It didn't take Russia's misinformation machine long to settle on who was to blame for the first assassination attempt on a European national leader in more than two decades.
When Slovakia's prime minister was shot five times on May 15, pro-Kremlin propaganda blamed Ukraine even before the authorities released any details about the gunman.
At first glance the attack seemed to be a setback for the Kremlin. Robert Fico, who remains hospitalized, is one of a handful of pro-Russian European Union leaders, and he opposed military aid to Ukraine.
But in the through-the-looking-glass world of disinformation, no news is bad news. That’s why pro-Russian social media channels, influencers and state media have seized on the shooting, suggesting that Fico was a victim because of his sympathies toward the Kremlin.
The Cyber Army of Russia Reborn, a hacking and disinformation group that frequently pushes Kremlin narratives, has circulated messages on the Telegram social media app suggesting that the 71-year-old suspect was a member of Progressive Slovakia, a pro-EU party that supports Ukraine. Local authorities have debunked the allegation.
Even so, the misinformation quickly spread on posts on X and Reddit, where anonymous accounts flooded Fico-themed discussions with speculation that the shooter was somehow affiliated with pro-Ukrainian forces. There’s no evidence of a such a link. Slovakian officials have called the shooting politically motivated and are investigating whether the attacker was part of a larger group.
One Telegram post compared the failed assassination to the 1914 killing of Austrian Archduke Franz Ferdinand that sparked World War I, the kind of veiled rhetoric that alludes to an imminent global conflict.
“Their main objective is to weaken support by creating so many domestic problems that we divide ourselves,” says Bilyana Lilly, cyber chair at the Warsaw Security Forum and the author of the book Russian Information Warfare. “We’ve removed all the levers to stop them from doing this in any way.”
The Cyber Army of Russia Reborn, which has more than 49,000 followers on Telegram, tries to boost its believability by circulating articles from websites that impersonate legitimate news outlets. It took credit for targeting water facilities in the US this year and may have ties to Russian military intelligence, Madiant Intelligence said in April.
The Cyber Army of Russia Reborn couldn’t be reached for comment.
In one example, it linked to a site that mimicked Britain's Telegraph, using a URL only slightly different from the newspaper’s website. Masquerading as local news websites fits within a history of propagandists trying to capitalize on the credibility of legitimate media organizations. Earlier this year, Russian media promoted a deepfake in which a journalist from France 24 seemed to announce that Emmanuel Macron postponed a trip to Ukraine because of an assassination attempt.
The Cyber Army of Russia Reborn also publicized posts from a pro-Russian hacking group, NoName, that called for cyberattacks against Slovakia’s pro-European parties.
Russian state media, meanwhile, have taken a complementary approach. A Sputnik Media article billed as an investigation said Western media, foreign non-governmental organizations and the US Agency for International Development were responsible for “turning up the political temperature” in Slovakia prior to the shooting.
That rhetoric matches that of some of Fico’s political allies, who have blamed the opposition and liberal media. Andrej Danko, the leader of the Slovak National Party that governs in coalition with Fico, last week vowed “to start a political war.”
As with any misinformation or political propaganda, the material effects of Russia’s Fico rhetoric are impossible to measure. Instead, the messaging points to the Kremlin’s commitment to creating even small cracks in international public opinion in a way that could weaken resolve to support Ukraine as a new offensive by President Vladimir Putin’s troops is gaining ground.
Kevin Mandia, founder of the threat intelligence firm Mandiant, announced that he’s stepping down as chief executive officer of the company nearly two years after it was acquired by Google.
Mandia, a former member of the US Air Force, built Mandiant into a leading cyber firm that’s helped clean up breaches at companies including Sony Pictures after North Korea hacked it in 2014. Mandiant researchers also have led the effort among security vendors to report on foreign nation-state cyber-espionage that target US firms. In its latest installment, the company published new details on Wednesday about pro-Chinese hacking.
Mandia has also been active in the cybersecurity venture capital market as the co-founder of Ballistic Ventures. He’ll transition to an advisory role at Google in the coming weeks, he said in an internal memo.