In this post we first discuss overlap in narratives we have observed on Russian state media, grey propaganda outlets, and unattributed pro-Kremlin Telegram channels. Second, we build on reporting by Adam Rawnsley in The Daily Beast by investigating low-engagement inauthentic social media accounts spreading pro-Kremlin messaging, including a novel persona primarily focused on sharing memes about the Iwo Jima Memorial who also occasionally spreads divisive content about Ukraine and the U.S. We document these activities not because we want to amplify falsehoods, but to raise awareness about an ongoing tactic for researchers.

Connection between overt propaganda themes and Telegram channel narratives

Over the past two weeks the Stanford Internet Observatory has been monitoring narratives related to the developing situation in Ukraine. Analysts have been observing overt channels, such as Russian state media, as well as grey propaganda outlets and unattributed Telegram channels. We observe that the narratives that state media and grey propaganda outlets push can be found on unattributed Telegram channels, and that in some instances the version of the narrative on the Telegram channels is more extreme. In this post we discuss some of the themes that appear across the propaganda spectrum.

Articles on Russian state media and RIA FAN (“Federal News Agency”, a media outlet reported to be linked to Yevgeny Prigozhin, a Russian businessman with ties to Russian President Vladimir Putin and past manipulation campaigns) have claimed the U.S. is fomenting hysteria about the prospects of Russia invading Ukraine, and ridiculed the idea of an invasion. One RIA FAN article referenced the “constant increase in military hysteria, and the attempts of the Western media to convince the whole world, and above all Kiev itself, that the Russian Federation is about to arrange an ‘invasion’” (translated from Russian). An RT article included the subheading “Western officials need to tone down ‘hysteria’ over an invasion.” Relatedly, overt propaganda articles mocked statements by U.S. officials and Western media predicting invasion. A February 13th RIA FAN article implied that Americans themselves found the idea of Russia invading ridiculous, and featured quotes from nameless commenters on a Washington Post article who had left comments such as, “Putin has never threatened Ukraine.”

This is not the first time pro-Kremlin news outlets have pointed to supposed commenters on Western media as illustrative of mainstream public opinion. DFRLab observed pro-Kremlin outlets citing supposed commenters in Der Spiegel, often failing to cite the username. 

On Telegram, versions of this narrative suggesting Western governments are fomenting hysteria take things a step further. We observed claims that the U.S. knows when Russia will invade Ukraine because “the schedule is being drawn up in Washington” (translated from Russian) - implying that the West is forcing action - and that Biden wants Russia to invade because it will solve American economic and political issues.  The cartoon below, shared to one of the Telegram channels we are monitoring, summarizes this position. Another post claimed that “hysteria of the West and escalation of the conflict between Ukraine and Russia prompts recognition of the LPR (Luhansk People's Republic)/DPR (Donetsk People's Republic)” (translated from Russian). 

A cartoon shared by a pro-Kremlin Telegram channel pushing the view that the U.S. is causing the Ukraine crisis.

We also observed a claim that Western media and NGOs were paying people to fabricate evidence of Russian atrocities during an invasion of Ukraine, and that reports of a shelling of a kindergarten (which did in fact happen) were signs of this evidence fabrication campaign. (See figure below.)

An image shared to a pro-Kremlin Telegram channel. Translation: For …
Publications are needed on the topic of war crimes, committed by Russian occupying forces in the territory of Ukraine.
Payment: $30 for a text of up to 4000 characters. Deadline - February 18
More details are in the terms of reference, which I will attach
Please put a + anyone who is interested.

The image above has parallels to a 2018 Russian military intelligence-attributed influence operation that spread claims that Syrian groups were working with Western NGOs to hire “actors for chemical weapons provocation.” Sockpuppet-written articles included a screenshot of a supposed WhatsApp conversation describing the location of a supposed movie studio.

Inauthentic accounts span platforms

Beyond overt state media channels, we additionally observed what appeared to be clusters of inauthentic accounts running covert social media propaganda efforts. In an article for The Daily Beast, Adam Rawnsley identified a number of accounts that bear some similarities to an unattributed network that originated in Russia called Secondary Infektion. Further investigation into the accounts, their tactics, and the narratives shared reveals a number of personas posting inflammatory content about Ukraine, primarily on Russian-language blogs. These personas have stolen profile photos, and will typically write just one post per blog. They also occasionally have Reddit accounts. Like the narratives discussed above, these accounts aimed to create divides between Ukraine, its allies, and additional Western countries, in addition to pushing specific narratives criticizing Zelensky that targeted Ukrainians.

One user, romagolyanich, illustrates this posting behavior. Between February 10 and 11, 2022, this user posted a story called “Who is behind the anti-German rhetoric of the Foreign Ministry and what are the consequences for Ukraine?” (translated from Ukrainian) to a number of Russian-language blogs, including ua-nazionalism.livejournal.com, blog.i.ua, politiko.ua, and kaniv.net. The user also attempted to post the story to the r/ukraina subreddit around the same time, but moderators deleted it (archived version of post). The article alleges that the Ukrainian government is spreading anti-German rhetoric online using materials produced by the U.K. and U.S., as well as publicly criticizing Germany for not providing military assistance to Ukraine to fight Russia. The post argues that this behavior is reckless and costly, and puts Ukraine at risk of ruining its relationship with Germany and economic deals in the E.U. The narrative does not appear to have received engagement - we were unable to find any social media shares of the posts. Romagolyanich’s profile photo appears to be stolen from a Twitter user in Illinois and the romagolyanich accounts posted just once on politiko.ua, livejournal.com, and Reddit.

Another user, Vitali Borsh (Віталій Борщ), posted a blog entry titled “No more EU, Trimorya is our goal!” (translated from Ukrainian). Trimorya (Тримор'я) refers to the Three Seas Initiative, an economic union of 12 Central and East European countries (not including Ukraine). The post criticizes the E.U. for the  lack of benefits it has brought to Ukraine. He then makes a strong call to support Ukraine’s entry into the Trimorya, highlighting Polish leadership and closer ties with NATO and the U.S.

Borsh also posted in Ukrainian on Reddit and Ukrainian blog websites: blog.i.ua, LiveJournal, mistaua.com, and politiko.ua. All posts were made on the same date and were the accounts only post to each website (with the exception of LiveJournal, where Borsh shared the same blog post in two groups). Borsh’s account is suspended on Reddit, and Borsh’s posts received little engagement on the other sites.

Borsh used the same profile photo across different websites. (See figure below.)

Left: Borsh’s profile photo. Right: Original photo of a real and unrelated person. Borsh appears to have mirrored and recolored the person’s photo, then placed it in a stock background.

Borsh seems to have taken a person’s photo from a legitimate account on VK, a Russian social media service, with an entirely different name and location (Borsh claims to be from Poltava, Ukraine on blog.i.ua, but the VK account owner is from Saint Petersburg, Russia):

A third account goes by Victor Shvets (Віктор Швець). This user wrote a post titled “Zelensky agreed with Poland to create a "buffer zone" in western Ukraine” (translated from Ukrainian) on Feb. 3, 2022. The article claims Polish troops will be deployed to this buffer zone, and includes a map that supposedly shows where the troops will be. It was published on politiko.ua and teletype.in. The user attempted to post the story to the r/ukraina subreddit, but moderators removed it. He stole his profile photo from a previously jailed British man, whose photo appeared in reporting.

Analysis of these accounts, among others, reveals a few trends. The accounts frequently posted just once to blog.i.ua, politiko.ua, LiveJournal.com, and mistaua.com, sites with Ukrainian audiences. The blog post narratives varied, but usually commented on Ukraine’s relations with Russia, Poland, Kazakhstan, the United States, NATO, and the E.U. The writing was polarized, political, and rarely referenced legitimate sources. The accounts varied in when they were created (ranging from January 2021 to February 2022), their stated location (Ukraine, Russia, Netherlands), age, and gender.

One of the accounts we observed – building off Rawnsley’s reporting – appeared to be attempting to socialize and launder fake documents, rather than writing their own unique articles. In The Daily Beast article, Rawnsley observed the spread of a faked document from a Ukrainian LGBTQ organization. Rawnsley wrote:

When not trying to inflame relations between Ukraine and specific countries, sock puppets using Secondary Infektion-like tactics have also tried to use LGBT rights as a wedge issue to discredit it in the eyes of the West. An October 2021 post forged a letter from a Ukrainain gay rights group, LGBT Association LiGa, protesting a proposed tax on childlessness as discriminatory towards gay couples, who cannot legally adopt children or marry in Ukraine.

In a statement published to Facebook, LiGa officials confirmed that the story “this letter was printed on a letterhead that does not belong to LiGa and has incorrect contact details of our organization and a faked logo,” complete with an fake signature from the group’s chairperson, Oleg Alyokhin.

We believe the first account to share this forgery was philiplyndon / PhilipLyndon2, who was notable also for the way he aimed to form an identity, and his active Twitter and Reddit presence. The Philip Lyndon account appears to have stolen its profile photo from a dating website, cropped and mirrored the image, and also colored over various items in the photo.

Left: The original photo, of a man with a different name. Right: The Philip Lyndon account cropped and mirrored the photo for his profile photo. The green bags also appear to have been removed through image editing; the coloring where the bags once were does not match the wall.

At first glance, Philip appears to be an enthusiast of the Battle of Iwo Jima. Each of his 76 tweets included a version of the “Raising the Flag on Iwo Jima” photograph.

An example tweet from @PhilipLyndon2 where he shares a politicized cartoon of the Raising the Flag image.

His tweet on August 26, 2021, however, was not like the rest. Alongside a pro-LGBTQ version of Raising the Flag, Philip shared the forged document.

On August 26, 2021 Philip shared a forged document supposedly from a Ukrainain gay rights group.

The forgery was shared to 9gag.com (by a seemingly authentic account) the same day, and received 31 comments. On October 11, 2021, a user named valyatkach shared the 9gag post, showing the possibly authentic reactions, on currentpolitics.livejournal.com (among other sites, and on the r/ukraina subreddit, which quickly removed it). Valyatkach has since been suspended from Reddit. The post was accompanied by a paragraph: “Before Kiev had time to feel like a part of a ‘civilized’, ‘tolerant’ and' free European home, it immediately turns on the back and shows its true face... the best houses in London - so what??? They even managed to get hold of the LGBT community, who are forced to seek protection in the West!” (translated from Russian). The forgery received very limited social media engagement. Like Philip, valyatkach has a stolen profile photo (valyatkach profile photo; original photo). 

Philip says he is American, and most of his tweets and posts are in English. He follows primarily English-language Twitter accounts, along with a few popular Russian accounts. His Reddit activity is similar to the Twitter activity, with a few exceptions. He moderates the r/flagofsix and r/iwojima subreddits, with 29 and 7 members respectively.

The Philip Lyndon persona on Reddit.

On Reddit, he posted the document forgery to a number of subreddits with the title “Did you know that same-sex couples in Ukraine are not allowed to have kids and still have to pay taxes for families without children? That's ridiculous!”  On the r/lgbt subreddit it received 17 points and 2 comments, on the r/gay subreddit 129 points and 5 comments. Philip also tried to get the narrative to take off among his few r/flagofsix members, with little luck. 

Philip tried to come across as a tolerant person raising awareness about anti-LGBTQ sentiment in Ukraine earlier in 2021. The two images below show him 1) telling a story about a gay friend in Ukraine whose parents did not accept him due to his sexuality and 2) asking “How can a gay escape from a mental hospital?”

Posts from Philip Lyndon on Reddit in early 2021.

Philip pushed some other themes as well. He reposted a satirical article, but without a label noting it was satirical, claiming that “Congress has approved the addition of [Rep. Alexandria] Ocasio-Cortez's likeness in bronze to the Iwo Jima memorial.”

Philip also posted anti-Hillary Clinton content suggesting her campaign was being propped up by media outlets like CNN.

He additionally shared thoughts on Reddit about the Black Lives Matter movement, saying that the movement was going too far and that it may lead to the U.S. being conquered by “Russia, China, France, Great Britain,” but it was also “the right thing.”  

A post from Philip Lyndon on Reddit in early 2021.

These inauthentic accounts received little engagement, and used many previously seen tactics. We are unable to attribute the inauthentic accounts to any particular actor. Across outlets we see messaging that aims to create divides between Ukraine, its allies, and additional Western countries, and reduce support among Ukrainians for Zelensky, though the exact versions of the messages varies.