BANNER: Residential buildings damaged by a Russian missile strike in Pokrovsk, Donetsk. (Source: Reuters/Viacheslav Ratynskyi)

A network of Telegram channels managed by Vasily Prozorov, a former employee of the Security Service of Ukraine, is spreading pro-Kremlin content in at least nine languages. The Telegram network is directly connected to the Vasily Prozorov Investigation Centre and targets audiences with anti-Ukraine content in Polish, German, Italian, French, Serbian, English, Spanish, Portuguese, and Russian.  The Telegram channels in this network have a similar naming structure indicating the country of focus, for example, “UKR LEAKS_srb;” “UKR LEAKS_eng;” “UKR LEAKS_fr;” and “UKR LEAKS_de.” The identified channels actively amplify each other.

The UKR LEAKS channels are open about their connection to Prozorov. The description of the UKR LEAKS English channel reads, “UKR LEAKS investigation center of the Ukrainian special services’ former officer Vasily Prozorov.” Translated versions of this text also appear in the descriptions for other channels. The channel descriptions also contain Prozorov’s Twitter and Telegram handles and a UKR LEAKS email. According to a post in the original UKR LEAKS channel, which publishes in Russian, Prozorov identifies himself as a Russian who was born and raised in Ukraine. He allegedly joined the Security Service of Ukraine (SBU) in 1999 and in May 2014 joined the headquarters of the Ukrainian Anti-Terrorist Center (ATO), where he served until 2018. Prozorov claims that he began to cooperate with “Russia’s Special Services” in 2014. He said he was triggered by the Ukraine’s 2014 Revolution of Dignity, which he called a coup d’état. The SBU confirmed that Prozorov worked for the service, but said he was dismissed “due to official misconduct” – more specifically, “systematic consumption of alcohol at the workplace, discrediting the rank of an officer.”

Telegram’s popularity in Russia significantly increased following the 2022 invasion of Ukraine. The number of active Telegram users in Russia rose from 25.5 million in January 2022 to almost 48.8 million in January 2023, according to Russian media research company Mediascope. As a result, the eco-system of pro-Kremlin disinformation has greatly expanded on Telegram. The DFRLab closely monitors the growth of pro-Kremlin narratives targeting international audiences. In March 2023, the DFRLab reported on three Telegram networks that spread pro-Kremlin narratives to users in Europe, Asia, South America, and the Middle East. In June 2023, the DFRLab discovered a coordinated network of nineteen Russian-language Telegram channels that aggregated anti-Ukraine and pro-Russia news stories from over twenty countries.

The UKR LEAKS network regularly publishes in multiple languages content that aims to damage the reputation of the Ukrainian armed forces. For example, a post published in the German channel claimed that a Ukrainian soldier was systematically beaten by his commander at a training base in Lviv and diagnosed with internal organ damage. Further, the Italian channel published a VICE News clip, in which a Ukrainian soldier, who fought in Bakhmut, said the Ukrainian government does not provide frontline soldiers with enough support. He added that it appears the government’s plan is the extermination of its combat-ready and working-age population. The Serbian channel also posted a video alleging that a Ukrainian commander killed his troops with a grenade after they refused to carry out a “suicide order.” The Polish channel posted a screenshot of an alleged news headline stating, “French police are fired upon with American rifles that may have come from Ukraine.” This claim was debunked by the BBC.

Further, the Telegram channels in this network spread negative sentiments about Ukraine in an apparent attempt to undermine relations between Ukraine and its Western allies. For example, the Spanish channel posted a cartoon with a caption claiming that “the only plan that can be offered to a beggar [e.g. Ukrainian President Volodymyr Zelenskyy] is the complete destruction of Ukraine.” Another cartoon that appeared on the English channel suggested that US President Joe Biden pays Zelenskyy to kill Ukrainian soldiers. The Portuguese channel posted a photo of Zelenskyy standing alone at the July 2023 NATO summit with the caption, “Zelenskyy is alone in the midst of his enemies… Sorry! In the midst of his allies, who demand that the war continue until the last Ukrainian.” A post published in the Polish channel claimed that Austrian people are fed up with Ukraine.

The vast majority of the channels in the network cross-post identical messages in multiple languages, indicating that they do not target foreign audiences with tailored messages. Most of the timestamps for identical posts show that the posts first appeared in the Russian channel before being cross-posted to the foreign language channels.  It appears the network operators are likely using machine translation to translate text from Russian into foreign languages. The DFRLab translated one post from the Russian channel into English, Spanish, and Italian and found that the text published in the English UKR LEAKS channel was identical to the translation offered by Google, while the translations of the Spanish and Italian posts offered by Google were similar, but not identical. Moreover, the DFRLab asked Italian, French, Spanish, Portuguese, and Polish native speakers to review posts published in these languages and all concluded that the posts do not appear to be written by a native speaker.  

The foreign language channels in the UKR LEAKS network were not created in unison, rather the network has expanded since April 2021. The Russian language channel was the first to be created, in April 2019, and the English channel was the second in April 2021. It appears that the network is continuing to expand as the latest UKR LEAKS channel, in Portuguese, was created on June 19, 2023.

An analysis of the channels’ posting activity demonstrates that not all the channels are equally active in terms of publishing cadence. It also reveals that not all channels publish identical content with the same frequency. For example, the Polish channel was created seven months after the German channel, yet, as of July 8, 2023, it had published more posts than the latter. Even though the Polish channel was prolific in its publishing, its posts received the least amount of amplification. Of the 2,108 posts published between the channel’s creation date, on February 8, 2023, to July 8, 2023, only forty posts (1.8 percent of all posts) were mentioned by or forwarded to other channels. For comparison, the more than 6,800 posts published by the Russian channel were forwarded or mentioned more than 26,000 times as of July 8, 2023.

The Russian language channel has the largest audience with more than 128,000 subscribers, followed by the English-language channel with more than 54,000 subscribers, as of July 8, 2023. However, as far as actual post views are concerned, according to TGStat, 21 percent (around 27,000) of subscribers read the content of the Russian channel, while this number stands at 22 percent (around 12,000 subscribers) for the English channel. This reveals that the Russian channel’s readership is more than double that of the English channel. Other channels in the network also have a high percentage of subscribers who read their posts, but their subscriber base is much smaller.

On July 4, the Polish channel announced that it was moving to a new address and moving forward all materials would be published in the Polish language Telegram channel Thrill Providers (Dostawcy Wrażeń). Created in March 2022, Thrill Providers belongs to Belarusian opposition activist and political prisoner Arciom Dubski, who was granted asylum in Poland after he finished his prison sentence in Belarus. The Polish Center for Monitoring Racist and Xenophobic Behavior reported that Dubski, who is currently based in Russia, cooperated with the State Security Committee of the Republic of Belarus to carry out sabotage acts while residing in Poland. This indicates that the operators of the Polish UKR LEAKS channel appear to be cooperating with other channel owners.  The DFRLab also found that some UKR LEAKS Telegram channels participate in cross-promotion. For example, on July 27, the German UKR LEAKS channel promoted another German Telegram channel, Ostnews Faktencheck (Ostnews fact check). On the same day, Ostnews Faktencheck promoted the UKR LEAKS German channel.

The Vasily Prozorov Investigation Centre operates a website titled “UKR LEAKS” that often publishes baseless “investigations” that seek to damage Ukraine’s reputation. One such investigation claimed that “the United States has long chosen Ukraine as a bio testing ground. Primarily because of the cheap bio-material.” The report goes on to say that due to corruption in Ukraine’s healthcare system, the United States can hide sudden deaths that result from its supposed testing. Another report accused Ukraine of using chemical weapons against Russian troops in Ukraine. The website also shares biographies, riddled with inaccuracies, of Ukrainian politicians and military figures. In addition, the website shares interviews Prozorov has given to different media outlets. The website’s contact information includes email addresses that end in @Inbox.pl, suggesting that UKR LEAKS may use a derivative of the Latvian email system Inbox.lv. 

Prozorov also has a Twitter account where he regularly publishes anti-Ukraine content, sometimes the same content appears in the UKR LEAKS Telegram channels.  Prozorov’s Twitter account was created in June 2022, at which time Prozorov had already begun building the multilingual UKR LEAKS network on Telegram. On June 20, Prozorov announced on Twitter the launch of the Portuguese UKR LEAKS Telegram channel. Apart from Prozorov’s account, the DFRLab also found French and German UKR LEAKS Twitter accounts.

It appears that the official UKR LEAKS YouTube channel was restricted for violating the platform’s guidelines. However, there is a Spanish-language YouTube channel called Vakulinchuk, which periodically uploads Prozorov’s interviews with Spanish subtitles. Twenty of the twenty-five videos uploaded by the channel as of July 11, 2023, featured UKR LEAKS content. Vakulinchuk also has a Spanish-language Telegram channel that primarily publishes anti-Ukraine content. In addition, UKR LEAKS has active channels on the alternative video platforms Odysee, Dailymotion, Rumble, and RUTUBE.

There is also an English UKR LEAKS Facebook page that frequently publishes content seeking to damage the reputation of the Ukrainian armed forces. The DFRLab found that pro-Kremlin and suspicious Facebook pages and accounts share or post UKR LEAKS content on Facebook in different languages, including French, Spanish, Romanian, Italian, Slovak, English, German, Swedish, and Thai. Russian diplomatic accounts have also quoted UKR LEAKS materials on Facebook.

Overall, the UKR LEAKS network primarily targets foreign audiences and provides selective coverage of the situation in Ukraine with the goal of portraying Ukraine in a negative light. This is especially noteworthy given that Prozorov does not hide his supposed cooperation with the Russian security apparatus.

Givi Gigitashvili, “Anti-Ukraine Telegram network targets audiences in nine languages,” Digital Forensic Research Lab (DFRLab), September 5, 2023, https://dfrlab.org/2023/09/05/anti-ukraine-telegram-network-targets-audiences-in-nine-languages.