The U.S. has revealed new intelligence of a Russian plot to use a phony video as a pretext for an invasion of Ukraine.

Senior administration officials said Thursday that the U.S. believes Russia has already recruited players to stage a propaganda video depicting “graphic scenes of a staged false explosion with corpses, actors depicting mourners, and images of destroyed locations and military equipment.”

The White House publicized the Kremlin’s alleged plans to fabricate an attack Thursday, in the hopes it would dissuade Moscow from going through with its latest disinformation effort.   

“We have made a decision — a strategic decision — to call out disinformation when we see it,” White House press secretary Jen Psaki said during a briefing with reporters, last week. “We are much more cognizant of the Russian disinformation machine than we were in 2014,” Psaki added. “Russia has a boundless capacity to misrepresent truth and what it’s doing.”

The Biden administration has been redoubling its counterattacks against Russia’s disinformation machine, reacting quickly to the storylines Moscow is churning out to undermine trust in Western democracy. 

Russia accelerates disinformation campaign on Ukraine and U.S.

U.S. officials registered a record-breaking number of efforts by Russian state media and proxies to push out anti-American and anti-Ukrainian content online, even as the Kremlin continues to threaten Ukraine by massing troops and equipment along the border.

In another example of Russia’s online malign influence campaign, self-declared “Russian federal news agency” Avia.pro published an article on January 23, claiming, “the United States has begun moving its heavy tanks and light armored vehicles to the border with Ukraine, apparently preparing to use these vehicles to attack Russia.” While Avia.pro is geolocated in the Netherlands, open-source data indicates the domain is registered to a private address of an apartment building in Moscow, Russia, according to fact-checking website StopFake.org.

Researchers at the Department of Homeland Security’s Office of Intelligence and Analysis have sorted through an avalanche of disinformation produced by Russian state media groups —including state media RT and Sputnik — that claim Russia has no intent to invade Ukraine and that the West fabricated the invasion story as an excuse for its own military buildup.

DHS warned state and law enforcement partners this week that “from September 2021 to January 2022, Russian state media and proxy websites published a greater number of anti-Ukrainian and anti-American narratives on a month-by-month basis than during any preceding period,” going back to World War II.

Anti-Ukrainian and anti-American narratives on the rise

“Ukraine-focused article production by Russian media outlets” surpassed 800 in January 2022, according to the DHS bulletin published Monday and obtained by CBS News. Researchers noted reactionary jumps in derogatory stories about the United States, NATO and its allies on December 7, following the video conference between President Biden and Russian President Vladimir Putin, then again on January 10 at the start of negotiations in Geneva, Switzerland.

Recently, Moscow’s online armies have spun out wild tales of disinformation accusing the U.S. of hiring mercenaries to carry out a chemical attack plot and revisiting false narratives aligning Ukrainians with Nazism.

“Disinformation is a significant threat,” deputy national security adviser Anne Neuberger told reporters Wednesday, during her diplomatic mission to Brussels.  

“The disinformation narrative is that Ukraine is the source of the crisis. That is not the case — Russia is the source of the crisis,” Neuberger stressed.

Russia is also perpetuating the lie that there are “significant NATO forces in Ukraine, significant threats in Ukraine to Russia, Neuberger added. “That is not the case.” She reiterated that Russia has amassed over 100,000 troops at Ukraine’s border.

Propaganda is flooding Telegram channels, according to the Ukrainian Crisis Media Center, a non-governmental organization backed by supporters of Ukraine’s sovereignty.  The group took note of one recently hatched claim that Ukraine and NATO are plotting an undercover operation code named “Crushing Sword.” That story, initially posted on the telegram account of Yan Leshchenko, self-proclaimed military leader of the so-called Luhansk People’s Republic, and circulated by Russian state media, uses bogus footage of Ukrainian aggression as a pretext for Russian military deployment.

While many messages are posted anonymously, others on Telegram connect to pro-Russian Ukrainian politicians such as Yevheniy Muraiev, the owner of “NASH” TV channel and one of Moscow’s chosen candidates for pro-Russian leadership, according to recent British intelligence reports concluding Putin plans to install a puppet government in Kyiv.

‘Not a lone cyber attack’: Russia’s hybrid information warfare

The White House dispatched its top cybersecurity official to NATO, Tuesday, to organize its mission to detect and deflect Russian cyberattacks – both against Ukraine, as well as possible retaliatory cyberattacks against Europe and the U.S. Neuberger equated Russia’s use of cyber with “a kind of kinetic operations” intended to destabilize a target population and government. “The goal of Russian disinformation is to… shake confidence in a country’s government or to make it difficult to assess a situation.”

Cyber criminals attempted to “shake confidence” in Ukraine last month, targeting more than 90 websites linked to 22 Ukrainian government organizations on January 14 in a three-pronged operation intent on driving Russia’s state-sponsored story, according to top Ukrainian cyber official Victor Zhora.

Approximately 50 websites were defaced with a “much smaller number of organizations and IT infrastructures” suffering damage. “Some external IT infrastructures were destroyed,” the deputy chairman of the State Service of Special Communications and Information Protection of Ukraine told CBS News.

Hackers successfully employed specially designed “wiper malware” on two of Ukraine’s government agencies, but there is no indication that personal information has been compromised.

And while the Ukrainian government has yet to formally attribute the attacks to Moscow, the investigation points to familiar Russian tactics.

“It’s a part of hybrid warfare against Ukraine. Cyberspace is just one of its areas of warfare,” said Zhora, who believes that the investigation would benefit from international experts.

“We consider this to be a psychological operation against Ukraine,” Zhora said. “It’s about seeding chaos and instability,” he added.

Ukrainian government websites, including the homepage for the Foreign Ministry, temporarily displayed a message warning Ukraine’s people to “be afraid and expect the worst.”

But in some ways, officials had expected far worse. “Fifty websites defaced and some data loss isn’t a big deal.” Zhora said, pausing. “It’s serious. It’s a good lesson for all of us. It’s one more hit in a series of cyber attacks, but we showed that our security cyber security system is working.”

Russia’s fake storyline themes

The State Department issued a fact sheet last month, highlighting five themes Russia has been trying to refine and peddle in its disinformation campaign to rationalize its own actions in Ukraine. For one, there’s “Russophobia” —  falsely portraying Russia as an ‘innocent victim’ of U.S. aggression, downplaying the Soviet’s alliance with Hitler during WWII and portraying the collapse of Western societies as “imminent.”

“Disinformation has been part of Russian military doctrine for more than a decade,” said James Lewis, a researcher and tech expert at CSIS. “The one thing Russians have learned is if you tell a falsehood often enough, there’ll be people who believe it.”

Lewis says that lesson learned was reinforced back in 2016, when Kremlin-backed trolls revamped their ‘classic playbook’ with an online disinformation campaign designed to sow doubt about the presidential election. The result culminated in a massive network of fake social media accounts or ‘bots’ programmed to spread divisive political content across the internet that would further exacerbate existing rifts in American society. But Russian meddling in U.S. elections — surfacing again for a bite in 2020 — offered up its share of hard-earned lessons to U.S. officials, too.

Experts tracking Kremlin-backed information warfare have welcomed the administration’s approach to combating Russia’s disinformation campaign, along with efforts by social media companies to curb fake news at its source.

“One thing that’s improved in recent years is that the social media companies have gone from saying, ‘Oh, we’re just, we’re just a bulletin board….’ to making a much more aggressive effort to weed out fake information,” Lewis said. “The Russians create hundreds of bogus individuals, using artificial intelligence to tweet out nonsense. But there’s a much stronger effort to expose that.”

Margaret Brennan and Olivia Gazis contributed to this report.