US Treasury Sanctions Russian Actors In Connection with Disinformation Campaign

On March 20, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two individuals and two entities for services they provided to the Russian government in connection with a disinformation campaign, including attempting to impersonate legitimate media outlets.

According to Treasury, the Russian government “employs an array of tools, including malign influence campaigns and illicit cyber activities, to undermine the interests of the United States and its allies and partners, including in Latin America, the Middle East, and Europe. Russia routinely uses its intelligence services, proxies, and influence tools in these efforts. Russia’s influence actors have increasingly adapted their methods to hide their involvement by developing a vast ecosystem of Russian proxy websites, personas, and organizations which give the false appearance of being independent news sources.”

OFAC designated Russian national Ilya Andreevich Gambashidze for his role in foreign malign influence campaigns that were conducted at the direction of the Kremlin. Treasury asserts that Gambashidze and his company, the Social Design Agency (SDA), along with Nikolai Aleksandrovich Tupikin (Tupikin), the CEO and current owner of Russia-based Company Group Structura LLC (Structura), were involved in implementing a campaign that impersonated news websites in Europe, as well as creating fake videos and social media accounts in order to spread pro-Russian messaging.The campaign, which was reportedly conducted in October 2022, involved over 60 websites which impersonated legitimate media.

‍Gambashidze and the Social Design Agency Previously Sanctioned By EU Authorities

Yesterday’s OFAC designation of Gambashidze is not the first time he has been sanctioned for supporting Russian malign disinformation activity. In July 2023 Gambashidzhe and the SDA were sanctioned by the European Union for supporting disinformation campaigns targeting Ukraine and several European countries.

‍

The SDA and Structura, according to media reports, were involved in a disinformation scheme known as “Doppelganger Operation” due to the entities’ imitation of legitimate news organizations. The U.S. State Department also cited their role in disinformation campaigns focused on Latin America in November 2023.

‍Cryptocurrency Addresses Tied to Gambashidze

In its sanctions designation, OFAC included a number of cryptocurrency addresses belonging to Gambashidze including two TRON (TRX) addresses: TMGLqRQ4twjW8wJhVH1mQR7nUThpGHUsN3 and TEFph7dZoUN5233cGEzF6XFwRpjPF8fQDS.

The first address (TMGLq) was active between April 2022 and March 2024. The vast majority of the funds received by the address came from the sanctioned Russian exchange Garantex.

TRM Labs traced several payments through the cross-chain swap service including one made to a Bitcoin wallet that paid a U.S.-based payment processor, a potential method of paying for internet infrastructure.

The second address (TEFph) address was only active between February and March 2024 . It appears the vast majority of funds were sent from a hot wallet likely associated with an exchange that has also made significant transfers to other Russian cryptocurrency traders, exchanges, and services.

‍TRM continues to follow the use of cryptocurrencies in financing disinformation campaigns ‍

The Russian government, according to the US State Department, Treasury, and European partners, is in the midst of financing a massive disinformation campaign in order to undermine support for Ukraine. According to the State Department a large part of that effort is aimed at Latin America where Russia seeks “to launder its propaganda and disinformation through local media in a way that feels organic to Latin American audiences to undermine support for Ukraine and propagate anti-U.S. and anti-NATO sentiment.”

With elections in the US and across the globe on the horizon we are likely to see these efforts continue. TRM has added the newly sanctioned addresses and continues to closely follow Russia’s use of cryptocurrencies to facilitate disinformation campaigns.