Just So You Know: Foreign Threat Actors Likely to Use a Variety of Tactics to Develop and Spread Disinformation During 2024 U.S. General Election Cycle

As part of efforts to combat foreign actors who are seeking to interfere in and influence U.S. elections, the Department of Justice (DOJ), in collaboration with federal partners, has taken a series of actions to degrade Russian threat actors' capabilities to conduct these malign influence campaigns.

In July 2024, the DOJ, in coordination with U.S. and international partners, exposed a covert Russian government-operated, AI-enhanced social media bot farm using specialized software to create fictitious social media personas at scale. In September 2024, the DOJ took steps to disrupt Russian government-directed foreign malign influence campaigns by seizing more than 32 internet domains controlled by Russian government malign influence actors. The DOJ also indicted employees of a Russian state-controlled media outlet who covertly funded and directed a U.S.-based company that deployed nearly $10 million to disseminate pro-Russian narratives to a U.S. audience.

Over the course of these actions, the DOJ seized website domains that Russian malign influence actors created and deliberately designed to look like legitimate mainstream news websites (see below for examples). Many of the seized domains employed "cybersquatting," — a method of registering a domain intended to mimic another person's or company’s domain. The images below are screen captures of articles produced by these Russian government actors. These examples include websites such as "washingtonpost.pm", and "fox-news.in," which are not the real websites of the Washington Post and Fox News

Russian malign influence actors also created fake social media profiles posing as U.S. citizens to direct users to these fake news websites and purchased social media advertisements to drive traffic to the specific fake articles on the fake news site. The Appendix at the end of this document provides a compilation of websites that the FBI, Department of State, or Department of Treasury have previously publicly attributed to Russian malign influence actors, as well as websites and social media accounts that the Intelligence Community has attributed to Russian malign influence actors.

In addition to Russia, Iran is also undertaking influence operations as it has in past election cycles, including through its cyber apparatus, targeting current and former U.S. government officials, members of the media, nongovernmental organizations, and individuals associated with U.S. political campaigns. Iran is probably using generative AI and inauthentic personas to hide its hand and attempt to sow discord during the 2024 U.S. election cycle. On September 27, 2024, the DOJ charged three Iranian nationals identified as employees of the Islamic Revolutionary Guard Corps (IRGC), for a wide-ranging hacking conspiracy targeting current and former U.S. officials. The three IRGC employees are alleged to have conspired to hack into accounts of current and former U.S. officials, members of the media, nongovernmental organizations, and individuals associated with U.S. political campaigns. That indictment further alleged that in June 2024, the IRGC conspirators engaged in a "hack-and-leak" operation, in which they sought to weaponize campaign material stolen from a U.S. Presidential campaign. Additionally, the FBI, U.S. Cyber Command, the Department of Treasury, and the United Kingdom's National Cyber Security Centre have previously disseminated a Joint Cybersecurity Advisory that includes a list of malicious domains used by cyber actors working on behalf of the IRGC, which is linked below. We have also seen Iranian actors use similar tactics as Russian malign influence actors where they create inauthentic news sites posing as a legitimate media organization (see example below).

We urge the American public to critically evaluate the sources of the information they consume and to seek out reliable and verified information from trusted sources, such as state and local election officials. Specifically, we recommend the American public take the following precautions:

• Educate yourself and others on the tactics of foreign malign influence operations, including the use of generative AI and deep-fakes, and their goal to undermine American public confidence in U.S. democratic institutions and processes. Greater public awareness may help limit the spread of foreign malign influence campaigns.
• Seek out information from trusted, official sources, such as state and local election officials, and verify reported claims through trusted, official sources before sharing such information.
• To better understand what you are viewing, know the media and social media company policies and citation rules to denote or disclose content created or doctored with generative AI tools. When viewing content, consider who produced it and look for labels that may identify the content as AI-generated.
• Consider reporting information concerning suspicious or criminal activity, to include the distribution of knowingly false information regarding the time, place, or manner of elections designed to deprive individuals of their right to vote, to their local FBI field office.

The FBI and CISA coordinate closely with federal,state, and local election partners and provide services and information to safeguard U.S. voting processes and maintain the resilience of U.S. elections. The FBI, alongside DOJ prosecutors, is responsible for investigating and prosecuting election crimes, foreign malign influence operations, and malicious cyber activity targeting election infrastructure and other U.S. democratic institutions. The FBI does not investigate, collect, or maintain information on U.S. persons solely for the purpose of monitoring activities protected by the First Amendment. CISA, as the Sector Risk Management Agency for Election Infrastructure, is the federal government lead for working with critical infrastructure owners and operators, including the election infrastructure community, to ensure the security and resilience of election infrastructure from physical and cyber threats.

We encourage the public to report information concerning suspicious or criminal activity, to include the distribution of knowingly false information regarding the time, place, or manner of elections designed to deprive individuals of their right to vote, to their local FBI field office (www.fbi.gov/contact-us/field).

For additional assistance to include common terms and best practices, such as media literacy, please visit the following websites:

• Protected Voices | FBI
• #Protect2024 | CISA
• Foreign Malign Influence Center Newsroom | ODNI
• Risk in Focus: Generative AI and the 2024 Election Cycle | CISA
• Securing Election Infrastructure Against the Tactics of Foreign Malign Influence Operations | CISA
• Joint Cybersecurity Advisory: State Sponsored Russian Media Leverages Meliorator Software for Foreign Malign Influence Activity | FBI
• Joint Cybersecurity Advisory: Iranian Cyber Actors Targeting Personal Accounts to Support Operations | FBI

• Just So You Know: False Claims of Hacked Voter Information Likely Intended to Sow Distrust of U.S. Elections | FBI, CISA
• Just So You Know: Ransomware Disruptions During Voting Periods Will Not Impact the Security and Resilience of Vote Casting or Counting | FBI, CISA
• Just So You Know: DDoS Attacks Could Hinder Access to Election Information, Would Not Prevent Voting | FBI, CISA

• Justice Department Leads Efforts Among Federal, International, and Private Sector Partners to Disrupt Covert Russian Government-Operated Social Media Bot Farm | DOJ
• Justice Department Disrupts Covert Russian Government-Sponsored Foreign Malign Influence Operation Targeting Audiences in the United States and Elsewhere | DOJ
• Two RT Employees Indicted for Covertly Funding and Directing U.S. Company that Published Thousands of Videos in Furtherance of Russian Interests | DOJ
• Three IRGC Cyber Actors Indicted for 'Hack-and-Leak' Operation Designed to Influence the 2024 U.S. Presidential Election | DOJ

1. Early October 2024
2. Mid-September 2024
3. Early September 2024
4. Late July 2024
5. Early July 2024