Fake Harris campaign websites with Russian connections
Origins and first wave of distribution
This campaigns bears some similarities with a prior campaign that was targeting French political coalition “Ensemble” prior to 2024 legislative elections in France.
Campaign revolves around two recently created websites, which appear to be visually identical:
newwayforward.us [whois] - appears to be a primary website used for distribution.
newwayforward.vote [whois] - link is present only in X/Twitter account description, possibly by mistake. Website is hosted on NameCheap, similarly to ensemble-24 campaign.
Both domains were registered shortly prior to campaign. Registration email for newwayforward.us domain follows the same pattern as the one used in ensemble-24 campaign, which is most likely just a throwaway Proton email.
An X/Twitter account NewwayforwardUS was created as part of campaign. Link to the .us site was posted on September 24 and it was later used for distribution. Supposedly, this account also ran X/Twitter, which is hard to verify due to the lack of AD transparency mechanisms on the platform.
The earliest quote tweet was done by Chay Bowes, who should be well known to our readers by now as one of the most active participant on X/Twitter in distribution of Russian disinformation campaigns.
There are also Facebook ads which run on all Meta platforms and are currently active: 1 2 3
Notably, on Telegram, it was posted on TheDissidentNews, which has previously promoted multiple Storm-1516 campaigns, most of which involved fake media websites operated by John Dougan: 1 2 3 4
It appears that this campaign didn’t get a lot of traction and distribution efforts weren’t significant.
Second wave of distribution (update 1)
Even though in original publication we were reluctant to put attribution, now we are can attribute this campaign to Storm-1516 with medium confidence.
Second wave of distribution was preempted by publication in John Dougan Telegram channel on September 29, which might be an indication of his level of involvement in these campaigns being higher than we have previously assumed:
On October 1, nearly identical publications were made in channels, which are often involved in distribution of campaigns of this group:
https://t.me/golosmordora/41291