Lying Pigeon — APT Profile
Lying Pigeon is a Russian-speaking influence-operation actor first documented by Check Point Research, which detailed the group's email-based "Operation MiddleFloor" disinformation campaign against Moldova in the runup to the country's October 2024 presidential election and EU-membership referendum. The group spoofs EU institutions, Moldovan government ministries, and political figures to distribute forged documents and anti-EU narratives, and unusually relies on email rather than the fake news sites and social-media amplification typical of pro-Russian influence networks. Check Point linked earlier, previously unattributed 2023 activity to the group, including disinformation around the NATO Vilnius summit and a campaign around Spain's July 2023 general election that used a counterfeit regional-government website carrying a fake terrorist-threat warning urging Russian-speaking residents to abstain from voting. Poland's CERT Polska separately tracks a cluster with substantial overlaps to Lying Pigeon that impersonated the .pl registry operator NASK to distribute the Lumma infostealer, indicating activity extending beyond pure disinformation into credential theft.
Vendor research
Countries linked to this actor
Read the full analysis on IntelFusions