Image: A deepfake of Ukrainian President Volodymyr Zelenskyy that aired on a hacked Ukrainian 24 newscast.

As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.

Hacked news program and deepfake video spread false Zelenskyy claims

Municipal VK accounts use children and patriotism to justify Ukraine invasion

Russia claims to have “obtained documents” proving Ukraine was preparing invasion of its eastern regions

Russia threatens to block YouTube

Information fog surrounds Russian TV journalist who conducted on-air protest

Suspicious Facebook page creates ads calling for people to join Ukraine’s International Legion

New Belarusian constitution revoking non-nuclear status goes into effect

Economic sanctions continue to mount on Belarus

A national news broadcast on the television channel Ukraine 24 was breached by hackers on March 16. The program’s news ticker was hacked to display messages to appear as though they were coming from Ukrainian President Volodymyr Zelenskyy. The messages urged Ukrainians to stop fighting and give up their weapons, while claiming that Zelenskyy “wanted to take Donbas” but was unsuccessful, so he had fled Kyiv.

The TV network confirmed that the news ticker was hacked and the messages were false. In response, Zelenskyy also filmed a short video debunking the messages and calling them a childish provocation. 

On the same day, the pro-Kremlin Telegram channel “Operational” reported that hackers published to Ukrainian websites a deepfake video of Zelenskyy repeating similar messages. The Telegram channel shared a video file, which according to its metadata was created on March 16, two hours before being uploaded to Telegram. Notably, the messages shared in the ticker and the deepfake video, encouraging Ukrainians to surrender, were amplified on VKontakte (VK), the Kremlin-owned social media platform that is similar to Facebook. Some commenters in Russia hypothesized that Zelenskyy uploaded the video in desperation and then backtracked after reconsidering. 

The deepfake video was debunked very quickly by Zelenskyy and was ridiculed by Ukrainians who noted the poor quality of the video and audio.

—Roman Osadchuk, Research Associate

Several accounts on the Kremlin-controlled social media platform VKontakte are posting “copy pasta” (slang for copying-and-pasting identical text) to justify Russia’s decision to invade Ukraine. While some of the accounts are personal, others belong to municipal organizations. The text repeats Kremlin narratives suggesting that the war “was needed to stop the shelling of Donbas” and that “Ukraine should be purged from nationalists.” It also stated, “It is absolutely clear that all these sanctions would have been imposed anyway.” The copypasta trend was first spotted by Russian journalist Dmitry Kolezev.

The identical posts used the hashtags #своихнебросаем (“do not leave ours behind”), #Zанаших (“For ours”), #Zапрезидент (“For the president”), and #Мывместе (“We are together”). Other posts using these hashtags feature kids being physically arranged to form the letters “Z” or “V,” the symbols of the Russian invasion, or children holding a piece of paper with the hashtags written on them. 

Another notable campaign featured a video that depicts young people supporting the invasion. The video includes text that says, “Stalingrad is ours!” This video intends to highlight the famous World War II battle in an effort to draw patriotic support for the war in Ukraine. The original video was published on the “Young guard” page. Fifty minutes after the initial post, five municipal entities from the Frolovsky district reshared the video, all within three minutes of each other. One hour later, eighteen posts were shared, all within two minutes of each other, by municipal bodies such as schools or cultural institutions, in the Elantskiy district of Volgograd. This suggests there was a centralized decision by regional government entities to share the same posts on VK locally .

The use of children to promote pro-war hashtags and the focus on municipal entities resharing the same content suggests a push for “patriotic” civic content. While most of the posts did not reach a broad audience, it is significant that multiple accounts participated, amplifying the reach of the posts.

—Roman Osadchuk, Research Associate

In an attempt to further justify Russia’s invasion of Ukraine, the Kremlin continues to present “proof” – in the forms suspicious documents and verbal statements – of Kyiv’s intentions to attack its eastern regions. Alongside unfounded claims that Ukraine planned to use “dirty nuclear bombs” and bioweapons against the Donbas region and Russia, the Kremlin stated that they obtained documentary evidence showing Kyiv’s plan to “invade the territories of Donetsk People’s Republic, Luhansk People’s Republic, and Crimea.” According to Secretary of the Security Council of the Russian Federation Nikolay Patrushev, “the documentary evidence” was obtained during “Russia’s special military operation in Ukraine.”

Kremlin media previously promoted claims that Kyiv was planning to attack Donbas prior to Russia’s invasion of Ukraine to create a pretext and prepare justification for Moscow’s attack.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

On March 14, the Russian state censor threatened to block Google’s YouTube video platform in the country. This marks the first time that the Russian government has made such an explicit threat. Following Russia’s ban of Instagram, YouTube remains the largest Western social media platform still available to Russian citizens. In 2021, YouTube reported 58 million Russian users, making it the video service’s fifth-largest national market. 

The impetus for the Russian government threat was YouTube’s March 11 decision to remove all Russian state-funded media channels globally. Specifically, Russia has demanded the reinstatement of channels funded by its “Soviet Television: State Television and Radio Fund.” This fund focuses on the historical preservation of Soviet-era films, television, and newsreels and appears unrelated to current Russian war propaganda efforts. By basing its objection on a relatively noncontroversial state media channel – as opposed to RT, for example – Russia seeks to cast its confrontation with YouTube in the best possible light. 

Russia’s independent YouTube community is already reeling from YouTube’s March 10 decision to suspend all monetization within Russia. For now, the most popular Russian YouTube creators are still able to make some advertising revenue from foreign subscribers. Less popular Russian YouTube channels, however, have lost their income entirely. Speaking to Novaya Gazeta, Russian YouTube stars were pessimistic about their ability to rebuild their followings on VKontakte, noting that VK has already begun to ban independent media producers. 

Both Russian YouTube creators and those close to the Russian government express the sense that a YouTube ban is ultimately inevitable. As one Russian reporter close to the Kremlin recently warned Telegram followers, “The time has come for us to live without YouTube.”

—Emerson T. Brooking, Resident Senior Fellow, Washington DC

On March 14, Marina Ovsyannikova, an editor at Kremlin-controlled Channel One TV, interrupted a live broadcast of the primetime news program “Vremya.” Ovsyannikova stood in the background holding a poster that read: “No war, stop the war, don’t believe the propaganda, they are lying to you here.” In a pre-recorded video statement, she explained that she is against Russian President Vladimir Putin’s war in Ukraine and expressed shame that she worked for Kremlin media. Channel One reportedly acknowledged the incident to Kremlin-owned TASS news agency.  
 
Ovsyannikova was not heard from again until the evening of March 15, when she briefly talked with journalists after exiting the Ostankino district court building with her lawyer Anton Gashinsky. The court issued a fine of 30,000 rubles ($280). 

After the incident, Ovsyannikova’s name trended on Twitter in Russia and abroad, with some users suggesting she had gone missing. Ovsyannikova has an Instagram and Facebook account, but both provide limited public information. After the incident on “Vremya,” accounts impersonating Ovsyannikova appeared on Instagram and Twitter, neither of which are still accessible in Russia.

Some of the fake accounts attempted to spread false information about Ovsyannikova. One account alleged that she previously supported Russia’s invasion of Ukraine, while another spread false information about the sentence she is facing. Both accounts have been removed.  

Some Twitter users suggested that her appearance in the live broadcast was staged, as “everything is pre-planned in Putin’s Russia,” to “lift sanctions,” or to “whitewash ordinary Russians of their sins.” The Guardian and Meduza, meanwhile, published articles explaining how it would be possible for Ovsyannikova to interrupt a live broadcast. 

Putin’s spokesperson Dmitry Peskov described the incident as an “act of hooliganism.” Oleg Matveychev, the Deputy Chairman of the State Duma Committee on Information Policy, Information Technology, and Communications, said it was a “provocation” and accused the US of paying Ovsyannikova “some $300 a month for this or $1,000 extra.” Kuban Oblast Governor Anna Minkova, who claimed to be the former boss of Ovsyannikova while she worked for Kuban television, characterized her as lazy and opportunistic. The inconsistency of these messages suggests that Ovsyannikova’s appearance took the Kremlin by surprise.  

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

On March 15, POLITICO correspondent Mark Scott tweeted about a Facebook page called “Ukrainian Legion” publishing advertisements calling on foreigners to join the International Legion of Defense of Ukraine. One day later, he tweeted that Meta is removing the Ukrainian Legion page for violating the company’s terms of service, specifically its policy against impersonation. The Facebook page was created on March 9 under the category “charity organization.”

The DFRLab searched for the page’s ads in the Facebook Ad Library and although the page was already removed, roughly forty ads are still visible in the library. The ads were targeted to Facebook and Instagram users in different countries, including Poland, Sweden, Latvia, Czech Republic, Germany, Ireland, United States, and Canada. The ads instructed users on how to apply to the International Legion of Defense of Ukraine, some of the ads contained the contact information for Ukrainian embassies in the countries targeted by the page admins.

The first ad in the set available for viewing was launched on March 11 and was paid for in Ukrainian currency. For most of the ads, less than USD $100 was spent on promotion. The ads included barcodes and links leading to the website fightforua.org, which was developed by Ukraine’s Ministry of Foreign Affairs in March. However, the Ukrainian Legion Facebook page is not listed on the fightforua.org website as a social media account run by the website. 

Facebook’s policy against impersonation includes the false representation of a brand, entity, or public figure. This implies that the Ukrainian Legion Facebook page was not connected to the official government effort to recruit foreign fighters. 

—Givi Gigitashvili, Research Associate, Warsaw, Poland

On March 15, Belarus’s new constitution went into effect, officially depriving the country of its previously neutral stance and revoking its non-nuclear status. The referendum on the constitutional amendments was held on February 27 and was allegedly supported by 82.86 percent of the population. As a result, the new constitution revokes Belarus’s non-nuclear status, allowing Russia to share and store nuclear technology in Belarus. According to a report from EUvsDisinfo, the result of the vote was falsified and the turnout was exaggerated. The report says that low turnout and minimal media coverage demonstrate “Lukashenka’s submission to the Kremlin.”

Some small anti-constitution protests were recorded in Belarus on March 15, but they were quickly dispersed.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

Western countries continue to mount economic sanctions against Belarus as a punishment for cooperating with Russia in the war against Ukraine. 

On March 16, Switzerland’s Federal Council announced its decision to implement sanctions on Belarus. Switzerland said it would adopt the same sanction regime as the European Union. The US, UK, and the EU all imposed new economic sanctions on Russia and Belarus over the past two days. The UK has added 300 more sanctions on Russia and Belarus, bringing the number of sanctions to more than 1,000. Meanwhile, the EU has already imposed its fourth set of sanctions against Russia.

Meanwhile, on March 12, videos emerged of Polish activists blocking cargo trucks from entering Belarus. The activists refuse to let the trucks pass, claiming that the trucks are subject to the sanctions imposed on Russia. Activists say the trucks are transporting materials for Russia to continue its assault on Ukraine. The blockade was still in place at the time of writing.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium