# Secondary Infektion Secondary Infektion is a Russia-based influence operation that ran from about 2014 to 2020. It planted forged documents and invented stories on more than 300 websites, using throwaway accounts. The Atlantic Council's [[Digital Forensic Research Lab]] named it in June 2019, after the Soviet [[Operation INFEKTION]], the KGB campaign that claimed the U.S. created AIDS. It is the operation that produced the one Russian forgery to reach the center of a British general election. ## How it worked - **Forgeries.** Fake letters, fake tweets and doctored screenshots attributed to Western officials. Examples include a fake Marco Rubio tweet that RT Deutsch reported as real, and a forged letter from EU foreign-policy chief Josep Borrell about a supposed plot against [[Boris Johnson]]. - **Burner accounts.** Each story was posted by an account created for that one post, often abandoned within the hour, on platforms such as [[Reddit]], Medium, Quora and LiveJournal. Then other burners would cite it. Single-use accounts left little for platforms to detect, but they also meant the stories had no audience of their own. - **Scale.** [[Graphika]]'s June 16, 2020 report, led by Ben Nimmo, counted at least 2,500 pieces of content in seven languages on more than 300 platforms, 2014–2020. DFRLab's 2019 report had counted "30+" platforms; the later and fuller figure is used here. ## The UK–US trade documents On October 21, 2019, documents from UK–US trade talks appeared online. The Labour Party and Jeremy Corbyn used them during the December 2019 general election to argue that the NHS was on the table. On December 6–7, 2019, Reddit said the leak was "part of a campaign that has been reported as originating from Russia" and banned 61 accounts and one subreddit. Graphika said the leak "closely resembles" Secondary Infektion. On July 16, 2020 Foreign Secretary Dominic Raab said it was "almost certain that Russian actors" had sought to interfere in the election through the leak. The report site Graphika maintains on the operation describes the trade-documents leak as its only real breakthrough: the one time a story it planted crossed into mainstream politics. ## Attribution and impact Facebook removed a network of accounts based in Russia on May 6, 2019, and DFRLab's analysis of that network named the operation. DFRLab's title called it a "suspected Russian intelligence operation." Graphika could not name the agency, describing it as running in parallel with, but systematically different from, the [[Internet Research Agency]] and the [[GRU]]. Almost none of its posts drew measurable engagement. Recorded Future found it still active but declining in 2021. No confirmed reporting on it has been found since 2022. ## Why it matters for the KB Secondary Infektion shows both the weakness and the danger of high-volume, low-engagement operations. Thousands of forgeries went nowhere. The one item that mattered did so because a major domestic political party picked it up — the same pattern the vault documents with [[Operation Overload]]'s USAID clip in 2025. ## See Also - [[Operation INFEKTION]] - [[Active Measures]] - [[Kremlin Disinformation]] - [[Operation Overload]] - [[Russian Influence]]