- Filed
- September 9, 2026, 06:11 UTC
- Actor
- Pro-Russian information manipulation set (Roska Bridge; structural link to Portal Kombat / Pravda network assessed by CheckFirst; no formal state attribution claimed)
- Target
- Western audiences on Mastodon and Bluesky (Ukraine, France, Germany, US focus) and domestic Russian users via Max messenger promotion
- Confidence
- high Multiple independent open sources, low disagreement about the facts
- Techniques
- Narrative launderingAstroturfingFlooding the zoneCard stacking
- Channels
- Mastodon instances (incl. mastodon.social)
- Bluesky via Brid.gy cross-posting
- Portal Kombat intermediary portals
- AI-generated account features
- burst-and-replace account cadence
Summary
CheckFirst’s July 2026 investigation (updated in Decipon analysis circulating 8 September 2026) documents an ongoing pro-Russian information manipulation set, Roska Bridge, that has operated since at least September 2025. Hundreds of Mastodon accounts across ten or more instances, including mastodon.social, automatically bridge content to matching Bluesky accounts using the legitimate Brid.gy tool. Content originates from EU-sanctioned outlets (Pravda network, RT, Sputnik) after an intermediate pass through Portal Kombat regional portals, then appears as personal posts. Accounts activate in monthly batches for short intense bursts before replacement, outrunning moderation cycles on both sides of the protocol boundary.
Analysis
Primary documentation is CheckFirst’s Roska Bridge report of 2 July 2026, with subsequent Decipon breakdown of the same findings circulating on 8 September 2026. The operation exploits a structural moderation gap between two independently governed decentralized protocols rather than any single platform vulnerability. Brid.gy is an open-source, largely volunteer-run translator between ActivityPub (Mastodon) and AT Protocol (Bluesky). A Mastodon account that opts into the bridge has its posts mirrored in near-real time to a corresponding Bluesky account, and vice versa. CheckFirst observed hundreds of such bridged pairs, spread across at least ten Mastodon instances including the largest (mastodon.social, >870k users). New cohorts appear roughly monthly, post at high volume for short windows, then vanish and are replaced—timing that systematically outruns report-and-review moderation pipelines on either side.
Content is not raw RT or Sputnik copy. It first passes through Portal Kombat’s constellation of ostensibly independent regional news sites (193+ documented by VIGINUM in 2024, later 224+), stripping the sanctioned byline. The second laundering layer is the personal-account presentation on the federated networks. The result is narrative-laundering at two removes: state media → regional portal → personal bridged post. Coordinated posting schedules, identical content bursts, and shared infrastructure patterns constitute astroturfing of organic conversation. The volume and replacement cadence flood the zone of available content on both networks. Selective presentation of only the laundered frame constitutes card-stacking of the information environment.
This qualifies as an influence operation because origin is systematically concealed, authenticity is artificially constructed through personal-account texture, and the output advances known Kremlin strategic narratives against Ukraine and Western support. Identical technique families—intermediary laundering, protocol-seam exploitation, burst-and-replace CIB—appear in other state and commercial operations; the methods are scored independently of any particular national attribution. CheckFirst itself hedges the Portal Kombat link as structural rather than formally proven; the assessment here respects that caveat.
Literacy counter: treat high-volume, thematically consistent posts on Mastodon or Bluesky that closely track known sanctioned media talking points, especially when accounts show synchronized creation dates, short active windows, or bridge indicators (single follow of the brid.gy account, out-of-character bios), as provisional. Reverse-check content against primary sanctioned outlets and Portal Kombat sites. Prefer established local journalism and multi-source verification over any single federated voice. Demand that bridge maintainers and instance admins publish clearer cross-protocol coordination indicators rather than relying solely on post-hoc researcher discovery.