Inauthentic accounts previously identified by the DFRLab spread hostile narratives toward Ukraine, some related to COVID-19

A group of sockpuppet social media accounts previously identified by the DFRLab acted to amplify the narrative of the Russia-backed so-called “Luhansk People’s Republic” (LDR) about an exchange of artillery fire between separatist forces and Ukrainian military on February 18, 2020. The fake accounts used the LDR’s official statement and fake personal stories to push the idea that the separatists were victims of a Ukrainian attack, an account that is contested by Ukraine. More recently, the accounts spread COVID-19 stories in an effort to discredit the Ukrainian military’s handling of pandemic near the frontline.

These accounts adopted fictitious personas on fringe websites as well as on social networking websites like VKontakte (VK) and Odnoklassniki (OK), both of which are high-traffic Russian social networks with little-to-no content moderation. That these accounts proliferated on fringe websites is further proof that this type of activity is not isolated to Facebook or Twitter — and in many ways can be more effective in disseminating false or misleading narratives because they are away from the mainstream.

The accounts employed inauthentic means to spread propaganda online as tensions escalated in the Donbas region in Ukraine, a portion of which has been occupied by Russian-backed separatist forces since 2014. On the morning of February 18, deadly clashes between Ukrainian forces and Russian-backed separatists took place close to the town of Zolote, in the Luhansk region. While Ukraine claimed the attacks were launched by the so-called LDR, separatists argued that the conflict started when Ukrainian soldiers tried to invade their territory but stepped on a minefield.

The accounts employed inauthentic means to discourage Ukrainian soldiers from fighting, incited disobedience to orders, and encouraged soldiers to retire from the military to work abroad. They tried to exploit the COVID-19 pandemic to spread false information on the number of infected soldiers in the Ukrainian army, criticized Ukrainian government measures to tackle the virus, and portrayed President Zelensky as a mastermind exploiting the quarantine to force people to serve in the military.

The sockpuppet accounts — accounts that are run by a person or several people masquerading as someone else — were active during the crisis but had been noticed before. In August 2019, the DFRLab reported that a group of fake accounts was spreading anti-Ukrainian content using websites, blogs, and social media platforms such as Facebook and VK. The personas were first identified following Facebook’s decision to remove a set of accounts from the platform for coordinated inauthentic behavior. The group does not seem to be active on Facebook currently, but it was still present on Twitter, VK, and various blogs. In addition, it is expanding to other platforms, such as Telegram.

Blogs react to developing events

After the escalation on February 18, several news aggregator websites published articles that were highly similar but had slight variations in text, all blaming Ukraine for the attack. The pieces accused the Ukrainian government of spreading “fake news” in claiming that the shelling was initiated by the LDR and of violating the Minsk Agreements meant to halt the war in the Donbas region. News aggregators are a popular source for news in Ukraine, but most of their content is not written by professional journalists but by unknown authors.

The website artv-news.ru, which the DFRLab has previously reported on, featured six stories in a row that were published by four different personas: Anna Lubartseva, Alexei Frolov, Nikita Mirniy, and Maksym Titov. The names are likely pseudonyms or entirely fictitious people, as they used either stolen or unidentifiable profile pictures, and a variety of Google searches produced no other results featuring their names.

The pieces amplified a message that was characterized as an “official statement by the Luhansk People’s Police.” The same posts were also published verbatim on other websites, including newskog.ru, cont.ws, labuda.blog, russiapulse.ru, rubezh.at.ua, bestlj.ru, shnyagi.net, and livejournal.com. The content was also published on Russian social media platforms VK and OK, the latter of which is a Russian social media website popular with older internet users.

The posts were not always published under the same author names but always recycled verbatim text. For instance, a blog post titled “Donbas only dreams about peace” was first published on artv-news.ru by “Nikita Mirniy” and later republished on various platforms under different names, including Harry, Yaroslav Kuznetsov, Bazilio, i_pro100_tyt, and nikitatyt. These news aggregators have used this strategy before. They usually republish their own content in an effort to amplify posts; this time, however, the operators used a wider network of accounts pretending to be different people.

Fake eyewitness accounts

Besides exact copies of posts, some authors disseminated fake eyewitness accounts claiming that they had been affected by the Ukrainian army’s shelling. For instance, on February 18, VK account “Vitaly Sedoy” claimed the shelling had forced him and his family to seek shelter in a basement. The story was published to VK group “4th Separate Motor Rifle Brigade” as well as three other VK groups.

The next day, the same user wrote in another VK group that he was a Ukrainian nationalist. He claimed that he was furious with the Ukrainian president, who he claimed wanted to “issue passports for people who deserve to be killed,” a reference to a proposal to issue passports to youth from the occupied Donbas territories. The post was written in Ukrainian, while most posts in this group were in Russian. The same post appeared multiple times on OK under the name Nikita Mirniy.

On February 20, one day after self-identifying online as a Ukrainian nationalist, Vitaly Sedoy condemned the Revolution of Dignity, calling it a “nationalists’ coup d’etat.” This post was a verbatim copy of a Live Journal blog post by a user named “Nikitatyt.”

The persona appeared to be assuming numerous identities in different VK groups. The Ukrainian language post in which he identified as a nationalist, for instance, was posted in a local group for a city under Ukrainian control and a group by a Ukrainian military unit, whereas other groups featuring the post were pro-separatist or for cities under separatist occupation. The account defended the separatists openly in some groups but, in other groups, did so more subtly, posing as a Ukrainian criticizing the president and the government.

This account was not the only one spreading hostility toward and skepticism of the Ukrainian army and government. Among the accounts publishing “personal” stories on multiple groups, the most active account was “Dmitry Fedorov,” a VK account with no profile picture and almost no personal information.

He often posted several stories to multiple groups per day about how he was frustrated with the Ukrainian government or military. The stories were subsequently picked up and republished by other accounts on OK. For instance, on February 19, the account published a post claiming he was a Ukrainian soldier and that his salary had decreased after Ukraine agreed to follow NATO standards on salaries — this was entirely false as Ukrainian army salaries are not tied to NATO guidance and, more importantly, the Ukrainian military did not receive salary cuts. One minute later, the account Olga Lizenko published the same text elsewhere on OK but failed to change the gendered endings in the original text to refer to “herself.”

The DFRLab identified a myriad of pseudonymous or entirely fictitious personas during the course of this investigation that posted anti-Ukraine content: Olga Lizenko, Dmitry Fedorov, Nikita Sergeenko, Denis Sukharev, Nikita Mirniy, Alesha Sveshnikov, Irina Sydirchuk, Andrey Smirnov, Valeriy Yatsenko. Yaroslav Kuznetsov, Natalya Samoylova, Egor Chizhov, Alyona Orlova, Aleksei Frolov, Sergiy Kovalenko, and Maria Litvinenko. Most of them had either a profile picture that was stolen or missing and, using Google searches, the DFRLab found no other corroborating evidence of these “people’s” existence. This list is not exhaustive, and there may be other personas replicating the same content.

These personas primarily published posts aimed at sowing mistrust toward the General Staff of Ukrainian Military Forces, discrediting specific military units, and attacking the Ukrainian government and president. They even published posts based on false stories that encouraged Ukrainian soldiers to leave the military and work abroad, including by tacking on contact information for foreign recruiters at the end.

Another approach used by these personas was to react to blog posts a few days after they were published, thus amplifying the stories. For instance, four different pieces appeared on the news aggregator platform artv-news.ru on February 20, 2020, about Ukrainian President Volodymyr Zelensky’s initiative to issue Ukrainian passports for youth from the separatist-occupied Donbas territories. The next day, these profiles started a wave of “nationalistic discontent” toward the initiative.

Old “friends” with old and new tricks

Some of the accounts that were first identified months ago were still using the same strategy and tactics.

Two accounts — Anna Lyubartseva (Lyubertseva) and Nikita Mirniy — still published several articles almost on a daily basis. Those articles were usually spread further by additional accounts. Both Lybartseva’s and Mirniy’s pieces also appeared on the Telegram channel Novosti: Korotko o Glavnom (Новости: Коротко о главном, or “News: briefly about the main things”), which was the expanded name of the blog platform newskog.ru.

Despite the personas’ efforts, the engagement level with the content they pushed remained close to zero. The posts rarely received reactions or comments from users, and the posts were rarely shared beyond VK and OK.

Personas’ activity during a pandemic

After the COVID-19 pandemic hit Europe at the beginning of March 2020, Ukraine followed the example of its European neighbors in adopting special quarantine measures beginning on March 11, in part by closing schools, kindergartens, universities, and, several days later, mandating the closure of private businesses such as cafes, gyms, and barbershops. This did not stop the blogs from telling their false stories in late March-early April, however, as they spread stories of how the “Ukrainian government is not in a hurry to introduce the quarantine measures or heal their citizens.” One paragraph on the Ukrainian government’s slow pace and “concealment of a huge number of cases” reappeared verbatim several times in various articles on cont.ws, newskog, rubezh.at.ua, ok.ru, and vk.com.

Stories posted by the personas also heavily focused on the Ukrainian military during the COVID-19 pandemic. The articles accused President Zelensky in the execution of an “artful plan” to use the pandemic to boost the number of soldiers in Ukrainian army in the face of declining enlistments. According to the article, which first appeared in April, the Ukrainian military is drafting unemployed people who had been forced to return to Ukraine after their seasonal jobs abroad were cancelled because of the coronavirus. Among those to spread this narrative, the abovementioned “Vitaly Sedoy” reprinted a story verbatim on vk.com that had previously been published in multiple verbatim articles by the “Nikita” and connected personas discussed above. “Nikita” published a follow-up article two days later in which he claimed that people will agree to do any job because of the lockdown and that they are “forced” to serve on the frontline in the Donbas unless they bribed their commanding officers, who “demanded” money from soldiers to avoid “front line service.” No other evidence corroborated these assertions, which first appeared in April after Ukraine officially postponed the draft from May through July. A verbatim copy of this story appeared on vk.com.

The final narrative pushed by sockpuppet personas was that the Ukrainian army was “hiding” the number of its personnel who had fallen ill with COVID-19. According to a May 18 official statement by the Ukrainian military, 199 soldiers had been quarantined, 78 had recovered, and two had died. While providing no evidence to back their assertion, “Nikita” once again issued an uncorroborated claim, this time accusing the Ukrainian military of counting all army losses as “COVID-19 casualties” and undercounting the real number of casualties. Another persona, “Aleksei Morozov,” echoed that the number of Ukrainian soldiers with COVID-19 was growing in “geometrical progression” and claimed that the majority of sick people in Ukrainian 25th Airborne Brigade were showing signs of COVID-19. Both articles were amplified in groups on vk.com as individual publications. Several of the personas identified above that republished stories verbatim from blogs also posed as Ukrainian soldiers or friends, in part by complaining that their commanding officers had restricted calls to family to prevent leaks about “truth” with regard to the number of COVID-19 cases in the military.

Finally, Vitaly Sedoy also undertook a new endeavor by publishing pro-separatists materials under a pretense of outrage that the materials had been posted by “separatists in another group.” This tactic allowed accounts to publish the same materials several times in the groups, even those that would object to their content, perhaps hoping that the repeated exposure would cause an illusory truth effect.

Accounts that have been previously identified as inauthentic by the DFRLab and known to spread anti-Ukraine content have doubled down on their activity as tensions flared between Ukrainian and Russian-backed separatist forces in the Donbas in February and during the ongoing coronavirus pandemic. These accounts have also adopted additional tactics, using “personal statements” in addition to false news stories in a likely appeal to emotion, and expanded their operations to other social platforms, including Telegram.

Whether the accounts were coordinating to post verbatim content or whether the news aggregators were directly involved remains unclear. The DFRLab was unable to attribute these accounts to a specific entity. The content the accounts spread, however, was sympathetic to the causes of Russian-backed separatist groups.

These accounts were maintained across fringe websites and Russian social media platforms VK and OK. As a form of message testing, the movement of the narratives they propagated — from the fringe websites onto VK and OK — is a relatively common and insidious strategy: proliferate bad information on the fringes such that it eventually makes it way into mainstream consciousness.

Roman Osadchuk is a Research Assistant with the Digital Forensic Research Lab (DFRLab) and is based in Ukraine.

Follow along for more in-depth analysis from our #DigitalSherlocks.