With Qatar Hack, the Kremlin May Be Opening a New Front in Its Global Information War

Before Qatar was gripped in a diplomatic crisis, a fake video was slipped onto a government media site, touching off immense political fallout. According to published reports, the U.S. intelligence community believed the Kremlin may be the culprit.

The story begins May 23, when Qatari government issued a statement that its state-run news agency, the QNA, had been hacked. Someone had posted a fake video to the QNA web site that purported to show the country’s leader, Sheikh Tamim bin Hamad Al Thani, saying Hamas and Hezbollah should be thought of as resistance movements, that Trump might not last long in power and that Qatar’s relationship with Iran was “strong.” The QNA Twitter feed was also hacked to reinforce the false story.

The fake news story fed an established narrative across the Middle East that Qatar funds extremist groups and is too cozy to Iran. Still, it’s impossible to say exactly how much the fake news report influenced the June 5 decision of Saudi Arabia, Egypt and other countries to cut off diplomatic ties to Qatar.

Qatar, of course, also hosts the forward headquarters for U.S. Central Command and some 10,000 American troops. (Pentagon officials have said they have no intention of moving the base.)

President Donald Trump soon waded into the fray, accusing Qatar via on Twitter of supporting violent extremists, a statement that did not find support among U.S. government officials, who moved quickly to try to defuse the situation.

Trump had a call with Amir Sheikh Tameem bin Hamad Al Thani of Qatar on Wednesday, during which he “emphasized the importance of all countries in the region working together to prevent the financing of terrorist organizations and stop the promotion of extremist ideology,” and offered to host a White House to cool tensions among the members of the Gulf Cooperation Council, which includes both Saudi Arabia and Qatar, according to a White House readout of the call.

Who wins when the country that hosts 10,000 U.S. troops suddenly finds itself cut off from Saudi Arabia, one of America’s biggest allies in the region?

Shortly after Trump’s tweet on Tuesday, Russian President Vladimir Putin made a well-timed phone call with Tamim bin Hamad Al Thani. Putin “reaffirmed Russia’s principled position in favour of settling crises by political and diplomatic means, through dialogue,” according to a Kremlin statement.

Also on Tuesday, CNN reported U.S. intelligence officials believed the Kremlin was behind the May 23 hack.

If that suspicion bears out, it would not be the first time Kremlin-backed actors had injected false information into a real media outlet. In 2015, APT28, also called FANCY BEAR, a group believed to be sponsored by Russia’s GRU military intelligence service attacked the website of the France’s TV5 Monde, under the guise of an ISIS-linked group called the CyberCaliphate. Cybersecurity group TrendMicro has traced that persona to FANCY BEAR.

“The hackers posted documents purporting to be ID cards of relatives of French soldiers involved in anti-IS operations,” BBC reported at the time. The CyberCaliphate committed a similar doxxing attack against Central Command’s Twitter feed.

If the intelligence professionals can connect the Qatar attack to Kremlin, it won’t be the first time the Russian military has attempted an information operation against U.S. forces in the Middle East and likely won’t be the last.