ANCOM warns of a network of cloned sites
ANCOM warns about the presence in the online local space of a network of Doppelganger sites, discovered following an investigation carried out in cooperation by several state institutions.
« A network of cloned sites has been identified, which just mimics the image of the official websites of some public institutions, televisions and important press agencies (the Government of Romania, the Ministry of Health, TVR 1, Digi24, Hotnews, Adevărul, Freedom), used to promote the deceitful content, on the social, political, of its perception ”, says ANCOM.
The information campaign is a complex one, carried out below the limit of anomalies detection and aims to use specific tactics, such as the exploitation of social media algorithms, the use of content generated by AI, the establishment of subliminal narratives, the use of advertisements adapted to the specific of vulnerable audiences, as well as trans-sectorial activities to activate some reactions.
The same informational infrastructure is used to carry out micro profiling activities that allow the definition of vulnerable audiences to the misinformation narratives and calibrate the messages according to emotional niches.
These actions of influence do not aim to promote specific entities, but to amplify at the level of the collective mind of some social, economic and political dissatisfaction in order to polar the society and decrease the confidence of the population in the public authorities, thus limiting the capacity to react of the state, respectively the influence of decisions at national level.
Thus, it was observed the emergence of networks and non -authentic accounts on a social media platform with a coordinated level of posts and content to determine a very high interaction. These pages systematically distribute the content generated by AI (both images and written), especially subjects with emotional impact to generate reactions from real users.
Within this ecosystem were identified links that redirect users to the aforementioned cloned pages, through malicious advertisements, used as « trampolines », present on local sites, especially clickbait type (eg cezicelumea.ro, sources.eu sticelitative.ro, dromania.ro, edactia.ro, viralnews.ro, lendermagazin.ro etc.).
The malicious advertisements are presented in the form of false news titles, the advertising spaces in which they are posted being contracted by the advertising companies using « Native ADS » technology – Adskeeper, Geozo, Adenow and MGID, previously reported in the public space for direct links with the Russian Federation. For example, ADNOW is the subject of extended investigations in other Member States, but also in Romania for involvement in information operations in favor of the Information Services of the Russian Federation.
In addition, on the cloned sites are found advertisements in both Romanian and in a language another foreign language that promotes similar deceitful content, paid through fictitious pages/accounts. The entire infrastructure is supported by the pages in question that distribute content elements generated by the artificial intelligence mentioned above.
« We specify that the responsible public authorities act in a coordinated way to counteract these malicious actions and limit its effects on the population, in partnership with the Internet service providers and the social media platform.
The investigations and checks are in progress, following the establishment and unavailability of the entire digital infrastructure that supports the presented ecosystem, respectively identifying and liable for the entities involved.
In order to avoid misleading through the exposed mechanism, it is recommended that the official website pages of public institutions or the media entities are accessed directly, ”ANCOM reports.
