BANNER: Workers load a shipment including generators and heaters on a train, as a part of humanitarian aid for Ukraine, at Liben railway station in Prague, Czech Republic, on December 14, 2022. (REUTERS/David W Cerny)

In August-September, the pro-Russia media ecosystem promoted messages aimed at discouraging further Western aid to Ukraine, seeking to undermine Ukraine’s relationship with its Western allies, including the United Kingdom, Poland, France, and Romania. These messages used purported hack and leaks that claimed to have data on Ukrainian casualties in an apparent attempt to present Ukrainian forces as weak. A separate hack and leak alleged that Western states were plotting to divide control of Ukrainian territories under the guise of further logistical and military support. In the case of the first narrative, it emerged on Telegram and was given credence when Russian state media reported on it. In the second case, the narrative emerged in a fringe Western media outlet before proliferating on Telegram. The narratives were mainly amplified on Telegram, with limited breakout to TikTok and Facebook. The narratives did not have longevity, losing popularity after one week, yet in the short period in which they circulated, they cumulatively received millions of views and hundreds of thousands of interactions.

Amid on-and-off peace talks between Russia and Ukraine, such narratives seek to undermine Ukraine’s ability to advocate for itself with the support of its long-standing partners. Claims of Ukraine’s inability to withstand, even with financial and military aid, allegations of the Ukrainian economy’s overreliance on the support of its partners, and the platforming of corruption allegations are all frequently used to undermine Ukraine. This messaging serves a larger Russian campaign to weaken Ukraine and distance it from Western allies. The Kremlin is attempting to establish a parallel information environment in which Ukraine’s loss is inevitable, and any support the West pours into its Eastern ally is ineffective. This messaging can be especially destabilizing for Ukraine as it navigates peace talks.

Although Ukraine has published a tracker of killed and wounded Russian soldiers, it does not disclose its own losses as openly. Information about Ukrainian losses is not regularly publicized, instead it is released in sporadic official statements, with the most recent being issued by Ukrainian President Volodymyr Zelenskyy in August 2025. Zelenskyy said 46,000 soldiers had been killed, tens of thousands were missing, and 380,000 soldiers were injured. Estimates have also been provided by media and civil society organizations, with The Economist in 2024 placing the number of Ukrainian military fatalities at anywhere between 60,000 and 100,000, and the Center for Strategic and International Studies (CSIS) estimated Ukrainian losses may be as high as 400,000. This casualty information gap and divergence in figures from various groups opens an exploitable space for pro-Russian campaigns.

On August 17, messages began proliferating on Telegram alleging to have data on the actual battlefield losses of the Armed Forces of Ukraine (AFU). The posts claimed a hacktivist group had gained access to the AFU’s general command systems, which contained a list of all missing and killed, along with information about their remaining family members. The posts claimed to have found evidence of 1.7 million dead servicemen. Given the nature of hacked and classified materials, it is not possible to verify the authenticity of the claim at this time, and the Ukrainian government had not commented on the matter at the time of writing. However, an examination of the actors behind the purported hack and leak reveals they are closely aligned with Kremlin interests.

Notably, the news of the hack did not come directly from the hacktivist group–it was instead first reported by the Telegram channel MASH, which posted excerpts of the stated leaked documents, including lists of dead and missing, death certificates, and supposed pictures of corpses of Ukrainian servicemen. MASH has previously been reported by Euronews to be a source close to the Kremlin and has historically been used to support Russian information operations. The 1.7 million dead narrative was immediately picked up and corroborated by RIA Novosti, which stated that it had obtained an official quote from the hacktivist group. After RIA Novosti, the claim of underreported Ukrainian losses swept Russian media outlets and Telegram channels, spreading rapidly for about a week before petering off.

Over one thousand Russian-language posts, reposts, and comments mentioning the keywords “Ukraine and (aid or support) and West” were shared between August 17-24, predominantly on Telegram and, to a lesser extent, on Facebook and Twitter, according to an Osavul query. The actors posting or engaging with the identified narratives varied from known propagandist accounts, like Tsargrad TV, which reported on the allegations, to news aggregators that shared links or summaries, to comments from suspicious accounts displaying possible signs of inauthenticity. Amplification via mainstream Kremlin-affiliated media adds credibility to the claims first circulated on Telegram. Additionally, this helps the message break out of the messaging app’s ecosystem, giving it a new and broader audience.

Killnet is a hacktivist group that has previously been observed to be acting in the Kremlin’s interests. Killnet became widely known in 2022 for cyberattacks against government and private company websites in states allied with Ukraine, with their official mission statement claiming they fight Russophobia around the globe. In 2024, the DFRLab examined over 60,000 Telegram messages from Russian hacktivists shared between February 2022 and October 2023, including those from Killnet and its members, and identified spikes in posting activity around real-world events. Their posts not only discussed their intended targets for attacks but also shared political posts and updates from the frontlines, contributing to the larger agenda of targeting Russia’s perceived enemies in Ukraine and the West.

In 2023, the group went underground after its founder was discovered and linked to the drug trade business in Russia, reemerging again in the spring of 2025 with new leadership. Since then, Killnet has been credited with several other hack and leaks, including an alleged data dump from a Ukrainian drone developer that Killnet claims to have infiltrated to delete crucial manufacturing files.

While Killnet’s activities support the Kremlin’s goals and are frequently used for propagandistic purposes, financial or other direct ties to the Russian government have not been confirmed.

In September, Killnet appeared again. This time, the reports of their alleged activities emerged in reverse order, originating in a fringe Italian outlet before spreading to Telegram. Over six hundred social media messages, primarily on Telegram, referenced reporting by the Italian outlet L’Antidiplomatico. L’Antidiplomatico alleged Killnet obtained information from the French defense ministry, including illicit maps, showing that Western allies were intent on dividing control of the Ukrainian territories under the guise of providing additional support and aid. The messages named at least four countries–France, the United Kingdom, Poland, and Romania–and outlined areas of influence they were vying for, assigning logistical hubs to the UK and border regions to Poland. The narrative was predominantly picked up by Telegram channels reporting on general news or Russian milbloggers. There was additional but limited narrative spread to TikTok and news websites. As with the previous hack and leak, it was picked up and given credence by Russian media outlets like RT, Sputnik, and Kommersant, leading yet again to higher view counts and increased social media penetration.

L’Antidiplomatico is a fringe news website, which also runs a Telegram channel, and frequently publishes opinion pieces, including on topics related to the “multipolar world.” According to the outlet itself, it has been censored by Western fact-checkers for being “a leading voice in the multipolar world that has emerged from the bloody US-led unilateralism.” The website regularly publishes content supporting the Kremlin and the Italian Five Star Movement Party, a populist Italian party that gained notoriety in the mid-2000s. There is no confirmation of a direct relationship between the news organization and either of these groups.

Additionally, the narrative further spread in October, when Hungarian Prime Minister Viktor Orbán repeated in a public speech the claim about Western states planning to divide Ukraine. His statement was picked up by Vesti, a Russian media outlet, financed from the Russian state budget as part of the VGTRK media holding, which referenced the original L’Antidiplomatico article in its reporting. The repetition of the claim by a state leader provided further credence and amplification to the unverified claim. In his speech, Orban did not cite any specific source, repeating only the narrative itself. Following the speech, the claim was debunked by European and Ukrainian fact-checking organizations.

The use of allegedly leaked classified data, which is difficult to verify or confirm independently, and the ability to reference reporting in traditional media outlets, or by state officials, allows anonymous channels on Telegram to launder credibility to spread narratives that seek to undermine Ukraine.

As with many Russian information campaigns targeting Ukraine, Telegram played a crucial role. At least 712 individual accounts shared the initial narrative about Ukrainian losses, with the majority posting in Russian. Notably, the accounts did not rely heavily on spamming tactics, with no single account sending more than nine messages during the entire campaign. The bulk of reposts and comments were made by around 450 small accounts with an audience of fewer than 1,000 subscribers. The majority of identified accounts showed no signs of overt state affiliation.

A common tactic for pro-Russian actors is to seed or amplify narratives via Telegram comments. Earlier this year, the DFRLab and OpenMinds investigated this tactic through the examination of a network of over 3,600 accounts using Telegram comments to target Ukraine’s occupied territories. The commenters use the audience of larger channels to spread their messages and to potentially try to direct users to desired content.

The identified messages amplifying the 1.7 million narrative accumulated more than 11 million total views and over 390,000 reactions, according to an Osavul query, contributing to significant message exposure for a campaign that lasted less than one week.

The second narrative about the division of Ukraine was shared in at least 477 messages. The accounts promoting this narrative were less skewed towards seemingly individual users and more towards news aggregators and war correspondents . The nature of these accounts, as news aggregators and war correspondents, means more messages were shared through posts rather than comments, since the channels already had an existing audience and did not need to hijack other accounts’ comment sections to draw attention to their messages. These accounts also did not show overt signs of state affiliation. The narrative received more than five million views and over 120,000  interactions.

Even without clear coordination efforts, the pro-Russia ecosystem is primed to promote narratives emerging from Russian state media and pro-Russia Telegram channels. Both hack and leak narratives were present on TikTok, with videos posted in Russian and English. This demonstrates a clear case of narrative breakout. At least fifty TikTok channels posted videos mentioning at least one of the hack and leaks, gaining over 4.7 million views and over 100,000  interactions across 56 posts. However, views may not be the best indicator of a video’s popularity, since the view count on TikTok can rise even if the video is only viewed for one or two seconds on a user’s For You Page. This means the 100,000 reactions provide a better estimate of the overall reach of the two campaigns. The channels predominantly posted in Russian, with most accounts averaging between 10,000 and 100,000 subscribers.

Many of these accounts have usernames that would suggest a personal account and profile pictures frequently featuring people’s pictures or memes. Their content, however, consists exclusively of clips of Russian news channels promoting Russian President Vladimir Putin, the Russian government, and pushing anti-Western narratives, alongside clips of political commentators and general news aggregation, suggesting that these could be personal accounts refurbished into political channels and news aggregators. Among the channels, there does not appear to be active coordination regarding the topics of the videos they post. Additionally, the content and editing styles vary widely across the channels, as do the messages’ style and text, suggesting that the Killnet messages could have been amplified simply because they were featured in mainstream news outlets and thus on the radar of news aggregators.

Further exemplifying the breakout of the narrative were Facebook comments, which constituted the lowest share of activity about the hack and leaks, but showed the highest level of coordination, with seventy-three users pushing the messages via original posts or comments on various Facebook pages and groups.

The Facebook accounts promoting these messages showed the greatest variety in their profiles, with some of the top pages among the identified accounts being situated in Ukraine, Canada, Georgia, Moldova, Italy, and Russia, according to an Osavul query. The pages, all in Russian, appear aimed at the Russian diaspora abroad, or promoting positive attitudes toward Russia in countries where they claim to be located.

The iterative nature of the narratives surrounding Western support to Ukraine allows propagandist channels to easily promote messages and reach the broad audiences receptive to them, while amplification by high-profile sources like state media or state leaders helps the narrative reach new audiences. While the effect of the messaging is challenging to assess, the narrative thrives on exploiting data gaps, wartime uncertainty, and complex political situations in Western countries.

Iryna Adams, “Pro-Kremlin actors attempt to undermine Western military aid to Ukraine,” Digital Forensic Research Lab (DFRLab), November 28, 2025, https://dfrlab.org/2025/11/27/pro-kremlin-actors-attempt-to-undermine-western-military-aid-to-ukraine/.

A public task financed by the Ministry of Foreign Affairs of the Republic of Poland within the frame of ‘Public Diplomacy 2024-2025: The European Dimension and Countering Disinformation’ contest. The opinions expressed in this publication are those of the authors and do not reflect the views of the official positions of the Ministry of Foreign Affairs of the Republic of Poland.