Antigovernment protests have raged across France for four weeks now, effectively shutting down the nation’s capital at times as rioters sporting yellow vests ( gilets jaunes) wage massive public demonstrations, loot stores, and clash with police. The gilets jaunes protest began in response to a planned gas tax hike, but it soon devolved into a more amorphous outpouring of rage. On Saturday, four days after president Emmanuel Macron gave in to the group’s original demands and suspended the tax increase, more than 125,000 gilets jaunes took to the streets in one of the most destructive riots yet.

Online, a more insidious war rages. On Twitter, outsiders with little or no association with France or French politics—including far-right figureheads, conspiracy theorists, and pro-Kremlin influence networks—are capitalizing on interest in the gilets jaunes to spread disinformation, push state-sponsored propaganda, and advance their own political agendas. Research reviewed by WIRED indicates that these accounts are responsible for at least tens of thousands of posts on Twitter, many of which were then shared by thousands of others, often unaware they were spreading disinformation. The campaigns have echoes of the Russian-inspired disinformation effort in the US during the 2016 election.

In the weeks since the gilets jaunes movement took off, Ryan Fox, COO of New Knowledge, a cybersecurity company that tracks Russian-related influence operations on Twitter, has noticed a network of accounts that his organization believes is connected to Russia shift its focus to France. Since October 28, these 340 accounts have created and amplified content about the brutality of the French police, Macron’s inability to lead the nation, and anti-NATO or anti-migrant sentiments more than 20,000 times, according to New Knowledge. Among the claims: Macron’s treatment of the gilets jaunes is worse than Bashar al-Assad’s treatment of Syrian rebels.

Roughly two weeks after they had first mentioned #GiletsJaunes in late October, the network of accounts was responsible for at least 1,600 protest-related mentions per day on Twitter, with daily tallies growing even larger in late November and early December. The allegedly Russian accounts primarily retweeted misinformation about the protests, rather than create it themselves.

Fox says that although there is no way to know for sure who is behind a particular influence network on a social media platform like Twitter, the accounts in question have a history of operating in concert with one another to amplify narratives being pushed by the Kremlin or that are aligned with Russia’s geopolitical goals. According to New Knowledge, the two most popular links shared by the network of accounts were articles published by the the French arm of Russian government-owned news agency Sputnik News. The third-most-popular link promoted by the network came from RT-France, which is also funded by the Russian government.

“The goal is to destabilize—to undermine the ability of these Western countries to successfully govern,” Fox told WIRED, noting similarities between the campaign in France and the Russian influence operations on Facebook and Twitter during the 2016 US presidential election.

French security officials opened a probe into possible Russian interference on social media over the weekend, reports Bloomberg. In a radio interview with RTL, French foreign minister Jean-Yves Le Drian said an investigation was underway, but offered no specifics on the status or scope. Regardless, disinformation targeting the gilets jaunes continues to spread relatively unchecked for now, as tensions grow in France.

Twitter says it removes tweets linked to any coordinated attempt to deceive. It did not respond to more detailed questions.

“The goal is to destabilize—to undermine the ability of these Western countries to successfully govern." Ryan Fox, COO of New Knowledge

Alleged Russian actors are far from the only group meddling in the gilets jaunes social sphere. An analysis of more than 250,000 tweets about the protests conducted by French security researcher Baptiste Robert points to a robust network of foreign misinformation-mongers unrelated to traditional Russian sock-puppet networks. Though the accounts analyzed by Robert tweeted almost exclusively for English-speaking audiences, they used the French hashtag #GiletsJaunes, rather than its English equivalent #YellowVests. The majority of the popular accounts using #GiletsJaunes to spread false information during the period masqueraded as journalists or news organizations, while others belonged to popular figures in fringe groups unrelated to French politics. Nearly all of these accounts used #GiletsJaunes to highlight police brutality, paint France as ravaged by a violent civil war, and vilify Macron.