Malicious actors have increasingly used crypto-linked disinformation campaigns to disrupt elections, including the 2020 election. With the 2024 global elections impacting half the worlds population, identifying and addressing these campaigns is important to protect democratic processes from interference.

Upon analyzing disinformation actors, their tactics, and on-chain activity, Chainalysis found that one such media outlet is Russia-based SouthFront, which was sanctioned by OFAC in April 2021 for its involvement in foreign interference in the US 2020 presidential election under Russian government guidance.

SouthFront’s Disinformation Campaign Funded by $27K in Crypto

The Federal Security Service (FSB), a division of Russian intelligence, oversees SouthFront, which targets military enthusiasts, veterans, and conspiracy theorists while meticulously concealing its Russian ties.

SouthFront seeks crypto donations to support its operations. Its official website has outlined guidelines for supporters to send crypto to the organization securely, advising donors to transfer funds directly from personal or unhosted wallets rather than through intermediary services. This is done to evade detection by crypto exchanges that enforce KYC practices.

From July 2018 to now, SouthFront has received over $27,000 in crypto, mainly in Bitcoin. The organization continues to operate, accepting donations and cashing out through both sanctioned exchanges like Garantex and mainstream ones. Its donation page currently reports $1,260 collected since June 1, covering about 25% of its monthly budget.

In a statement to CryptoPotato, Chainalysis said,

Executing effective malign interference campaigns requires significant infrastructure. Because crypto is mistakenly perceived as anonymous and untraceable, some malign actors pay for these technology services using cryptocurrency, hoping to hide their activity.

Irans Growing Cyber Influence Operations

Chainalysis said that these malign influence operations aren’t limited to Russia. In recent years, Iran has significantly expanded its cyber-influence activities to further its geopolitical objectives.

Islamic World News (ISWN), a partner of SouthFront, is a media outlet reportedly linked to the Islamic Revolutionary Guard Corps (IRGC). It operates militaristic social media channels, including Telegram, to promote pro-Iranian government and military propaganda.

Both open-source research and on-chain activity suggest a connection between ISWN and SouthFront. The entity seeks donations in BTC, BCH, ETH, XRP, DOGE, SOL, TRX, and SHIB. Chainalysis discovered that transfers from SouthFront and ISWN to exchanges may suggest efforts to convert cryptocurrency into fiat currency.