February 29, 2024
In Ukraine, Russia tries to discredit leaders and amplify internal divisions
This is one chapter of the DFRLab’s report, Undermining Ukraine: How Russia widened its global information war in 2023. Read the rest here.
At the beginning of its February 2022 invasion of Ukraine, Russia expected a swift military operation that would end before Kyiv and its allies could react. But relatively quickly it became clear that its initial plan would not work, forcing Russia to switch to a long-term operational posture that continued a strong emphasis on information operations.
Russia kept its focus on eroding Ukrainian morale and the country’s willingness to fight throughout 2023. The most prevalent themes included narratives discrediting Ukraine’s civilian and military leadership, portrayals of Ukraine as an unreliable partner, messages amplifying internal domestic struggles, and scams targeting Ukrainian civil society and the public at large.
Discrediting Ukrainian leadership
To destroy Ukrainian unity and support for its wartime government, Russians used multiple narratives and tactics, mixing old narratives with new approaches. Russian narratives targeting Ukrainian politicians had previously focused mostly on President Volodymyr Zelenskyy, but in 2023, they extended to other government officials, military figures, and local authorities.
Russia and pro-Russian actors placed particular emphasis on reports of Ukrainian government corruption. While journalists have documented specific instances of corruption, Russia presented the problem as endemic to the entire Ukrainian leadership. The tactic was simple: convince the domestic Ukrainian audience of its government’s inability to rule the country honestly while simultaneously demonstrating to Ukraine’s allies that investing their own governmental resources in Ukraine would be wasteful.
While investigating these corruption narratives, the DFRLab and BBC Verify jointly uncovered a massive TikTok network disseminating corruption allegations targeting Oleksii Reznikov, the former Ukrainian minister of defense, alongside accusations against mayors, heads of draft commissions, and the Office of the President of Ukraine. While Russian narratives framing Ukraine as corrupt or a failed state are nothing new, the use of TikTok as a propaganda vector took place at an exceptional scale, involving more than 12,800 separate user accounts. As noted in our December 2023 investigation, TikTok attributed it to a Russia-based covert operation and described it as the largest information operation ever uncovered on the platform.
Videos produced for the operation followed a basic pattern, employing AI voice narration in conjunction with images of luxury items such as villas and cars, presented alongside photos of officials and those of suffering Ukrainian citizens. In numerous cases, photos of luxury villas supposedly purchased with absconded funds were sourced from online real estate listings. These videos were then published in at least seven languages by thousands of TikTok accounts, each of which uploaded a single video to the platform.
While the campaign was not extremely sophisticated from a fact-checking perspective, its employment of nearly 13,000 TikTok accounts allowed it to garner hundreds of millions of views on the platform. This exposure ultimately led to dissemination across other platforms; in once instance, a single video received more than five million views across YouTube, Twitter, and BitChute. Other videos propagated across X, including some translated by users of the platform.
While the TikTok campaign targeting Reznikov was the most notable operation involving corruption allegations, others gained traction as well. A narrative claiming that Ukrainian First Lady Olena Zelenska had purchased luxury jewelry during a visit to the United States went viral on X, receiving millions of views even though the story had been widely debunked.
Weapons-trading narrative goes international
In 2022, Russians invested heavily in the narrative alleging that Western weapons donated to Ukraine were being traded on the black market or shared with Russians. It reached a new level of operational sophistication in 2023, however, when Russia hacked Ukrainian media outlets to plant forged documents on their websites, then subsequently delete them; this effort allowed the perpetrators to present archived copies of the planted materials as evidence that Ukrainian media had reported the story then covered it up. This narrative twist subsequently received coverage in both Russian and pro-Russian foreign media.
Elsewhere, pro-Russian social media sources amplified false allegations that Ukraine re-sold Western military aid to drug cartels and terrorist groups. In one instance, they shared a video and claimed it was proof that a cartel had purchased a Western-donated Javelin missile launcher from Ukraine; in a subsequent fact-check, AFP reported that the account that shared the clip had mistranslated a video from a Mexican news outlet so it could accuse Ukraine of selling the system.
The latest push of Russian propaganda in this vein is to promote a story that Ukraine supplied weapons to Hamas, which allegedly used them in its attack on Israel on October 7, 2023. In one instance, Russian sources used screenshots of ammunition to claim without evidence that Ukraine sponsors Hamas; they also circulated a forged BBC video discussing a nonexistent report they attributed to the open-source research organization Bellingcat in a continuation of the 2022 trend of impersonating reputable outlets to convey legitimacy.
Internal conflicts and fear fuel Russian activities
Russia is adroit at exploiting the internal problems of adversaries to their advantage. This holds true in Ukraine as well. While the whole of Ukraine suffers from missile strikes, blackouts, and air raid alerts, the damage caused by the Russian invasion varies greatly by region, with the southern and eastern parts of the country experiencing the heaviest toll. Additionally, those regions historically had a larger percentage of Russian speaking Ukrainians, the legacy of Soviet industrialization and settlement of the region. Russian actors tried to exploit these two factors to foment hostility between regions. Russia used similar tactics in 2014, when it illegally annexed Crimea and started the war in the Donbas region, and it can be traced back as far as Ukraine’s 2004 presidential election.
In 2023, Russians played up narratives regarding the relative safety of western Ukraine as a point of internal division. For example, the meme song “Fortress Lviv” sarcastically demonstrated the supposed “suffering” of western Ukraine by contrasting images of people living a relatively normal day with claims of being targets of Russian violence. Originating on TikTok, the song was subsequently amplified and republished to other platforms. “Fortress Lviv” is a satiric parody of the song “Fortress Bakhmut,” which celebrates Ukraine’s efforts to defend that city. The Ukrainian government’s Center for Countering Disinformation later claimed that “Fortress Lviv” was a psychological operation of pro-Russian operators.
Russians and pro-Russian actors also amplify harmful and pessimistic content on Telegram and other social platforms, pushing doom-laden predictions for Ukraine’s future, its struggling military counteroffensive, and the abandonment of Ukraine by its allies. While the topics vary, their general purpose is to break Ukraine’s will to resist, reduce humanitarian and military aid from Western partners, and drive tensions within the country. For instance, during blackouts in Fall 2022 and Winter 2023, Russians amplified news of the small gathering of Odesa citizens who had protested the prolonged electricity shortage, attempting to use the instance to foment wider protests. In September 2o23, pro-Russian accounts spread footage from another protest in the city, claiming that people were protesting against President Zelenskyy, even though the protests were actually an attempt to nudge local authorities not to spend budget funds on infrastructure repair but on military supplies.
Attacks on civil society organizations and media
Ukrainian civil society organizations active in countering Russian disinformation also faced numerous attacks. Multiple organizations received suspicious phishing notifications on Facebook from an account called “Meta Service,” which prompted them to perform actions that would lead to them losing access to the account.
Campaigns targeting these organizations evolved over time, returning in waves in a variety of forms. An October 2023 campaign used WhatsApp and Telegram to contact Ukrainians and promised them easy money in exchange for liking specific YouTube and TikTok videos. Effectively a marketing scam, such campaigns can be used to push specific content in order to make it trend, thus giving audiences the perception that it is widely popular or accepted as fact. Additional phishing campaigns also appeared, aiming to take control over more pages. By some estimates, these phishing attempts occur thousands of times per month. And in another instance, hackers took direct control of the Facebook page of the nongovernmental organization Ukrainer without having to resort to phishing.
Meanwhile, inauthentic websites impersonated legitimate Ukrainian media websites and their journalists to promote pro-Russia narratives with a veneer of authenticity; some of these took place under the auspices of a longstanding inauthentic campaign commonly known as Operation Doppelganger. The DFRLab identified multiple instances in which Russians or pro-Russian actors copied the look and internal structure of a legitimate website, hosting them with a similar but altered domain name. Articles on these nearly identical pages usually portrayed Ukraine’s situation as doomed and predicted to fail quickly. The pages attempted to build their audience by sponsoring provocative ads on Facebook and Instagram presenting Ukraine in a negative light, accompanied by a link to a website that then redirected users to one of the fake Ukrainian media pages.
Related content
The Atlantic Council’s Digital Forensic Research Lab (DFRLab) has operationalized the study of disinformation by exposing falsehoods and fake news, documenting human rights abuses, and building digital resilience worldwide.
Image: A Ukrainian soldier stands in front of the graves of Ukrainian soldiers killed in the war at a cemetery in Kharkiv. REUTERS