A sophisticated Russian influence operation has been targeting schools and educational institutions across Latin America, using fake emails, forged government documents, and even creating local organizations to carry out its attacks. The operation, dubbed “Dark Clark” by researchers at OpenAI, leveraged a combination of artificial intelligence (AI) planning and traditional techniques to convince school administrators to participate in a “National Day of Cultural and Linguistic Diversity” on May 21st.
The campaign, which appears to have been orchestrated by a group linked to the late Russian oligarch Yevgeniy Prigozhin, aimed to promote three Ukrainian politicians as part of its influence operation. The attackers used AI to create fake reports detailing their activities, even generating content for their campaigns. According to OpenAI’s analysis, “the use of AI can confer these facade operations greater scale, efficiency, linguistic fluency, and editorial capacity.” This allows the operators to exploit unsuspecting victims, such as employees or editors, and disseminate their content to unaware audiences.
The operation targeted schools in Peru and Ecuador, among other countries. In one case, attackers sent fake emails purporting to be from Peruvian educational authorities, convincing administrators to organize events that were later used by the operators to spread controversy. The campaign’s use of AI made it more efficient, with the attackers able to create complex content and manipulate language to fit their goals.
The Latin American region has become a hub for cyber espionage and influence operations, making it the most targeted in the world. Other major powers, including China, have also been involved in similar campaigns in the region. The Russian operation is part of an ongoing effort by Moscow to expand its cyber intelligence and disinformation capabilities, particularly to counter US efforts.
The fallout from this campaign was not immediate, but rather a subtle influence that played out over time. Two months after the event, the Peruvian Ministry of Education issued a formal letter acknowledging the fake directive and informing the public about the Ukrainian Embassy’s identification of the scam.
For schools and educational institutions in Latin America, this operation serves as a stark reminder of the dangers of disinformation and cyber influence operations. As the region continues to be targeted by major powers, it is crucial for institutions to be vigilant and proactive in detecting and preventing such attacks. By understanding the tactics used by these operators, schools can better protect themselves from falling prey to similar campaigns in the future.
Source: Dark Reading — 2026-11-05