Loading threat actor…
Operation Undercut is a Russia-linked influence operation attributed to the Russian company Social Design Agency and assessed to have been active since at least late 2023. The operation is part of a broader ecosystem of Kremlin-aligned information operations targeting European audiences, including campaigns focused on Moldova and Germany. Its activity has supported anti-European integration, anti-government, and pro-Kremlin narratives, including messaging designed to undermine trust in democratic institutions, election integrity, and Western alignment. In Moldova, Operation Undercut targeted social media users with Romanian-language content aimed at discrediting President Maia Sandu and the Party of Action and Solidarity (PAS), weakening support for Moldova’s European Union accession path, and conditioning audiences to expect electoral fraud. Its narratives also emphasized fears of war with Russia, inflation, agricultural decline, and social costs. The operation expanded onto TikTok, where it used impersonated local personas and synthetic or heavily edited video content, including material created with consumer editing tools and likely AI-generated avatars. In Germany, Operation Undercut was observed distributing German-language content supportive of Alternative für Deutschland (AfD) and critical of Chancellor Olaf Scholz. The operation has been described as one of several long-running, at least partially Kremlin-funded influence networks seeking to inflame domestic political divisions, pollute the information environment with manipulated content, foster criticism of the United States and the European Union, and undermine NATO cohesion. It has also posed as legitimate news organizations to increase credibility. Operation Undercut is associated with influence and deception tradecraft rather than traditional network intrusion. Its known behavior includes social media persona fabrication, media impersonation, narrative laundering, and the use of AI-enabled or synthetic content to scale propaganda and increase plausibility. The operation aligns with Russian state strategic objectives in Europe, particularly weakening pro-Western political forces and eroding public trust in elections and institutions.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russia-linked influence operation targeting European audiences; grouped with other campaigns that impersonate media outlets to push Kremlin-aligned narratives.
Russian influence operation likely conducted by the Social Design Agency to target Moldovan audiences with anti-PAS, anti-Sandu, anti-EU messaging, especially on TikTok and other social platforms, while conditioning audiences to expect election fraud and fear war and economic collapse.
Russia-linked influence operation posting German-language content to support AfD and undermine Chancellor Olaf Scholz; also described as posing as real news organizations to increase credibility.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.