Russia is very likely to push disinformation and pursue offensive cyber operations targeting businesses and institutions in Finland and Sweden in the near term.
This assessment was issued to clients of Dragonfly’s Security Intelligence & Analysis Service (SIAS) on 14 April 2022.
Russia’s invasion of Ukraine seems to have prompted a near total shift in their foreign policies; we now assess that both are likely to apply to join NATO in the coming months. Disinformation campaigns in particular would fit with what is a tried-and-tested but rarely successful approach by Russia to divide society and polarise debates over contentious issues that threaten its national security.
To reflect this, we have raised our cyber threat exposure levels for Finland and Sweden from high to severe. This does not mean that we anticipate the likelihood of a disruptive cyber incident on critical infrastructure in either country is elevated at present. But that in our assessment, the three indicators below are likely to increasingly play out in the coming months:
- Finland and Sweden have a high degree of diplomatic or military tensions with another country that has advanced offensive cyber capabilities (Russia).
- The Finnish and Swedish authorities have warned of the potential for offensive cyber and information operations in the coming months.
- There are early signs that Russia is engaged in active disinformation campaigns in Finland and Sweden.
Accelerated accession plans
Russia has repeatedly warned Finland and Sweden against joining NATO, threatening retaliation if they do. Russia already seems to be engaging in hostile activity against Finland. The Finnish government said that while the Ukrainian president was giving an online speech to its MPs on 8 April, DDoS attacks forced several government websites and services offline. The Finnish authorities have not attributed this to Russia or the groups it co-opts, but it did say that a Russian state aircraft was ‘suspected’ to have breached its airspace at the same time.
The Russian invasion of Ukraine has incentivised Finland and Sweden to pursue NATO membership. Finland tabled a white paper on its ‘security environment’ in parliament yesterday, 13 April. And more than half of MPs would support a proposal to join NATO, according to local press reports. The Finnish prime minister yesterday said that a decision would be made ‘in weeks’. And the former prime minister has said the government could apply to NATO in May, ahead of the bloc’s summit in Madrid on 29-30 June.
More surprising has been Sweden’s openness to NATO accession. According to sources in the governing party cited in the usually-reliable Svenska Dagbladet this week, the Swedish government plans to submit an application to join NATO in June, and accession appears to now have cross-party support. The Swedish prime minister had said on 8 March that a NATO bid ‘would further destabilise the security of this particular region of Europe’. While it is not clear what has prompted this apparent turn-around, the invasion of Ukraine has probably made Finland and Sweden now see being inside NATO as safer than outside of it.
Divisive campaigns
As part of attempts to influence and polarise debates on NATO accession, Russia is very likely to push disinformation campaigns and divisive messaging in Finland and Sweden in the coming months. The Swedish security police said last month that Russia’s goal is to keep it out of NATO, and that it tries to ‘influence decisions…and behaviours…in Sweden through misleading information’. Supo, the Finnish intelligence service, has assessed that Russian disinformation tactics could include the following:
- Claims of abuse or harassment of people with a ‘Russian background’ in Finland
- Blackmail of politicians
- Deep fake videos of ‘real people’
All of the above are tried-and-tested tactics by Russia, particularly in the Baltics. And there is clear precedent of Russia pursuing disinformation tactics in Finland and Sweden related to NATO. The Swedish Institute of International Affairs in 2017 said that the circulation of fake news, false documents and disinformation by Russia around that time was intended to influence public opinion and decision making in Sweden and to hinder the Swedish government’s ability to gain public support for its policies. The institute added that Russia’s goal was to ‘preserve the geo-strategic status quo’ by minimising NATO’s role in the Baltics and keeping Sweden out of the alliance.
Pro-Russia media outlets and social media bots are highly likely to be the main source of divisive messaging and disinformation in Finland and Sweden in the coming months. Based on Russia’s past disinformation campaigns, probable narratives include the killing or raping of civilians by NATO member-state troops, corruption within the alliance and that NATO expansion is a threat to Russia. For the Kremlin, it seemingly views disinformation campaigns as a way to exacerbate societal divisions and destabilise its adversaries. Such campaigns are likely to be evident ahead of a general election in Sweden in September.
Disinformation campaigns by Russia are unlikely to destabilise Finland or Sweden, such as by prompting unrest due to divisive messaging, let alone derail any NATO accession. Alleged Russian disinformation campaigns in the Baltics for example have failed at distorting public opinion on issues such as Russian language rights. And Russia seems to be losing the battle to reverse public support for NATO membership in Finland and Sweden; opinion polls cited in the press have suggested that 68% of Finns now support NATO membership, more than double the proportion prior to Russia’s invasion of Ukraine.
Cyber campaigns
Despite increasing Russian hostility towards Finland and Sweden, we doubt that Russian state-sponsored cyber groups are currently intent on disrupting critical systems in either country. Instead, they are likely to increase the scale of cyber activity in Finland and Sweden for intelligence collection, particularly around NATO accession, and launch technically unsophisticated attacks such as barrages of DDoS (as occurred on 8 April). The Finnish authorities have said Russia is ‘likely’ to expand its cyber and information ‘from Ukraine to the West’ and increase such operations against Finland in the coming months.
There is a reasonable chance that hacktivist and criminal cyber groups supporting Russia will increasingly seek to target businesses in Finland and Sweden in the coming months. Several prominent malware and ransomware groups have intensified their attacks, mainly on Ukrainian networks, since the invasion of the country on 24 February. And while we have not seen such groups explicitly threaten Finnish or Swedish firms, some have expressed outright hostility towards the West. The potentially-high financial rewards for targeting firms in Finland and Sweden probably make them attractive for cyber extortion groups.
Image: NATO Secretary General Jens Stoltenberg speaks during a joint press with Sweden and Finland’s Foreign ministers after their meeting at the Nato headquarters in Brussels on 24 January 2022; JOHN THYS/AFP via Getty Images
