Russia’s Pravda Network: AI-Driven Disinformation on a Global Scale
Mejreme Asllani | 14 May 2025
Summary
A widespread Russian-linked network, 'Pravda' and 'Portal Kombat' operates hundreds of websites globally, mimicking local news outlets to amplify pro-Kremlin narratives.
This network generates significant political and security risks by disseminating disinformation and potentially compromising open-source intelligence (OSINT) gathering and Artificial Intelligence (AI) training datasets.
The network will likely persist and increasingly leverage AI, evolving into more sophisticated automated Information Operations (IO) tactics that will likely challenge global information integrity and AI safety in the long term.
The global information space serves as a critical battleground where state-affiliated entities employ increasingly sophisticated methods to influence perceptions and advance geopolitical agendas. A notable example is the extensive pro-Kremlin disinformation network identified by the Atlantic Council’s Digital Forensic Research Lab (DFRLab), CheckFirst and the French digital vigilance agency, VIGINUM. Named 'Pravda' by DFRLab due to its domain naming conventions (e.g., pravda-fr.com, pravda-de.com, serbia.news-pravda.com), the network also includes a particularly large and coordinated subset referred to as 'Portal Kombat'.
This operation has been active since at least early 2022, disseminating content regarding the war in Ukraine, witha significant worldwide increase in 2024. The Pravda ecosystem encompasses hundreds of news websites with over 3.7m published articles, meticulously designed to mimic the content of legitimate local news portals across Europe, the Americas, and Asia. Key European countries targeted by the Pravda network include France, Germany, Ukraine, Moldova and Serbia.
The primary strategy of networking avoids original content creation. Instead, it focuses on the large-scale copy-paste and amplification of narratives favourable to the Kremlin. This content is often taken directly from Russian state media outlets like Sputnik, RT, RIA, Telegram, official government statements, social media posts by Russian politicians, and pro-Kremlin supporters, and translated into the local language utilising automatic translation software. The network operates by flooding the digital sphere with high volumes of repetitive content through digital automation and almost to human generation. The overall aim of this network is multifaceted: to increase pro-Kremlin viewpoints in foreign information ecosystems, exacerbate existing societal divisions, undermine international support for Ukraine, erode public trust in democratic governments and credible media institutions, and ultimately shape a global narrative more aligned with Russia's strategic goals.
The Pravda/Portal Kombat network carries profound implications across political, operational, security, and potentially economic domains. Politically, it constitutes a persistent, low-cost tool for foreign interference, aiming to subtly manipulate public discourse, disseminate pro-Russia, anti-Ukraine, and anti-NATO narratives and potentially sway opinions on critical foreign policy decisions or during election cycles within targeted countries. Moreover, the network operates against nations imposing sanctions on Russia, effectively undermining these restrictions by disseminating targeted content. Its tactics also challenge national sovereignty by attempting to circumvent domestic media regulations and directly influence citizens.
Operationally, the network's decentralised structure and reliance on easily replicable website templates make it highly resilient. Exposing and dismantling one cluster often proves insufficient, as new domains can be quickly established, demonstrating an adaptability that complicates takedown efforts. This presents a persistent challenge for content moderators and cybersecurity agencies. The most significant security risk lies in the deliberate pollution of the information environment on an overwhelming scale. The sheer volume of content makes discerning credible information more difficult for the average user and complicates OSINT gathering for analysts. Critically, this flood of disinformation risks contaminating the vast datasets used to train Large Language Models (LLMs) and other AI systems. This concerns especially manipulation of Wikipedia content by Pravda network, as these LLMs are considered to get primary sources of knowledge from Wikipedia. The documented operation of Pravda-network content being cited on platforms like Wikipedia or ingested by AI tools illustrates a dangerous pathway for disinformation laundering, where biased or false narratives can be absorbed and presented as neutral facts by systems trusted and used by millions of people.
Economically, while direct costs are harder to quantify, the network indirectly impacts legitimate media outlets by competing for audience attention with zero-cost, automated content and increases the operational costs for tech platforms investing in detection and moderation.
B_A/Pixabay, CC-BY SA 1.0
Forecast
Short-term (Now - 3 months)
It is highly likely that the Pravda/Portal Kombat network will continue operating, potentially adapting tactics to evade detection following recent exposures.
It is likely that amplification in operations around key events, such as elections, will continue.
Medium-term (3-12 months)
It is likely that network operators will experiment further with AI for content translation, adaptation, and perhaps limited generation to boost efficiency.
It is highly likely that enhanced detection systems will improve, however network flexibility remains a key challenge.
Long-term (>1 year)
It is highly likely that techniques established by such networks will integrate a more sophisticated AI for automated, hyper-personalised disinformation, significantly challenging information integrity and AI safety globally.
