Banner: Ryan Routh in Kyiv, May 17, 2022. (Source: Reuters/Valentyn Ogirenko/File Photo)

Following the second assassination attempt against former US President Donald Trump, pro-Kremlin influencers and supporters of Russia exploited the would-be assassin’s zealous support for Ukraine to suggest Kyiv was linked to the shooting. Ryan Routh, 58, was arrested on September 15, 2024, after the Secret Service spotted the suspect hiding in shrubs at a South Florida golf course as the former president played golf. The Secret Service said Routh, who was armed with a modified AK-47, had not fired his weapon before being identified.

Routh had a long history of posting messages on X (formerly Twitter) soliciting support for Ukraine. These included multiple attempts to convince celebrities to record Ukraine solidarity songs, as well as proposing to form a legion of former Afghan police officers to fight for Ukraine against Russia. Ukraine’s foreign legion told CNN that Routh had contacted the organization several times but had never been a member. “The best way to describe his messages is — delusional ideas,” said Oleksandr Shaguri, an officer of the Foreigners Coordination Department of the Land Forces Command. Routh self-published a nearly 300-page book in 2023 titled Ukraine’s Unwinnable War: The Fatal Flaw of Democracy, World Abandonment, and the Global Citizen—Taiwan, Afghanistan, North Korea, WWIII and the End of Humanity. In the book, he appears to imply that he previously voted for Trump, writing, “I misjudged and made a terrible mistake.”

In multiple online threads, those active among Ukraine’s community of volunteer fighters repudiated Routh’s actions and pointed to discussions that took place earlier this summer condemning his efforts to serve in Ukraine. Evelyn Aschenbrenner, an American who according to the The Washington Post served as an administrator for Ukraine’s International Legion, warned about Routh months before the assassination attempt, writing in a June 21 X post, “Warning about Ryan Routh: he is not, and never has been, associated with the International Legion or the Ukrainian Armed Forces at all. He is not, & never has been, a legion recruiter. He is misrepresenting himself and lying to many people.”

Despite attempts by Ukrainian forces and its supporters to distance themselves from Routh, his fervent advocacy quickly became fodder for pro-Kremlin influencers and media outlets, some of whom disseminated false claims attempting to link Ukraine directly to the failed assassination attempt.

It was late evening in Moscow when news of Trump’s second assassination attempt broke at around 10 PM local time. The following morning, September 16, Russian official sources were initially silent on the topic. The earliest Russian media coverage of the incident adopted a neutral reporting style, citing Western media outlets and adhering to the known facts. Russian media used phrases like “obsessed with Ukraine” and “ready to die for Kyiv” to describe Routh, echoing what Western media had reported at that point.

The Telegram channel of sanctioned Kremlin propagandist Vladimir Solovyov was among the first to report on the incident. On September 15 at 10:35 PM, the channel shared initial reports, noting that the shooting occurred at a golf club in Florida and that Trump was safe.

Similar posts maintained a factual tone throughout the morning of September 16. The first identified mention of Routh came at 2:09 AM local time on September 16, with a post featuring an image of Routh alongside basic details such as his name, age, and a note that his social media contained calls to fight for Ukraine. A subsequent post at 2:41 AM shared more images, captioned with claims that Routh had been recruiting mercenaries to fight for the “Kyiv regime.” As the morning progressed, the channel provided additional details about Routh, noting his dislike for Trump’s policies, his support for the Democratic Party and President Joe Biden, and his record of twenty donations to the Democratic Party in 2020.

The Telegram channel of sanctioned RT editor-in-chief Margarita Simonyan remained silent about the assassination attempt. At the time of writing, the only post about the subject was a repost from the Russian military Telegram channel “Siloviki.” The post featured a clip from the Russian movie “Brother 2,” where a Russian character tells an American counterpart that while Americans have money, Russians have truth—and those with truth on their side are more powerful.

Most of the early morning posts in Solovyov’s channel focused on Routh’s personal political views and support for Ukraine but refrained from directly implicating Ukraine in the assassination attempt. However, at 4:58 AM Moscow time, Solovyov posted a link to his morning show “At Dawn” on his Telegram channel with the caption “New assassination attempt of Trump – Ukrainian trace,” marking the earliest identified instance of this narrative. The phrase “Ukrainian trace” is intended to suggest that the attempted assassination could be traced back to Kyiv.  

Using the social media monitoring tool Junkipedia, the DFRLab identified early mentions of the “Ukrainian trace” narrative in the Telegram channels of Russian vlogger Dmitry Nikotin and “Anti-Fascist.” The Russian military Telegram channel “ГОССЛУГА 🇷🇺 Z” further speculated that “according to Western logic, if any criminal has some Russian connection, then Putin personally directed them. But if there’s a Ukrainian connection, does that mean Zelensky ordered the assassination of Trump?”

Despite these early mentions, the narrative had, at that point, not proliferated widely, with the identified posts reaching around 100,000 views in total. The narrative implicating Ukraine began to intensify in the Russian information space when Dmitry Medvedev, Deputy Chair of the Russian Federation’s Security Council, suggested on X (a platform currently banned in Russia) that Routh may have been hired by the “neo-Nazi regime in Kiev” to carry out the assassination attempt.

Using the social media listening tool Meltwater Explore, the DFRLab analyzed the amplification of Medvedev’s mentions in English between 12:00 AM on September 16 and 11:00 AM on September 17. During this period, there were 7,000 mentions, with the highest peak of 951 occurring around 6:00 PM on September 16. Most mentions came from posts on X, followed by news websites and Reddit. As of September 17, Medvedev’s post received approximately 4,900 retweets. It was also screenshotted and reposted by other X users, including ones with verified checkmarks, propagating Medvedev’s allegations even further.

After Medvedev’s X post, Kremlin-controlled media shifted their tone. The initially neutral and factual coverage began to morph to point to a specific narrative, with headlines extensively using the phrase “Ukrainian trace” to suggest that the attempted assassination could be traced back to Kyiv.

Russian vloggers quickly adopted the “Ukrainian trace” narrative, publishing conspiracy videos on YouTube and RUTUBE alleging Ukraine’s involvement; these videos were further amplified on Telegram. For instance, vlogger Anatoly Shariy promoted the narrative on YouTube, where he has more than three million subscribers, and on Telegram, where he has nearly 1.3 million.

Influencer Dmitry Nikotin took a similar approach, alleging a “Ukrainian trace” to the shooting on his RUTUBE channel before cross-posting the content to his 715,000 Telegram subscribers.

Pro-Russian Telegram channels, including the Russian military channel Сводки ополчения Новороссии Z.O.V. (“Militia reports of Novorossiya Z.O.V.”), further amplified the vlogger videos. At the same time, Kremlin-controlled media outlets spread this narrative through their Telegram channels. For instance, Arguments and Facts posted a video with the caption, “The Ukrainian trace in the second attempt on Trump’s life,” reinforcing the unfounded claim that Ukraine was involved in the incident.

Kremlin officials also spun the incident to perpetuate a narrative that claimed Routh’s actions were evidence of US assistance to Ukraine being problematic. Dmitri Peskov, Press Secretary for the President of Russia, stated that the United States is “playing with fire” by aiding Ukraine and that this would have consequences. Russian newspaper Izvestia covered Peskov’s remarks in an article titled “Kremlin links new assassination attempt on Trump to escalating political struggle in the US.”

Similarly, Russian foreign ministry spokesperson Maria Zakharova echoed a similar message on her Telegram channel. Zakharova referenced a New York Times article about US volunteers in Ukraine to claim that “absolutely anyone can end up in the ranks of the Ukrainian Armed Forces — gaining access to firearms and explosives.” This claim spread despite the fact that the Ukrainian forces did not accept Routh into their ranks. Zakharova later warned, “By the way, those of them who survive will then return to the United States. And they will continue Routh’s work — shooting at their own.”

Russia’s propaganda machine further exploited Routh’s pro-Ukraine advocacy to fuel debates about US aid to Ukraine. Following comments from Kremlin officials like Peskov and Zakharova, who claimed that US support for Ukraine “backfires,” Russian media leveraged Western news coverage to bolster the anti-aid narrative. For instance, a CNN report that said Routh’s support for Ukraine was a “propaganda win for Moscow” was exploited by Russia to reinforce the Kremlin’s position against foreign aid to Ukraine. The original CNN noted that the assassination attempt involving a pro-Ukraine advocate occurred at a “tricky time” for Kyiv. Russian news websites, however, twisted this narrative to publish headlines such as “US Links Assassination Attempt on Trump to Zelensky’s ‘Victory Plan” and “Concerns in the US About Potential Decline in Support for Ukraine Due to Trump Assassination Attempt.”

Former US National Security Agency contractor and whistleblower Edward Snowden, who is currently exiled in Russia after leaking classified US intelligence on surveillance programs, alleged on X that the United States may have “had a hand in encouraging” Routh’s past “militancy.” Snowden went on to compare the situation to the US’s support for the Mujahideen during the Soviet Union’s invasion of Afghanistan. “We had a word for it at the CIA: blowback,” Snowden wrote. At the time of writing, the tweet had garnered more than 700,000 views.

Kremlin-controlled media swiftly amplified Snowden’s claims, spreading them in the Russian language featuring headlines that blamed the US government for Routh’s attack, such as “Snowden accused the US authorities of ‘militancy’ of the person who attempted to assassinate Trump” and “Snowden: The US authorities are responsible for the radicalization of the person who attempted to assassinate Trump.”

Following the shooting, some X users claimed that Routh had appeared in a commercial for BlackRock, the global investment firm. The suspect in the previous assassination attempt against Trump, Thomas Matthew Crooks, did briefly appear in a BlackRock commercial that featured Crooks’ high school classroom. X accounts, including verified ones, promoted conspiracy theories suggesting that the alleged involvement of both suspects in commercials was not coincidental but part of a deliberate plan.

In the latest iteration, the footage in question did not come from a BlackRock commercial but instead from a video related to the Azov battalion, a far-right Ukrainian militia. Routh appeared in an Azov video posted on X on May 1, 2022. The Azov Brigade confirmed Routh’s presence in the video but clarified that he had no connection to the group and was captured on video by accident during a peaceful demonstration in Kyiv in support of the Mariupol garrison. Additionally, the Associated Press published a photo of Routh attending a rally in central Kyiv on April 30, 2022, further verifying his participation in the rally during that time.

Russian Telegram channels circulated memes about the incident to fuel conspiracy theories suggesting the second assassination attempt was another scheme by the White House and Democrats to undermine Trump. This memeify tactic was also observed in the Russian Telegram ecosystem after the first assassination attempt on Trump, as memes were used to spread anti-US narratives and mock US democracy. A compilation of memes from Solovyov’s channel promoted Trump’s image as a strongman surviving attacks. Two Telegram channels, “Solovyov” and “Pul 3,” posted memes that were viewed at least 280,000 at the time of writing.

Sopo Gelava and Ruslan Trad, “How pro-Kremlin influencers spread unfounded connections between Ukraine and a would-be Trump assassin,” Digital Forensic Research Lab (DFRLab), September 23, 2024, https://dfrlab.org/2024/09/23/routh-conspiracy-theories-russia/.