UK establishes National Centre for Information Defence to counter Russian state disinformation operations

UK establishes National Centre for Information Defence to (TL-2026-2638), also tracked as Doppelganger, is a high-severity tracked intrusion set, first published 2026-09-24. It is attributed to Russian state foreign information manipulation (Russia) with high confidence, affects BBC Public-facing news brand and editorial identity, maps to 10 MITRE ATT&CK / ATLAS techniques (AML.T0020, T1036.005, T1583.001), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-2638

Threat ID
TL-2026-2638
Also known as
Doppelganger, RRN, Recent Reliable News, Storm-1516, Storm-1679, Matryoshka
Severity
HIGH
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-09-24
Last reviewed
2026-09-24
Attribution
Russian state foreign information manipulation
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
DESTRUCTION
Target sectors
government administration, news - media, education, defense, civil society, elections
Target regions
united kingdom, Europe, North America, australia, Global
Detection rules
9
Indicators of compromise
26

Malware and tooling in UK establishes National Centre for Information Defence to

Malware and tooling: Matryoshka - S0167, Sanctions, AI voice-cloning and deepfake generation tooling

The UK has announced a National Centre for Information Defence to detect, attribute and disrupt hostile state information attacks, unveiled by PM Andy Burnham at the UN General Assembly on 22 September 2026. Burnham cited an 'industrial-scale assault' on the information environment, Russian state use of bots, fake websites, falsified newspaper articles and forged branding of 28 British organisations including universities and the BBC, attempted interference in the 2019 General Election, and around GBP 1.3 billion in annual Kremlin spending on information manipulation. The centre will initially be led from the Office for the Prime Minister and Cabinet, working with intelligence agencies, government departments, law enforcement and social media companies.

How UK establishes National Centre for Information Defence to works

ANNOUNCEMENT. On 22 September 2026, in his first address to the UN General Assembly, UK Prime Minister Andy Burnham announced the creation of a National Centre for Information Defence, directing security chiefs to stand up a body able to 'detect, attribute and disrupt' hostile state information attacks. Initial work is being led from the Office for the Prime Minister and Cabinet (Cabinet Office), with intelligence agencies, other government departments, law enforcement and social media companies involved in shaping how it will operate. It is expected to consolidate counter-disinformation work currently spread across several departments, but the government gave few details of its final structure, statutory basis, budget, staffing or powers; a PM spokesperson said further information would follow 'in due course'.

THE ADVERSARY PICTURE AS STATED. Burnham described 'an industrial-scale assault by hostile actors on the information environment in the UK and that of many of our allies', and said Russian agencies 'have used every means at their disposal to spread lies and disinformation and prey on people's fears'. The methods he listed were bots and fake websites, falsified newspaper articles, and forged branding of 28 British organisations including universities and the BBC, alongside amplification of far-right narratives, evidence of attempted interference in the 2019 General Election, and cyber attacks on UK companies and institutions. He put Kremlin spending on information manipulation at around GBP 1.3 billion a year and warned that 'AI will multiply the threat', framing the campaign as one that creates 'a narrative of decline, stoking division and sowing despair'.

DOCUMENTED TRADECRAFT BEHIND THE DESCRIPTION. The tradecraft described maps onto campaigns that have already been publicly attributed. Doppelganger (also tracked as RRN / Recent Reliable News) relies on typosquatted domains and cloned news sites: France's VIGINUM observed 355 domain names impersonating media outlets in France and nine other states between June 2022 and May 2023, including UK-facing typosquats such as theguardian.co.com and dailymail.cfd/.top/.cam, plus the operation's own outlets rrn.world, rrussiannews.com, newsroad.online and truemaps.info. Attribution has been consistent across governments: Meta (December 2022), VIGINUM (June 2023), the EU Council (28 July 2023) and the US Treasury (20 March 2024) all named the Social Design Agency (SDA) and Structura National Technologies, with Treasury concluding they acted on behalf of the Russian Presidential Administration. The UK sanctioned SDA, Structura, ANO Dialog and three senior figures - Ilya Gambashidze, Nikolai Tupikin and Andrey Perla - on 28 October 2024, noting a web of at least 120 sites spoofing existing news and government websites that deceptively redirected social media users.

BRAND FORGERY AT SCALE. The Matryoshka operation, active since at least September 2023, impersonates AFP, BBC, USA Today and Fox News, and has targeted more than 500 X accounts across 90-plus operations in over 60 countries; its output includes AI-generated video reports presented in the visual identity and fonts of real outlets, and an AI deepfake of IOC President Kirsty Coventry built on real Euronews press-conference footage. EDMO documented fabricated pieces imitating Euronews, BBC, France 24, Politico and the Institute for the Study of War, describing the tactic as 'authority borrowing' - copying trusted brands' logos, visual styles and journalistic formats. Earlier, the fake entity Storm-1679 produced the documentary 'Olympics Has Fallen' with an AI-generated imitation of Tom Cruise's voice and fabricated reviews attributed to The New York Times and the BBC.

ELECTION INTERFERENCE. The 2019 interference Burnham referenced concerns the October 2019 leak of a 451-page trove of classified UK-US trade documents, posted to Reddit ahead of the December 2019 General Election. Graphika assessed that the early distribution - via Reddit, German-language websites and an anonymous Twitter account - matched the Russian 'Secondary Infektion' operation, with 'absolutely identical' tradecraft, though the leaked documents themselves appeared authentic rather than forged. In July 2020 Foreign Secretary Dominic Raab told Parliament it was 'almost certain that Russian actors sought to interfere in the 2019 general election through the online amplification of illicitly acquired and leaked government documents', and Reddit suspended 61 accounts showing a pattern of coordination.

AI DIMENSION. The sourcing describes an escalation from human-operated trolling to AI-enabled content production and to poisoning the AI systems that now mediate public information. The Pravda network - a pro-Kremlin 'information laundromat' launched in 2014 and targeting more than 80 countries and regions - publishes fraudulent news portals whose material is cited on Wikipedia and absorbed into LLM training data, so that assistants reproduce its framing for Western users; a NewsGuard audit of ten leading AI tools found they repeated Pravda's false narratives 33 percent of the time. Burnham tied the threat to AI directly, announcing an AI defence partnership with the US to protect critical national infrastructure and placing AI at the heart of the UK's G20 Presidency next year, aiming at 'a single set of global principles and standards' on transparency and access, with legislation held in reserve.

DOMESTIC CONTEXT AND CRITICISM. The centre follows disorder in Belfast and Southampton in June 2026, where an analysis of X location data found more than half the accounts posting about the Belfast rioting were based outside the UK, and EDMO documented manipulated footage - a Dagestan pipeline fire with a 'send them home' chant added to suggest a link to Belfast unrest. Chi Onwurah MP, chair of the Science and Technology Committee, welcomed the announcement but warned it leaves domestic misinformation unaddressed and urged action on the algorithmic amplification of legal but harmful content; the committee's July 2025 report had already backed a single anti-disinformation body and warned that Ofcom was ill-equipped. Experts from RUSI and King's College London questioned whether the centre becomes an agency accountable to Parliament or merely rebadges existing effort, and what 'disruption' means in practice given the evidentiary threshold of the National Security Act 2023 foreign interference offence. France's Viginum, created in 2021, is the closest model but has no explicit disruption mandate, concentrating on detection, attribution and public debunking/prebunking.

ASSESSMENT. No CVE, exploit code, malware family or command-and-control infrastructure is associated with this threat: it is a state information operation, not a software vulnerability. A BeaconBeagle query for the attributed FIMI domain rrn.world returned no beacon or C2 configuration records, consistent with influence activity rather than malware command-and-control. The intelligence value lies in the tradecraft - domain impersonation, brand forgery, coordinated inauthentic amplification, AI-generated synthetic media and training-data poisoning of AI assistants - and in the attribution chain linking these campaigns to Russian state-tasked entities now under UK, EU and US sanctions.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2638

persistence

AML.T0020 Training Data Poisoning

Stealth

T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1585.001 Social Media Accounts; T1585.002 Email Accounts; T1608.005 Link Target

Reconnaissance

T1593.001 Social Media; T1594 Search Victim-Owned Websites

Affected products and versions in UK establishes National Centre for Information Defence to

  • BBC — Public-facing news brand and editorial identity
    Vulnerable versions: Branding, logos and journalistic formats forged in fabricated articles and AI-generated video reports
  • UK universities — Institutional branding and academic reputation
    Vulnerable versions: Included among the 28 British organisations whose branding was forged, per the PM's UNGA statement
  • United Kingdom — Democratic processes (2019 General Election)
    Vulnerable versions: Attempted interference through online amplification of illicitly acquired and leaked government documents
  • Media and fact-checking organisations — Editorial identity (AFP, BBC, Euronews, France 24, Politico, USA Today, Fox News, Institute for the Study of War)
    Vulnerable versions: Authority borrowing via forged branding, fabricated reports and deepfaked presenters

Remediation for UK establishes National Centre for Information Defence to

Patches

  • No software patch applies: this is a state information operation, not a software vulnerability (no CVE and no affected product version)

Immediate actions

  • Block or sinkhole the attributed Doppelganger/RRN typosquatted domains (theguardian.co.com, dailymail.cfd, dailymail.top, dailymail.cam, rrn.world, rrussiannews.com, newsroad.online, truemaps.info) at DNS resolvers and web proxies
  • Add attributed FIMI domains to threat-intel blocklists and monitor certificate transparency and new registrations matching trusted UK media, university and government brands
  • Report inauthentic accounts and coordinated reply campaigns to platform integrity teams and preserve evidence to support attribution
  • Brief newsrooms, universities, election officials and communications teams on authority-borrowing tradecraft (forged branding, cloned sites, deepfaked presenters) so impersonations are challenged quickly

Workarounds

  • Treat brand-authenticated content as untrusted until verified against the organisation's own official channels
  • Restrict algorithmic amplification of unverified breaking-news content during periods of civil disorder

Longer-term hardening

  • Build community and media literacy resilience programmes, prioritising the groups identified as most exposed to influence operations
  • Adopt prebunking and rapid public attribution as standing counter-FIMI practice, modelled on Viginum's detection and attribution approach
  • Coordinate attribution, sanctions and platform engagement with allies (EU, US), consistent with the announced UK-US AI defence partnership
  • Track and mitigate training-data poisoning of AI assistants by SEO-optimised fake outlets, including requiring transparency on model data provenance

Timeline of UK establishes National Centre for Information Defence to

  • A 451-page trove of classified UK-US trade documents is posted online via Reddit ahead of the December 2019 General Election; Graphika later assesses the distribution pattern as matching the Russian 'Secondary Infektion' operation.
  • Foreign Secretary Dominic Raab tells Parliament it is 'almost certain that Russian actors sought to interfere in the 2019 general election through the online amplification of illicitly acquired and leaked government documents'; Reddit had suspended 61 accounts for coordinated behaviour.
  • Meta publishes the first attribution of the Doppelganger operation, naming Structura National Technologies and the Social Design Agency and releasing associated domains.
  • France's VIGINUM publishes its RRN (Recent Reliable News) report, recording 355 domain names impersonating media outlets in France and nine other states between June 2022 and May 2023, including UK-facing typosquats such as theguardian.co.com and dailymail.cfd.
  • The EU Council sanctions the Social Design Agency and Structura for operating fake websites impersonating government organisations and legitimate media.
  • The Matryoshka operation is active from at least September 2023, impersonating AFP, BBC, USA Today and Fox News and eventually targeting more than 500 X accounts across 90-plus operations in over 60 countries.
  • The US Treasury sanctions the Social Design Agency and Structura, concluding they acted on behalf of the Russian Presidential Administration and ran over 60 websites impersonating legitimate news organisations.
  • The EEAS reports Doppelganger activity targeting the 2024 European Parliament elections, documenting a network of inauthentic websites impersonating European media including Die Welt, Le Parisien and Le Point.
  • False online information following the Southport stabbings helps spark riots across the UK - an episode Burnham later cites as evidence of the real-world cost of the hostile information environment.
  • The UK sanctions the Social Design Agency, Structura National Technologies, ANO Dialog and three senior figures (Ilya Gambashidze, Nikolai Tupikin, Andrey Perla), noting SDA crafted a web of at least 120 sites spoofing news and government websites.
  • DFRLab and ABC News report the pro-Kremlin Pravda network poisoning AI chatbots; a NewsGuard audit finds ten leading AI tools repeated Pravda's false narratives 33 percent of the time.
  • The UK designates the Moscow-based Centre for Geopolitical Expertise and its founder Aleksandr Dugin, linking them to Russian intelligence services and to coordinated support for the Storm-1516 FIMI network.
  • Belfast rioting and Southampton civil disorder draw foreign amplification: analysis of X location data finds more than half the accounts posting about Belfast were based outside the UK, and EDMO documents manipulated Dagestan pipeline footage with a 'send them home' chant added.
  • EDMO documents pro-Kremlin networks forging the branding of Euronews, BBC, France 24, Politico and the Institute for the Study of War - 'authority borrowing' through copied logos, visual styles and journalistic formats.
  • PM Andy Burnham announces the National Centre for Information Defence at the UN General Assembly, citing the forged branding of 28 British organisations including universities and the BBC, attempted 2019 election interference, and around GBP 1.3 billion in annual Kremlin spending on information manipulation.

Sources cited for UK establishes National Centre for Information Defence to

More in threat intel

Detection coverage for TL-2026-2638

As of 2026-09-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2638 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats