Unveiling Operation Texonto: A Case Study of Russian Information Operations in Ukraine and Beyond

ESET researchers have uncovered Operation Texonto, an information operation supporting the Russian war effort in Ukraine, active since at least September 2023. This operation aims to sow doubt among Ukrainians by disseminating disinformation on critical issues such as heating interruptions and food shortages. Notably, some disinformation campaigns were synchronized with Russian military operations, such as the intense airstrikes on Kharkiv in April 2024. Operation Texonto also extended its reach to target the Russian opposition, during the presidential elections in March 2024 . In particular, they tried to disorganize protests launched by supporters of Alexei Navalny.

Overall, these activities suggest that Operation Texonto is orchestrated by a Russia-aligned threat actor, closely coordinating with the Russian military. In this presentation, we will present the TTPs used in Operation Texonto, such as disinformation and related credential-phishing emails, correlate the content of the emails with actual events and discuss about possible attribution.