TL;DR
Google Threat Intelligence Group (GTIG) observed multiple pro‑Russia information operation (IO) actors amplifying narratives after reported Russian drone incursions into Polish airspace on Sept. 9–10, 2025. The campaigns pushed themes denying Russian culpability, blaming NATO or Poland, and seeking to weaken domestic and international support for Poland’s Ukraine policy.
What happened
GTIG reported that, in the immediate aftermath of reported Russian drone incursions into Polish airspace on Sept. 9–10, 2025, a range of pro‑Russia information operations rapidly promoted narratives tailored to different audiences. The activity included articles and social posts from established influence networks and inauthentic media brands. Portal Kombat (aka the “Pravda Network”) published pieces questioning whether the drones could have come from Russia, alleging media footage was fake, and suggesting officials politicized the incident to derail negotiations. The Doppelganger actor used linguistically targeted custom media sites (Polish and German) to claim Polish public opposition to government Ukraine policy and to portray European responses as exaggerated. The long‑running NDP campaign framed the incident as manufactured “war hysteria,” used suspected inauthentic personas, and shared related claims via branded social assets. GTIG characterized these examples as representative snapshots and noted the broader pro‑Russia ecosystem can quickly mobilize around major geopolitical events.
Why it matters
- Such operations can distort real‑time understanding of security incidents, making it harder for the public to assess threats based on facts.
- Messages aimed at blaming NATO, Poland, or Ukraine risk eroding domestic support for government policies and international assistance.
- The use of targeted, language‑specific outlets and inauthentic personas shows how influence infrastructure adapts to reach different regional audiences.
- Rapid re‑use of existing influence networks demonstrates how covert IO can amplify geopolitical stressors soon after events occur.
Key facts
- GTIG observed pro‑Russia IO activity tied to reported Russian drone incursions into Polish airspace on Sept. 9–10, 2025.
- Observed influence objectives included denying Russian culpability, blaming NATO or Poland, undermining Polish domestic confidence, and reducing support for Ukraine.
- Portal Kombat (also described as the “Pravda Network”) promoted narratives questioning the origin and authenticity of the drone reports and media.
- Doppelganger operated inauthentic custom media brands publishing in Polish and German that framed the incident as politicized or exaggerated.
- Niezależny Dziennik Polityczny (NDP) used suspected inauthentic personas and branded social assets to portray the response as ‘war hysteria’ and allege prior warning to Poland.
- GTIG noted that the highlighted examples are representative and not a comprehensive catalog of all pro‑Russia activity tied to the incident.
- Google said it tracks IO beyond its own surfaces and will continue to block inauthentic content on Google platforms, disclosing enforcement in the TAG Bulletin.
- GTIG found no single proof of coordination across all groups, but the quick, parallel response shows a responsive pro‑Russia influence ecosystem.
What to watch next
- Continued rapid mobilization of pro‑Russia influence networks after high‑profile geopolitical incidents, particularly those involving NATO members.
- Use of localized, language‑specific inauthentic media brands and social assets to tailor narratives to regional audiences.
- Google’s disclosed enforcement actions in the TAG Bulletin for updates on platform removals and mitigations.
Quick glossary
- Information operations (IO): Coordinated activities that aim to influence public opinion, decision‑making, or perceptions, often through messaging and media.
- Disinformation: False or misleading information created and spread deliberately to deceive or manipulate an audience.
- Inauthentic accounts/brands: Online personas or publications that misrepresent their identity or origin, often used to amplify targeted narratives.
- Influence campaign: A set of coordinated actions by actors seeking to change attitudes or behavior among particular populations.
- NATO: North Atlantic Treaty Organization — a political and military alliance of member countries in North America and Europe.
Reader FAQ
Who produced this reporting on the influence activity?
Google Threat Intelligence Group (GTIG) authored the observed findings described in the source.
Does the source confirm that Russia launched the drones?
Not confirmed in the source.
Were these pro‑Russia groups proven to be coordinating with each other?
GTIG noted parallel activity across actors but did not present evidence proving coordination among all groups.
Will Google take action against the identified content?
The source says Google will continue to track these threats, block inauthentic content on its platforms, and report enforcement in the TAG Bulletin.
Did the report assess how public opinion changed as a result?
Not confirmed in the source.
Written by: Alden Wahlstrom, David Mainor Introduction Google Threat Intelligence Group (GTIG) observed multiple instances of pro-Russia information operations (IO) actors promoting narratives related to the reported incursion of Russian…
Sources
- Pro-Russia Information Operations Leverage Russian Drone Incursions into Polish Airspace
- Video. Russian propaganda fuels disinformation about Poland …
- Russian Disinformation Surrounding Drone Incursions into …
- Russian Disinformation Followed Drone Incursion of Poland
Related posts
- Vietnam-linked actors post fake job ads to deliver malware and hijack ad accounts
- Defending Privileged Accounts: Monitoring Strategies for Modern IT Environments
- Cybersecurity Forecast 2026: Preparing Organizations for Emerging Threats