As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report.

Facebook takes down inauthentic networks targeting Ukraine

After being limited on Twitter, Russian government accounts look to Telegram, VK

Kremlin-linked Telegram channels claim the West is forcing Ukraine into a long war

Russian troll factory promotes hotline for reporting “Ukrainian Nazis”

On April 7, Facebook announced that it had de-platformed a network targeting Ukraine that originated in Russia and Belarus. According to the announcement, the influence campaign dubbed Ghostwriter had intensified efforts to hack the social media accounts of Ukrainian military personnel. In some cases, the Ghostwriter operation successfully intercepted military accounts and posted videos asking Ukrainian soldiers to give up. Facebook said it had blocked these videos and prevented other users from sharing them. The cybersecurity firm Mandiant had previously assessed with high confidence that the Belarusian government is connected to the Ghostwriter operation.

Facebook also said it had disrupted government-linked actors from Russia and Belarus engaging in cyber espionage and covert influence operations against Ukraine. Some of these actors, who are connected to the Belarusian KGB, reportedly disseminated false information about Ukrainian soldiers. For example, posts claimed that Ukrainian political leaders left the country on the first day of the invasion and Ukrainian soldiers had given up without a fight. Facebook also noted that the network created an event in Warsaw to organize a protest against the Polish government on March 14.

Additionally, Facebook de-platformed a previously removed network linked to individuals associated with Russia’s Internet Research Agency who added new accounts in late 2021 and January 2022. Following Russia’s attack on Ukraine, the network published content that blamed Russia’s invasion on NATO and accused the Ukrainian military of targeting civilians.  

Facebook also removed a network originating from Luhansk. The actors behind the network allegedly promoted two pro-Russian websites targeting the Caucasus and Ukraine, kavkazru.press and politica.in.ua. Facebook said the website politica.in.ua appeared to have been “taken over” in March, as the audience was directed towards a Telegram channel where photos of Russian casualties were available. The website currently displays a banner message with phone numbers for those searching for lost Russian soldiers in Ukraine to call. It also directs visitors to a Telegram channel called Ishchi Svoikh (“Ищи своих,” or “Look for yours”).  

Facebook said it also de-platformed a small group of Facebook and Instagram assets exhibiting coordinated inauthentic behavior against Ukraine. This network reportedly ran several false news websites to spread anti-Ukrainian messages. Accounts within this network pretended to be based in Kyiv. The network used fake accounts, AI-generated profile photos, and fictitious personas to mislead users. Facebook said the network was connected to a previously removed network linked to the propaganda outlets News Front and South Front websites. The DFRLab previously reported on Facebook’s April 2020 takedown of News Front and South Front networks.  

Finally, Facebook removed about 200 accounts that falsely reported Facebook users’ content for various violations. The main objective was to convince Facebook to remove posts or accounts. Both fake and authentic accounts were used to submit thousands of complaints via Facebook’s abuse reporting tools. The reports mainly targeted individuals in Ukraine and Russia. The people behind this network used a cooking-themed group to coordinate reporting activities. The network reportedly became more active in mid-February prior to the invasion. Facebook said the network was linked to a Russian network removed in 2019.

—Givi Gigitashvili, Research Associate, Warsaw, Poland

Twitter accounts run by the Russian government are asking users to follow them on Telegram and VKontakte (VK) to receive official updates. This comes after Twitter announced last week that it would limit content from more than 300 official Russian government accounts. 

On April 10, the Twitter account of the Russian embassy in Ghana pinned a tweet in which they accused Twitter of waging a campaign to silence Russia’s official accounts. The account urged users to subscribe to “reserve social networks” on Telegram and VK. The tweet was promoted by the official Twitter account of the Russian Foreign Ministry.  

Both the Telegram channel and VK account of the Russian embassy in Ghana were created on February 28, 2022, shortly after Russia’s invasion of Ukraine. At the time of publishing, the accounts had 659 subscribers and 35 followers, respectively.  

Official Kremlin Twitter accounts have a documented history of manipulating Twitter and using the platform to spread disinformation.

—Eto Buziashvili, Research Associate, Washington DC

Kremlin–tied Ukrainian Telegram channels are continuing their attempts to shift blame for the war from Russia to other actors. The Telegram channel Rezident wrote on April 9 that the West is “easily throwing us into war with Russia” but is only supplying financial loans rather than weapons. The claim that the West is not supplying weapons to Ukraine is inaccurate. Rezident then alleged without evidence that the US and UK “warned Ukraine not to sign off on any peace treaties with Russia.” The Telegram post quoted the Kremlin-tied channel ZeRada, which claimed that Josep Borrell, High Representative of the EU for Foreign Affairs and Security Policy, believed the war must be one militarily rather than diplomatically. “[W]ar must be won on the battlefield,” the Telegram post quoted Borrell. While the EU diplomat did tweet this phrase, he has also tweeted about his support for diplomacy. 

Another pro-Kremlin channel, Spletnitsa (“Сплетница,” or “Gossip Girl”), claimed that UK Prime Minister Boris Johnson nudged President Volodymyr Zelenskyy to “postpone peace talks” during his recent visit to Ukraine. As evidence, the channel quoted Zelenskyy adviser Mykhailo Podolyak. On April 9, Podolyak said that great battles were still to come, including in the Donbas, and only after Ukraine wins them will it “get a more substantial negotiating position from which it can dictate certain terms.” The channel suggested that Johnson influenced Podolyak’s statement but did not provide evidence. The Rezident Telegram channel forwarded this message and commented, “[T]he UK and the US are against any peace treaties with Russia,” adding, “the preliminary agreements have reached their finale, and the war will be long.” 

In recent weeks, Rezident has published various “inside” scoops about the US and the UK’s influence over Ukraine-Russia negotiations. The channel posted that Johnson’s visit indicates a change in Ukraine’s public position, and continues to heavily promote debunked narratives claiming Western countries have control over Ukraine.

—Roman Osadchuk, Research Associate

RIA FAN, a website published by the Internet Research Agency, is running a hotline for reporting “Ukrainian Nazis” and promoting movies on Russian mercenaries in support of the Kremlin’s pro-war campaign. The Internet Research Agency is a troll farm financed by oligarch Yevgeniy Prigozhin, who was sanctioned for the agency’s role in meddling with the 2016 United States presidential election. 

On its website, RIA FAN has a section called “Z Heros” to support Russia’s war in Ukraine. The section lists Russian military personnel who were awarded the highest Russian state medal and tells the stories of their achievements in what the Kremlin still refers to as its “military operation in Ukraine.” In the same section of the website, RIA FAN runs a “Stop Nazism” hotline “for everyone who has something to tell about the facts of any discrimination or Nazism in all its forms.” In partnership with the Patriot media group, the site urges Ukrainian citizens to report “crimes that have been happening for eight years,” including information about “illegal weapons.”

In addition to “Z Heroes” and “Stop Nazism,” RIA FAN promotes a movie produced by Prigozhin about Russian mercenaries fighting in eastern Ukraine. Prigozhin has previously financed propaganda movies showing Russian mercenaries in a positive light, and is believed to finance the mercenary company known as the Wagner Group.

—Eto Buziashvili, Research Associate, Washington DC