BANNER: Photo of the late pro-Russian priest Iona Ignatenko, whose image was used in a Facebook scheme to get people to subscribe to dubious Telegram channels. (Source: Ukraina Peremozhe Facebook page)

The DFRLab identified twelve Facebook pages undertaking deceptive bait-and-switch behavior seemingly with the sole intent of pushing Ukrainian audiences to three Telegram channels that publish dubious news coverage and prompt users to join additional Telegram channels.

Bad actors routinely deploy deceptive tactics in order to grow audiences for disinformation and influence, often with the goal of manipulating the recipient in some way. One such tactic involves publishing a banal or emotionally engaging post (i.e., the “bait”) to Facebook in order to bring it traffic and drive up its potential virality. Once that post starts to gain traction – and likely appear in an increasing number of user feeds – the operator edits the original post (i.e., “the switch”) to be something drastically different than the original post.

Eleven of the twelve Facebook pages identified by the DFRLab published emotionally manipulative content to garner engagement and then edited their posts to include links to a garbage clickbait website that itself redirected to one of three Telegram channels, apparently with the intention of building their audience. Until January 2023, one of the pages also cited external websites in its publications but mostly wrote culinary recipes and drove people to the Telegram channels without an intermediary redirecting website. The Facebook pages all had generic names, usually containing the word “Ukraine,” using techniques such as sponsoring Facebook ads to lure more people to sympathetic content about Ukraine.

Since the start of Russia’s large-scale invasion in February 2022, Telegram has risen to become the most popular social media platform for Ukrainians to get their news, according to the USAID-Internews Media Consumption Survey. This growth has subsequently led to an increased number of new, anonymous channels with hundreds of thousands of followers without any apparent editorial oversight. Some of these channels seek more subscribers to sell advertising posts or promote biased news coverage.

Previously, the DFRLab covered similar attempts to drive people to websites with emotional content, as well as via TikTok, to grow Telegram channels. This happens at a time when Russia is waging both a kinetic ground war and an information war on Ukraine; in the latter, it has promoted false documents, conspiracies, and falsehoods to influence the Ukrainian population and lower morale. It is within this context that these Telegram promotion campaigns present an alarming trend of people being pushed toward low-quality information with a dubious editorial slant. The quantity of such campaigns and Telegram channels suggest that they are often successful.

The Facebook pages all featured general but appealing names, such as Real Ukraine or Ukraine is our home, and sponsored ads with clickbait headlines. The pages ran the ads for months and amassed thousands of followers in the process. The ads are not sophisticated or reflective of the content, opting instead to appeals such as, “If you support our military, click  👍 right corner.” Notably, the phrase is in poorly written Ukrainian with grammatical mistakes; the exact phrase occurred across multiple pages and ads, suggesting possible copypasta and potential coordination between the pages. Users who follow the instructions to “like” this content are more likely to receive additional posts from the pages on their feeds.

Notably, the language in the ads was the same as that previously covered in a DFRLab report on pages administered from Armenia. For instance, the now-defunct page Интересный Мир (“Interesting world”) was administered by twelve accounts based in Armenia, according to their Page Transparency sections, and sponsored ads using the exact same language as those in the Ukrainian set comprising this case study.

Most of the assets identified by the DFRLab published emotionally compelling content to receive a boost in engagement, which in turn would prioritize its content in a user’s feed. The posts usually featured a photo of a soldier, a person with disabilities, or a random person alongside text claiming that nobody wished them a happy birthday. Such content receives a spike of sympathetic engagements, including likes and comments, from people wishing them well, thus driving the post’s popularity and causing it to appear more often in user feeds. After a critical mass of such engagement is collected and a post is sufficiently viral, the posting account edited the post entirely, changing the content either to something political or to some sensational news and including a link to an external website, which usually seemed to have been hastily built on WordPress.

In one example, the Facebook page Україна Переможе (“Ukraine Will Win”) claimed that an elderly man named Adam had celebrated a birthday but no one had wished him happy birthday. That version of the post received 1,845 interactions, according to the post’s edit history. Later, the Facebook page switched the post’s text to saying “Adam” was a seer who could predict the future, and encouraged users to go to a website, bloging360.pp.ua. This site, in turn, redirected users to a Telegram channel.

In truth, “Adam” was a late Orthodox priest, Iona Ignatenko, who had preached in favor of Russian-Ukrainian integration and against the European Union.

The link provided in the Facebook posts redirected users to one of three Telegram channels. After clicking a link in Facebook, a user would end up at a window prompting them to join the channel, seemingly as a means of accessing the linked story. For instance, when tested by the DFRLab, the story about the elderly man’s predictions led people to the WelcomeTonews Telegram channel. This was corroborated by Redirect Checker, a tool that analyzes redirects. One of the identified Telegram channels featured around one million subscribers.

The perpetrators of this effort sometimes updated the redirect links, leading Facebook users from the same post to different Telegram channels. The aforementioned fortunetelling story initially directed to WelcomeTonews but switched to another channel, Briefly about Ukraine, after a period of eleven days.

These Telegram channels also built their audience utilizing a cascading series of verification prompts. After a user sends a subscription request to a channel, a Telegram bot named “Radar” then sends the user another message asking them to verify their age. Both options, “above 18” and “below 18,” led to yet another Telegram channel seeking their subscription, after which a similar prompt from Radar would appear, pushing the user to confirm their age or “being a human,” sending them to a third Telegram channel. This tactic of cascading prompts was likely designed to build the subscriber base for multiple channels as quickly as possible.

The DFRLab identified two subsets of junk websites filled with clickbait stories amplified by the Facebook pages involved in this campaign. According to whois records, these websites were registered by nearly identical email addresses, differing only by the addition of a zero to the user name. Each Facebook page involved in this campaign published materials from both registrants’ websites. Overall, the DFRLab identified twenty-one websites promoted by the campaign, one of which did not have any registrant information. All of the websites used WordPress as a content management system; some were no longer functional.

The DFRLab could not establish the campaign’s ultimate motive beyond growing its Telegram subscriber base among Ukrainian-speaking audiences sympathetic to the Armed Forces of Ukraine, but peddling disinformation is a distinct concern. For example, they have publish advertisements for networks of web pages that push manipulated or unverified information, such as false claims regarding a possible explosion at the Zaporizhzhia nuclear power plant. The potential for such disinformation to cause harm will only grow worse as the Telegram channels in question gain larger audiences.

Roman Osadchuk, “Clickbait Facebook pages trick Ukrainians into following dubious Telegram channels,” Digital Forensic Research Lab (DFRLab), August 1, 2023, https://dfrlab.org/2023/08/01/clickbait-facebook-pages-trick-ukrainians-into-following-dubious-telegram-channels/