Brace yourself for the 48 hours before election day: Russia, China, and Iran ramping up attacks

Microsoft observes ‘sustained influence efforts’ from state-sponsored actors aimed at corrupting US democratic processes and warns that the last days before elections will be key. Fake videos already garner millions of views in fewer than 24 hours.

A deepfake of Vice President Kamala Harris, posted by an RT correspondent in mid-September, states that Trump refused to “even die with dignity” – it received tens of thousands of views on X.

Another video depicts a staged interview with a ranger impersonator, claiming that Harris killed an endangered rhinoceros in Zambia. The Russian state-controlled media channel RT attempted to amplify the narrative on social media.

On October 16th, yet another clip appeared accusing Governor Tim Walz of sexual assault while he was studying at Mankato West High School. This manipulated fake accumulated nearly 5 million views on X in fewer than 24 hours, and many copies were disseminated elsewhere.

Russian influence actors decisively target Harris's campaign. Those are a few examples of a disinformation campaign carried out by a Russian-aligned troll farm labeled Storm-1516.

Most of the fake videos receive minimal engagement, yet they underscore ongoing attempts to use traditional and AI-generated content to influence the US audience.

“History has shown foreign actors’ ability to rapidly distribute deceptive content can significantly impact public perception and electoral outcomes. With a particular focus on the 48 hours before and after Election Day, voters, government institutions, candidates, and parties must remain vigilant against deceptive and suspicious activity online,” Microsoft Threat Analysis Center (MTAC) warns in a new report.

Iranian and Chinese threat actors also spread fake narratives.

On October 14th, researchers observed a group calling themselves “Bushnell’s Men,” posing as Americans on social media, calling citizens to sit out the elections and spreading messages that the next US president won’t have their support for “aiding Israel in its brutal activities.” The fake cyber persona was Iranian-operated.

Another Iran threat actor, “Cotton Sandstorm,” conducted reconnaissance and ‘limited probing” of election-related websites in some swing states since April 2024. MTAC expects the group, known for election interference, to increase its activity as the election nears.

Multiple faker news outlets appeared to post divisive and conspirational content managed by another Iran-run group, Storm-2035.

Chinese influence operations seem to focus on candidates denouncing the People’s Republic of China. A threat actor dubbed Taizi Flood targeted republican Barry Moore, releasing content criticizing Moore’s support of Israel. It also launched campaigns criticizing Tennessee Senator Marsha Blackburn and Representative Michael McCaul.

“Several foreign malign influence scenarios may emerge in the final two weeks before the Election Day,” MTAC warns.

Influence actors from all three authoritarian regimes – Russia, Iran, and China – are expected to

Increase influence activity and sow doubts about the outcomes of the vote.

“Early detection and fact-checking will be essential for preventing Russia from undermining the fair conduct of the election,” MTAC concluded.