of fake institutional content and false announcements aimed at sowing confusion about the electoral process.
- Exploitation of the social tensions and polarisation specific to the campaign.
- Activity synthesised in Viginum's 2024 activity report, which devotes a substantial part to the protection of elections.
Multi-vector amplification and the exploitation of internal tensions, grafted onto pre-existing FIMI modes of operation.
Viginum reported on this activity in its 2024 activity report, without publishing a stand-alone report dedicated to the legislative elections.
The case is treated in Chapter 4 in the section devoted to electoral sequences as windows of epistemic vulnerability.
Paris 2024 Games
- Identification
- Summer 2024
- Attribution
- Viginum (SGDSN) · Microsoft (MTAC)
- The most internationally visible information environment in the corpus, targeted during the Paris Olympic and Paralympic Games (26 July, 11 August 2024).
- The "Seine water" fabrication: a fake ANSES report alleging E. coli levels dangerous to athletes, identified as a Doppelganger product within 48 hours; an AFP Factuel correction within 52 hours, after multilingual circulation.
- Impersonations and synthetic content: a fake CIA-branded video announcing a "high" terrorism threat level, a fake City of Paris document, and fake DGSI and CIA briefings (the Storm-1679 modus operandi).
- Amplification by an automated-account network (estimated at around 30,000 accounts by the Associated Press) and exploitation of the debate around the athlete Imane Khelif.
- A "doping" strand targeting the World Anti-Doping Agency: Russian elements at high confidence (via Portal Kombat) and China-attributed elements at low-to-moderate confidence (the Spamouflage network).
- Fragmented institutional response: three uncoordinated corrections (Viginum, the Organising Committee, the Ministry of Sport) over a 72-hour window.
Exploitation of legitimate uncertainty ("uncertainty amplification") and saturation of a high-demand international media environment, through institutional impersonation and synthetic content.
Viginum published a summary of the information threat that targeted the Games (13 September 2024). Russian targeting is established at high confidence; the China-attributed elements are at low-to-moderate confidence, by convergence of several research centres.
The case is analysed in Chapter 4 as a study of major international events as windows of epistemic vulnerability, and of the fragmentation of institutional response.
“These operations share a structural feature: they do not invent their effectiveness, they exploit pre-existing vulnerabilities in the democratic fabric. This is what the thesis calls societal resonators.”