Google says Russia shifts influence focus beyond Ukraine

Google Threat Intelligence Group has published an assessment of the pro-Russia influence ecosystem, concluding that activity developed during the war in Ukraine is shifting back toward wider global objectives.

The assessment argues that Russia's information operations have moved from a near-singular focus on Ukraine to a broader set of targets, including the United States, Europe, NATO, the EU, countries around Russia, the Middle East, Africa and domestic audiences inside Russia.

According to the group, the ecosystem blends overt state media, covert operations, intelligence-linked activity, hacktivist personas and third-party proxies into a structure that is both interconnected and difficult to disrupt through limited action against individual actors or campaigns.

The report describes five broad strategic aims: weakening Western influence, reinforcing Russia's global position, maintaining Moscow's dominance in neighbouring states, shaping outcomes around military and political objectives, and preserving the stability of the political regime at home.

Wider targeting

Ukraine remains a priority, but the balance is changing, the researchers said. In their view, the Kremlin appears to be returning to influence goals that pre-date the full-scale invasion, with greater attention on political cohesion in Western countries and institutions Russia views as adversaries.

The United States and Europe remain central targets in that analysis. Russian influence efforts have long sought to undermine political stability in those countries and weaken unity between them, while NATO and the EU are treated as core adversaries.

The report also identifies Russia's so-called near abroad as a continuing focus. Activity aimed at former Soviet states reflects Moscow's longstanding view that it is entitled to a special role in the region, according to the assessment.

In the Middle East and Africa, influence activity often appears alongside broader Russian geopolitical efforts. At home, covert and overt campaigns continue to support Kremlin policies and suppress opposition voices.

Tactics evolving

A key finding is the growing use of generative AI tools in influence work. The researchers said pro-Russia actors are increasingly using them for planning, research and content creation, reflecting a broader trend toward more industrialised workflows.

The report also highlights what it calls narrative resonance, in which operators exploit existing ideological divisions and emotional tensions in target societies. That approach is often combined with media mimicry, including fake outlets that present themselves as independent news organisations or imitate established brands.

Another strand is direct dissemination through channels outside mainstream social platforms, including emails, text messages and messaging apps used to spread narratives directly to intended audiences.

Cyber activity also remains closely linked to influence operations in several cases. The report points to incidents in which destructive attacks, website defacements, false surrender messages and hack-and-leak tactics were used to shape public understanding of events or intimidate targets.

Hacktivist role

The researchers devote significant attention to pro-Russia hacktivist groups, arguing that they now serve a direct influence function rather than acting only as disruptive cyber actors. Their public claims, branding and messaging are often designed to draw attention, amplify narratives and create plausible deniability for state-backed activity.

One example is NoName057(16), a group that emerged after the invasion of Ukraine and has targeted Ukraine and countries seen as supporting Kyiv. The report says it has gone after political institutions, critical infrastructure and major public events while framing its activity around grievances linked to Western support for Ukraine.

The assessment also says some Russian espionage groups have incorporated influence methods into their operations by publicising stolen data or claimed intrusions to shape perceptions. In some cases, the public impact may matter as much as the underlying compromise.

Persistent system

Major pro-Russia campaigns persist even after exposure, takedowns or sanctions, according to Google Threat Intelligence Group. Operators often shift infrastructure, use mirror domains, revive personas or continue activity openly, sometimes mocking public attribution.

The report argues that established parts of the ecosystem help seed and promote new assets, making it easier to build audiences quickly. That process supports a self-sustaining cycle in which overt media, covert personas and hacktivist brands reinforce one another.

It also says outsourcing plays a notable role. Russian state bodies and aligned actors have used contractors and proxies for tooling, staffing and campaign execution, expanding reach while obscuring direct responsibility.

Another conclusion is that overt Russian media has connections with covert activity beyond simply echoing official talking points. The researchers say state-aligned outlets can help shape targeting, circulate narratives that covert operators later amplify and, in some cases, coordinate more directly with influence actors.

The group said the war in Ukraine has acted as a feedback loop for refining these methods, allowing Russia to test and adapt influence tactics at speed. It added that defenders should treat the ecosystem as a durable strategic instrument rather than a collection of isolated campaigns.

Google Threat Intelligence Group said: "As Russia seeks to emerge from international isolation and reorients its influence ecosystem back toward global objectives, it is critical for defenders to understand how this ecosystem provides the Kremlin with a durable influence capability in order to better anticipate future Russian influence threats."