Loading threat actor…
Portal Kombat, also known as the Pravda Network, is a Russian influence operation that disseminates pro-Kremlin narratives through a large multilingual ecosystem of websites and content aggregators. The network is associated with sustained information operations aligned with Russian strategic interests, particularly around the war against Ukraine, and is used to shape public opinion, undermine support for Ukraine, and erode trust in Western institutions and democratic processes. The operation is characterized by the production and amplification of overlapping websites in multiple languages that present themselves as news or information outlets while republishing or laundering pro-Russian narratives. Moldova-focused components such as Pravda Moldova have been used to target Romanian-speaking audiences with anti-EU, anti-government, and pro-Russian messaging, especially around Moldovan politics and elections. The network has also been observed promoting narratives aimed at Poland and the Baltic states, including denial and reframing narratives following Russian drone incursions into Polish airspace. Portal Kombat functions primarily as an influence and propaganda ecosystem rather than a conventional intrusion-focused threat actor. Its tradecraft centers on narrative seeding, content aggregation, cross-network amplification, and broad distribution across the open web and social platforms. Research has linked the network to high-volume publication activity and to attempts to contaminate search and AI-driven information environments through mass publication and hyperlink propagation. It has also been amplified by, and has amplified, other Russian influence operations including CopyCop and InfoDefense. High-confidence reporting distinguishes Portal Kombat from Doppelgänger despite thematic overlap and shared pro-Russian objectives. Portal Kombat is best understood as a distinct Russian information operation focused on scalable propaganda distribution, audience manipulation, and influence over political discourse in countries relevant to Moscow’s geopolitical objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A distinct Russian influence campaign targeting Russian-speaking audiences, compared against a newly identified DoppelGänger-linked cluster but not technically linked to it.
Pro-Russia information operations amplifying disinformation narratives targeting Poland/NATO/West in response to geopolitical events.
Portal Kombat is known for producing multilingual domains to spread pro-Russian disinformation, particularly around the Ukraine War, and for reframing real-world events to support Russian strategic narratives.
Portal Kombat is known for producing multilingual domains to spread pro-Russian disinformation, particularly around the Ukraine War, and for reframing real-world events to support Russian strategic narratives.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.