Loading threat actor…
Operation No Bell is a Russian influence operation that used generative AI to support information manipulation focused on geopolitical narratives in sub-Saharan Africa. The operation used ChatGPT to generate and edit social media content and long-form articles, then sought to make the output appear more human-written to reduce suspicion of AI involvement. Reporting tied the campaign to article placement on African news sites under a fabricated expert persona, indicating a coordinated effort to seed narratives through ostensibly legitimate media channels rather than through overtly malicious technical intrusion. The operation’s known activity centered on narrative shaping and propaganda rather than malware deployment or financially motivated cybercrime. Themes included favorable coverage of African political figures and claims that Western leaders were conducting disinformation campaigns against African states. Tradecraft included content generation, editing, stylistic refinement, and spoofed identity presentation through a fake byline and false credentials. Based on the available facts, Operation No Bell is best characterized as a state-linked Russian influence actor engaged in influence operations and deception in support of geopolitical objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.