Portal Kombat
Portal Kombat, also referred to as the Pravda Network, is a Russia-linked information operation and influence network. Multiple reports cited in the content tie it to the production of overlapping domains in multiple languages that advance pro-Russian narratives, particularly around the war in Ukraine. Google researchers tracked Portal Kombat alongside Doppelganger and Niezależny Dziennik Polityczny in coordinated disinformation activity following Russian drone incursions into Polish airspace in September 2025; in that case, Portal Kombat promoted claims that Russian drones lacked the range to reach Poland and that Poland and the Baltic states were exploiting the incident to derail peace negotiations. The network is described as an ecosystem that includes Moldova-focused outlets such as Pravda Moldova / Pravda MD and domains including md.news-pravda.com, moldova.news-pravda.com, and pravda-md.com. Insikt Group assessed that Pravda MD functioned as an automated aggregator whose likely sole purpose was to amplify and launder pro-Kremlin narratives to Romanian-speaking audiences in Moldova by republishing content from RT, Sputnik, Pravda.ru, TASS, RIA Novosti, Russian ministries, and pro-Russian Telegram sources. The content states that Pravda Moldova is part of the Portal Kombat ecosystem and was identified as engaging in poisoning artificial intelligence chatbot outputs; related research found Pravda-network links increased sharply on Wikipedia after February 24, 2022, and that the network had published more than 3.7 million articles on the open web. The content warns this activity could contaminate large-language-model outputs via so-called LLM grooming. Portal Kombat content is also described as being amplified within broader Russian influence ecosystems and as amplifying other pro-Russian campaigns, including CopyCop content. Based on the provided content, Portal Kombat is best characterized as a pro-Russian, multilingual disinformation and narrative-laundering network focused on shaping information environments in Europe, including Moldova and Poland, especially on issues involving Ukraine, NATO, and EU-aligned governments.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Independent Media
Where they target
Geographies tied to known operations.
- 🇲🇩 Moldova
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pro-Russia information operations amplifying disinformation narratives targeting Poland/NATO/West in response to geopolitical events.
Portal Kombat is known for producing multilingual domains to spread pro-Russian disinformation, particularly around the Ukraine War, and for reframing real-world events to support Russian strategic narratives.
Portal Kombat is known for producing multilingual domains to spread pro-Russian disinformation, particularly around the Ukraine War, and for reframing real-world events to support Russian strategic narratives.
Russian influence network that amplifies CopyCop narratives and related pro-Russian influence content.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.