Spam, ads, fake news. Russian propaganda targeting Ukrainians on social media
The Center for Strategic Communication and Information Security explains how Russians attack Ukrainians on the most popular social networks and messengers.
Bots and trolls — a universal weapon for social networks
Creating profiles of fictional users on social networks is not a Russian invention. However, the Russians invest many resources in scaling up these tactics and using them for hybrid aggression against foreign states, in particular, Ukraine.
To create the illusion of authenticity of fake accounts, they are given “human” names, have photos, friends, several posts that are copied from other users, reposts or links to other resources.
Trolls are usually called real people hiding behind fake profiles, and bots are profiles created using automation or artificial intelligence programmes. Bots unite into bot farms, which can coordinate likes, leave similar comments, make reposts, or complain about a post to block the page. The main function of trolls is to provoke conflicts on social networks and polarize their participants to turn opponents into enemies who hate each other.
Bots and trolls operate on all popular social networks in Ukraine (YouTube, Facebook, Instagram, X (Twitter), TikTok) and messengers, in particular, on Viber and Telegram. They promote narratives and fakes to Russia’s advantage and are actively working to drive a wedge between Ukrainians and convince them that “the enemy is in Kyiv, not in the Kremlin.”
In addition to bots and trolls, Russian special services use other tools that have their own features on different platforms.
The Meta policy allows any user, even a newly registered one, to place an advertising message and target it to a specific audience quite simply, quickly, and inexpensively. The Russians turned this purely commercial tool into a weapon. Almost every day they register new profiles on Facebook and through ads attack Ukrainians with fakes, disinformation, and manipulations.
Profiles with strange names (like Webbed Hairy or Handsome lsy2) publish text messages, caricatures of Ukrainian military and politicians, videos edited using artificial intelligence, links to clones of Ukrainian media with fake articles, etc.
Among the key narratives that these pages spread are the following: “Ukrainians do not want to fight,” “mobilization is illegal,” “the authorities steal,” “the West has betrayed Ukraine,” “Zelenskyy is a puppet of the United States,” “Western weapons are worse than Russian,” “the military are preparing a coup,” “Ukrainian commanders treat soldiers like cannon fodder.” The purpose of persistently promoting this content is to demoralize, provoke splits and conflicts within Ukrainian society, and reduce its ability to resist Russian aggression.
In addition to propaganda, the same profiles post fraudulent messages about non-existent “additional payments” to pensioners, families of servicemen, and internally displaced persons. In no case can you click on such links because frauds will try to seize your personal data and gain access to your bank account.
The Centre for Strategic Communication and Information Security, together with partners, identifies such pages, informs Meta, and the latter promptly removes them. However, new ones appear to replace them.
TikTok
The Chinese platform for posting short videos turned out to be very convenient for Kremlin propaganda. TikTok houses are being created in Russia and in the occupied territories under the patronage of government agencies such as the Internet Development Institute. Their residents shoot videos about the “fantastic restoration of Mariupol,” “wonderful life” in the occupied cities, etc.
The Russians post a huge number of videos on TikTok glorifying the armed forces of Russia, Putin, his accomplices, and the expansionist war, as well as promote videos calling on Ukrainians to evade mobilization.
To reach a larger audience, videos with identical messages (and sometimes with the same texts) are recorded by dozens of no-name bloggers.
Russian special services actively monitor Ukrainian social networks, in particular, the accounts of servicemen. They use their findings as a weapon, re-editing videos shot by the military, adding dramatic music, manipulative captions to videos or footage from military cemeteries.
To create videos, fake makers actively use artificial intelligence: the voices generated talk about the foreign villas of the “daughter of Zaluzhnyi,” “mother-in-law of Zelenskyy,” or the head of some district or regional recruitment centre. The videos are common stock photo slideshows.
Videos created for TikTok are also posted on other platforms: Facebook Reels, Instagram Reels, YouTube Shorts, etc.
YouTube
Back in 2022, YouTube imposed serious restrictions on Russian propaganda media: access to them was blocked in Ukraine and the European Union. Channels of some Russian propagandists, such as Dmitry “Goblin” Puchkov or Nikita “Besogon” Mikhalkov, were removed from the platform for inciting hatred and other violations.
But this does not mean that Russian propaganda has disappeared from YouTube. Anti-Ukrainian stories of Russia 24, NTV, and other Russian channels are transferred to new channels, and for them to last longer, the logo of the channels is blurred or concealed by putting other images over it.
Do not forget that Kremlin narratives and disinformation can be hidden behind any Russian content, in particular, entertaining. It’s safer to give it up altogether. Moreover, Russian bloggers can get monetization for views outside Russia, including from Ukraine, and by paying taxes in Russia, they finance the war.
X (Twitter)
The concentration of Russian bots and trolls on social network X is extremely high. The platform’s policy in the field of countering disinformation is much softer than that of Meta. This creates grounds for the spread of conspiracy theories, fakes, hate speech, and outright manipulations.
After Elon Musk bought Twitter at the end of 2022, the situation with disinformation on the network worsened. The state-affiliated media mark, which was a warning about their bias, was removed from the accounts of Russian media and their employees. The restrictions that significantly hindered the coverage of the accounts of the Ministry of Foreign Affairs, embassies, and consulates of Russia were also lifted. In recent years, they have become part of the machine spreading disinformation and are spreading outright fakes. In 2023, Twitter accounts of the Ministry of Foreign Affairs of Russia and the Russian Embassy in the United Kingdom posted a staged video about the “attack of the Ukrainian military on a woman with a child,” and in January 2024 — a fake about the “Zelenskyy’s tattoo.”
Telegram
Created by Russian Pavel Durov, Telegram is not only the most popular messenger in Ukraine, but also a powerful tool for spreading disinformation. The messenger has an extensive propaganda network: channels of war correspondents, Z-bloggers, Russian federal media, government agencies of Russia, etc. continuously generate content.
The attention of the enemy special services to Telegram is absolutely predictable and understandable, given the number of Ukrainians who use it.
Back in 2021, the SSU officially informed the public that the Telegram channels Legitimny, Resident, Spletnitsa, and related resources work for the special services of Russia to destabilize the socio-political situation in Ukraine. Despite this, the Ukrainian audience of these resources remains huge: the authors post fictional “insides” from the Pechersk and Capitol hills, the Kremlin, and even Beijing. These “insides” boil down to the promotion of Russian narratives about the “doom” of Ukraine and the “futility” of resisting Russian aggression.
Ukrainian media, government agencies and units of the Defence Forces use Telegram as a communication tool. Therefore, the emergence of cloned channels for information and psychological operations was only a matter of time. In 2023, the Russians created several fake channels of the brigades of the Armed Forces of Ukraine to spread fake news about huge losses and treason of the leadership, as well as to manipulate the relatives of servicemen. Perhaps the greatest achievement of the Russians in this field was the use of the fake channel of the 46th Separate Airmobile Brigade of the Armed Forces of Ukraine as a source of news for CNN in January 2023.
On the eve and during the full-scale invasion, the Russians created dozens of regional Telegram channels to spread disinformation under the guise of ordinary news and announcements.
These channels are promoted both through spam mailings and advertising, and through the algorithms of Telegram itself. After subscribing to a channel with local news, Telegram recommends “similar channels,” including Russian ones.
Signal, WhatsApp, Viber, and other messengers
The Russian special services use popular messengers to exert information and psychological influence on Ukrainians. Russian trolls operate in comment sections of popular messenger channels. Disinformation can often be seen in local chats.
Messengers are also a convenient tool for spamming fakes, phishing, and other fraudulent schemes. In autumn 2023, WhatsApp recorded a mass mailing to Ukrainian ad numbers with offers to earn some money. The user was offered to follow the link on Telegram and fill out a questionnaire, leaving personal data, or to transfer a certain amount of money to “buy out the order,” rent some property or under other pretexts.
In 2022, Ukrainian officials, law enforcement officers, and the military received WhatsApp messages urging them to surrender and go over to the enemy’s side.
Ukrainian high-ranking officials received such messages on WhatsApp in February 2022 urging them to cooperate with Russian special services.
At the end of 2023, Ukrainian servicemen were subjected to spam attacks with “New Year greetings” from Russians in Signal.
A popular type of spam is links to Telegram channels with fake content and phishing pages.
Considering these dangers, in no case should you click on questionable links and download files that you received during such mailing.
Conclusions
Among the most common tools used by the Russian special services to attack Ukrainians on social networks and messengers are the following:
● bot farms and trolls (all platforms)
● video and audio fakes, propaganda videos (all platforms);
● intrusive ads (Facebook)
● propaganda, pseudo-Ukrainian, and cloned channels (Telegram);
● spam mailing (WhatsApp, Viber, Signal).
The enemy tries to use almost all the popular platforms in Ukraine in its information warfare. Therefore, it is necessary to follow the rules of information and digital security, not to click on suspicious links and to treat emotionally charged messages with caution, especially if their source is spam mailing, an intrusive ad, a questionable TikTok blogger, or an anonymous Telegram channel.
Center for Strategic Communication and Information Security
