Russian milbloggers employed nuclear scare tactics following Ukrainian incursion of Kursk
Telegram channels claimed that Ukraine intended to attack Russian nuclear power plants, then exploited a site visit by IAEA Director Rafael Grossi
Russian milbloggers employed nuclear scare tactics following Ukrainian incursion of Kursk
Banner: International Atomic Energy Agency (IAEA) Director General Rafael Grossi speaks to members of the media following his visit to the Kursk Nuclear Power Plant in Kurchatov, Russia, August 27, 2024. (Source: Reuters/Maxim Shemetov)
On August 6, 2024, the Armed Forces of Ukraine (AFU) launched an incursion into Russia’s Kursk Oblast. Amid limited information released by Ukrainian authorities, the primary communicators on the situation were pro-Kremlin military bloggers and Russian state media, which downplayed the success of the AFU. On August 13, Olexandr Syrskyi, Ukrainian commander-in-chief, stated that Ukraine controlled 1,000 square kilometers of the oblast at that point in time. The following day, after Russian Major General Apti Alaudinov commented that Russia still controlled the key town of Sudzha, a Ukrainian TV channel aired a video from the city showing Ukrainian soldiers taking down the Russian flag.
Amid Ukrainian advances, Russian sources launched a narrative campaign attempting to frighten the world into believing that Ukraine’s advance could result in a nuclear catastrophe. The campaign employed an information laundering technique, amplifying unverified information through statements from Russian officials. They also weaponized an August 2024 visit to the Kursk Nuclear Power Plant by IAEA Director General Rafael Grossi, exploiting it by suggesting his appearance there demonstrated how dire the current situation was.
Origin and placement
The first step of any information laundering campaign is to post the relevant content on social media. On August 16, military blogger Marat Khayrullin posted a message to Telegram stating, “Ukraine is preparing a nuclear provocation – the detonation of a dirty nuclear bomb. The strikes are planned to hit the places where spent nuclear fuel is stored at nuclear power plants.” Khayrullin added that the supposed provocation would happen during AFU attacks on Rylsk from the direction of Glukhiv. The message also alleged without evidence that Ukraine had delivered secret munitions to the Eastern Mining and Processing plant in Zhovty Vody, Dnipropetrovsk Oblast. The post would eventually garner more than 550,000 views.
Less than an hour later, another Telegram channel, Russian Engineer, claimed that Ukraine would “frame Russia” overnight and blame it for being responsible for a nuclear accident at the Zaporizhzhia Nuclear Power Plant after covertly targeting it with missiles or drones. Neither message provided sourcing of the claims, instead insisting that the information came from “trusted people” and “people from the other side,” which implied the Telegram channels were in communication with operatives imbedded within Ukrainian military forces. This claim of insider knowledge is a popular trope used by speculative channels on Telegram, creating the semblance of a news “exclusive” and a certain level of access or expertise. For example, the Russian Engineer channel stated that it was “in the know” when it speculated about the potential responses of the International Atomic Energy Agency (IAEA) and the international community based on previous events around involving Zaporizhzhia NPP.
While the initial report by military blogger Marat Khayrullin only referenced the Kursk NPP, the additional claims by Russian Engineer allowed pro-Kremlin influencers to “scale up” the alleged attack plan to involve both Zaporizhzhia and Kursk NPP. According to Google Earth maps, Zhovty Vody is approximately 120 kilometers from Zaporizhzhia NPP and about 400 kilometers from Kursk NPP as the crow flies. As of August 2024, the munition deployed by the AFU with the longest effective firing range is the ATACMS missile when launched from Lockheed Martin’s HIMARS systems. These have a range of up to 300 kilometers in optimal conditions, well short of the distance between Zhovty Vody and Kursk NPP. The likelihood of such an attack was also extremely low because as of August 2024, the United States government had not yet granted the AFU authorization to strike into Russian territory with US military equipment at the time.
Live Broadcast News, Russia’s second largest news channel on Telegram, stated that Western intelligence agencies would supervise the supposed attacks. Russian state-owned media out RIA News echoed this claim while also claiming that Ukraine was “about to attack the nuclear facilities of Zaporizhzhia and Kursk,” citing a baseless statement from the Russian entity administering occupied areas in Kharkiv Oblast. RIA also claimed that Ukraine planned to use “warheads with radioactive material” to attack both NPPs, citing a “source in the security agencies,” most likely in reference to a military blogger.
When the predicted attacks did not come to pass, the narrative dormant for about a week. It re-emerged on August 22, when claimed it had intercepted Ukrainian drones near the Kursk NPP. Following this alleged incident, IAEA Director General Rafael Grossi visited the NPP for an inspection; Russian media took advantage Grossi’s presence to openly speculate on the direness of the situation and lay further blame on the Ukrainian side. Grossi later pushed back, warning against any attempts to use IAEA activity to promote subjective narratives. He acknowledged that the NPP was at risk of being caught up in the fighting, but for the time being was still operating at a relatively normal capacity.
The DFRLab observed additional nuclear-related narratives related to the AFU incursion into Russia’s Kursk Oblast. The latest spike in messages took place on October 13, regarding Russian claims of another attempted Ukrainian strike against the Kursk NPP. Some narratives cited a Ukrainian-made drone targeting the nearby town of Kurchatov, while others alleged Russian forces had diverted an attack with a French-made missile from the Ukrainian side. Speculation about NATO involvement in the Kursk incursion is also common, fitting broader narratives about military competition between Russia and the West.
Despite their dubious sourcing, these narratives managed to attract significant audiences. For example, Khayrullin’s original Telegram post garnered more than 550,000 views within its first month online. The successful proliferation of these narratives will continue to promote uncertainty and fear of a potential nuclear escalation, all likely part of Russia’s efforts to sway Ukraine and its Western partners towards concessions to Moscow.
Weapons of mass proliferation
One of the key dangers of these narratives is their ability to propagate quickly from unknown sources to state media and official Kremlin statements. For example, when military bloggers alarmist messaging around threats to the Kursk NPP, they provided no sources or evidence for the claims. Nevertheless, they were soon picked up by traditional media outlets and later the Russian Ministry of Defense, giving the narrative more weight and visibility. While the original narrative put forward by Khayrullin had no factual backing and was based entirely on speculation, it proved useful for Moscow’s broader narratives regarding nuclear risk, allowing them to raise alarm and draw attention away from their military failures during Ukraine’s Kursk incursion. This incident falls in line with typical disinformation practices, where false, easily disproved allegations will gain traction if they integrate well with the existing meta-narrative, playing into the confirmation bias of audiences indoctrinated to believe Kremlin messaging.
As is often the case with Russian narratives, Telegram served as both the point of origin and the primary vector for the narrative’s online proliferation. Despite being the third-most downloaded messenger app worldwide, Telegram has minimal content moderation and offers the ability to conceal data about account owners, making it a natural pathway for spreading unsourced and unverified information with extensive audiences.
It did not remain exclusive to Telegram, however, with many accounts on the platform X reposting official Russian communications and contributing to additional fearmongering. In the case of Khayrullin’s initial claim, French-language X accounts attempted to proliferate the narrative, some of them reposted information from their own Telegram channels, while others produced original posts or copied and translated information from Russian military bloggers. On August 22, following the claim of an alleged Ukrainian attack against the Kursk NPP, French-language accounts picked up the narrative again, repeating official Russian talking points. This also occurred in Arabic, when accounts amplified it on August 16 and 22 with a particular focus on highlighting the supposed role of Western munitions in the alleged attacks. On average, the Arabic posts received more views than the French posts. There were additional posts using the same talking points in multiple European languages, as well as in Hindi, Japanese, and Chinese, though these were less successful. The targeting of French and Arabic-speaking audiences remains consistent with previously observed areas of geographic interest for Russia, which have targeted countries in the Middle East, Africa, and France with anti-Ukraine narratives since the February 2022 re-invasion of Ukraine.
Unlike Telegram, where users must actively seek out and subscribe to channels to view content, X’s algorithms allow actors to reach wider audiences by recommending content directly to users. This strategy of cross-posting Telegram narratives to X to gain traction and validity through exposure works especially well for topics like nuclear threats, which already attract significant attention on the latter platform.
The laundering of these anonymous narratives by traditional media channels and official Russian sources provides them with an air of legitimacy, themselves becoming the supposed sources as the narrative proliferates. At the same time, when military bloggers and speculative accounts on social media and messaging platforms are referenced or echoed by traditional media channels, it provides them with greater validity, creating a loop that reinforces each other’s authority. Furthermore, events like the official IAEA visit can be used to rejuvenate flagging narratives and piggyback off the reputation of more respected sources. In these circumstances, neutral statements can be manipulated to serve a particular purpose as malicious actors may take advantage of the lack of clarity surrounding events.
As battle lines get closer to nuclear facilities, it will become easier to raise further concerns about potential nuclear disaster and to use that fear to undermine public support for Ukraine. This adds to the urgency of distinguishing between genuine, fact-based concerns and alarmist propaganda.
Cite this case study:
Iryna Adam and Roman Osadchuk, “Russian milbloggers employed nuclear scare tactics following Ukrainian incursion of Kursk,” Digital Forensic Research Lab (DFRLab), November 25, 2024, https://dfrlab.org/2024/11/25/milbloggers-kursk-npp/.