Bluesky says the Kremlin is hacking his platform to spread propaganda

Ben Gilbert describes himself on Bluesky, a social media app, as an “economist, enlightened guitar nerd, rugby fan, owner of excessive amounts of pets.” The Colorado School of Mines professor rarely publishes, but when he does, the subjects reflect his natural resources expertise.

So it was strange when a video pretending to be a news report appeared on his account last month, blaming France’s financial and political support for Ukraine for the lack of police personnel at home.

Unbeknownst to him, Mr. Gilbert said, he had fallen victim to Russia’s latest tactic to try to spread its propaganda in the West.

His account, like hundreds of others on Bluesky, was hijacked and used to publish fake news articles, according to the company and Clemson University researchers working with a collective of Internet monitors that track Russian influence operations called the dTeam.

Bluesky’s compromised accounts included people who are influential in their fields, though perhaps not famous. They were journalists and professors, an explorer in Texas, an anime artist and a filmmaker in Hollywood, whose account posted a video edited by artificial intelligence to impersonate a Canadian police official criticizing French President Emmanuel Macron.

The campaign, which Clemson researchers linked with the Social Design Agency in Moscow, shows how Russia continues to find new ways to erode public support for Ukraine, which Russian forces invaded in 2022.

Bluesky has become more prominent as a rival platform to X since X owner Elon Musk threw his political support behind President Trump ahead of the 2024 election. However, with 42 million users, Bluesky lags behind X’s nearly 600 million.

While Russians have long flooded social media platforms with fake accounts and content, hacking real accounts appeared to be a new strategy.

“Obviously, they’re still experimenting,” said Darren L. Linvill, director of Clemson’s Media Forensics Hub. “They are always experimenting.

Bluesky monitors activity and removes posts – up to several thousand. They came in waves starting in April and lasting until at least last week.

The company called Russian influence operations an “industry-wide problem” in a statement. “We are devoting significant resources to detecting and disrupting coordinated inauthentic campaigns,” the statement said.

Mr. Gilbert, of the Colorado School of Mines, a public research university near Denver, learned of the post on his account when The New York Times contacted him. “I just deleted it,” he wrote in an email.

In other cases, Bluesky has suspended accounts until owners proceed to reset them. Many targets only found out about the hack when their accounts were locked. One of them was Pamela Wood, a political reporter in Baltimore Banner.

She was on vacation on April 28 when her account was suspended after it posted a short video with a headline that said The New York Post had linked Ukraine to the man accused of trying to assassinate Mr. Trump at the White House Correspondents’ Association dinner last month.

“Bluesky didn’t provide much information but indicated that my account may have been hacked or compromised,” Ms Wood said. “My account is more vanilla – I basically just post my stories – and I haven’t posted or looked at Bluesky in a few days, so getting hacked made the most sense.”

Clemson attributed the Social Design Agency’s campaign to a Kremlin influence operation that researchers dubbed Matryoshka, after the Russian nesting dolls.

The operation, which emerged in 2024, specializes in creating fake articles that appear to be from real news organizations such as Reuters or France 24. The goal appears to be to spread the claims by encouraging fact-checkers to debunk them.

Russian news media also cite these fictional posts, falsely implying that the content, mostly in English, originated in the West. The Social Design Agency did not respond to a request for comment.

Russian Bluesky propaganda first surfaced during Germany’s election last year, when the Kremlin sought to bolster Germany’s far-right, led by the Alternative for Germany party, known as the AfD.

Joseph Bodnar, a researcher at the Institute for Strategic Dialogue, an international organization that has also tracked Russian disinformation, said the hijacking of individual accounts on Bluesky had “a level of sophistication beyond what we typically see.”

“What we typically see is the use of hijacked accounts on X, but these are random, obscure accounts with crazy avatars,” said Mr. Bodnar, who was not involved in the Clemson research. “He’s not trying to be moderately well-known or respected.”

Ukraine is almost always the main target of Matryoshka operations, but previous campaigns have also sought to discredit preparations for the 2024 Summer Olympics in Paris and the Trump administration’s dismantling of the US Agency for International Development.

That was one of Russia’s most successful disinformation operations, Mr. Linvill said. It contained videos with fabricated news reports suggesting that USAID had paid celebrities, including actor Ben Stiller, to travel to Ukraine. These posts have been seen by millions of people.

Although Mr Trump has been the subject of recent posts on Bluesky, most have shown Russian preoccupation with France, which has emerged as the leader of European efforts to bolster Ukraine in the war, and Armenia, a former Soviet republic whose elections next month could move further out of Moscow’s orbit.

“He only needs to get lucky a few times to make it worth it,” Mr Linvill said.