• Executive summary
• Background
• Russian practices of information influence in occupied Ukraine
• Methodology
• Indicators of bot-like activity
• Artificial narratives
• Narrative themes
• Active vs. reactive propaganda
• A case study in high-impact bot messaging
• Conclusion
• Authors
• Appendix: Full list of narrative themes

Executive summary

Russia’s ongoing territorial occupation of Ukraine’s eastern and southern regions is accompanied by an informational and cultural occupation aimed at flooding local social media communities with messaging designed to foster gratitude and loyalty to Russia. At the same time, this messaging attempts to undermine Ukraine and the Ukrainian government, and to raise doubts about Ukraine’s intentions in the territories currently occupied by Russia. As the most popular digital platform in Eastern Europe, Telegram has become the epicenter of Russian efforts to influence perceptions and opinions of local Ukrainian populations.

This joint report from OpenMinds and the Digital Forensic Research Lab (DFRLab) analyzes the activity of a network of 3,634 automated accounts that posted pro-Russian comments on Telegram channels between January 2024 and April 2025 targeting Ukrainian populations inside Russian-occupied territories. These accounts crafted tailored messages to target the occupied territories, differentiating their content from that aimed at other audiences across Russia and Ukraine.

Our investigation found that automated Telegram comments targeting local audiences in Ukraine fell into three overarching categories: pro-Russian propaganda, anti-Ukrainian propaganda, and abstract anti-war messaging and calls for peaceful coexistence. Individual narratives were often tailored to respond to current events and changes in local conditions, such as power or water outages, but there was also evidence of proactive narratives initiated by the network unrelated to external events.

The bot network used similar messaging when targeting channels based in Russia; however, a significantly larger share of comments targeting the occupied territory channels emphasized positive portrayals of Russian culture and government. Across the sixty-nine narrative themes identified (see appendix), the bot network pushed essentially the same menu of talking points in both Russia-wide and occupied territory channels. What differentiates the content aimed at the occupied territories from that aimed at a wider Russian audience is the proportion of talking points: themes that praised Russian culture, social services, and governance dominated in occupied territory-based channels, accounting for a markedly higher share of content than in Russia-based channels. The pattern points to an effort to cultivate the appearance of local consensus in favor of occupation and Russian administrative control, but not necessarily to create genuine agreement.

Background

A hybrid messaging app and social media platform, Telegram is the preferred communication platform for many in Eastern Europe. Offering more anonymity and less moderation than many other platforms, it allows users to join open channels, create closed groups and chats, and message individuals without the need to create and manage a full-fledged social media profile. While the functionality of the platform is universal, Telegram’s content and how users interact with it vary depending on the country, region, and even individual towns. This is particularly true within Russian-occupied Ukraine, where Telegram channels and user interactions differ from those based in the neighboring regions of Ukraine and Russia.

In examining comments on local Telegram channels associated with Ukrainian cities occupied by Russia, certain features immediately stood out:

• Promoted narratives were consistent;
• Account usernames and profile pictures were often incomprehensible or inconsistent;
• Accounts posted pro-Russian messages but did not engage in actual discussion;
• Accounts made frequent posts throughout the day, with messages often making little sense or containing notable stylistic and contextual mistakes, suggesting the employment of artificial intelligence (AI), as many messages contained oddly assembled word combinations and exaggerated or overly formal expressions;
• Real-world events triggered an increase in comment frequency.

The comments’ narrative focus on the proliferation of pro-Russian content and the fostering of mistrust in Ukraine and the Ukrainian government is consistent with general Russian propaganda trends in occupied Ukraine. However, this carries additional significance as the occupied regions are cut off from easy access to Ukrainian media and internet, and Telegram is often integral to connecting with neighboring regions. As such, Telegram presents a key forum for promoting messaging favorable to the Kremlin.

Russia has blocked access to Ukrainian satellites in some regions since 2022, including blocking Ukrainian TV channels in the occupied territories, while also forcibly switching local residents to Russian telecom providers, further limiting their access to Ukrainian mobile and internet platforms. The integration into what is sometimes referred to as the “Russian world” information ecosystem prevents these users from reaching Ukrainian-based broadcasts and online platforms without a virtual private network (VPN), complicating the process in particular for older members of the population.

Though the closed nature of the occupied territories’ information space and the dangers faced by locals reaching out to outside contacts make it difficult to truly understand the information landscape and user habits within occupied areas, understanding the mechanisms through which Russian propaganda targets these territories is crucial when considering the possible reintegration of these Ukrainian regions when the war comes to an end. Therefore, it is first necessary to understand why Telegram comments were chosen as part of Russia’s information strategy in that region.

Russian practices of information influence in occupied Ukraine

Russia’s attempts to create a tailored and easily controlled information environment in occupied areas of Ukraine began almost immediately after launching its full-scale invasion of Ukraine in February 2022. This included launching Telegram channels targeted at specific occupied territories. Some positioned themselves as official or unofficial local news channels, while others were led by influencers and officials on the ground. A 2022 Texty data investigation found that channels were created for every occupied township and community, posing as local news sources but predominantly spreading Russian disinformation narratives and propaganda. While some of these hastily assembled channels were later abandoned, the general Russian strategy of using Telegram to propagandize every district in the occupied territories persisted. The imitation of local news sources is a tactic used to make the channels appear credible and foster trust with audiences, thereby enhancing the potential impact and persuasiveness of pro-Kremlin narratives.

By 2023, the Telegram ecosystem in the occupied territories had grown to over six hundred channels, according to OPORA’s follow-up analysis. That year, the ecosystem expanded to include channels for administrative entities, local organizations, and individuals, as well as for trading goods and services. A key commonality across these channels was the tendency to venerate the pro-Kremlin occupation administration while simultaneously sharing disinformation, misinformation, or general negative messaging about the Ukrainian government. Acting within the larger framework of a controlled information environment, these Telegram channels enabled administrators to tap into additional audiences while disseminating a more cohesive propaganda narrative aimed at uplifting Russia and undermining Ukraine.

In addition to Telegram, regional pro-Kremlin ministries of information operated and curated other social media groups and traditional local news outlets soon after the occupation of eastern and southern Ukraine. These ministries are managed under a centralized system, ultimately receiving high-level tasking from the Kremlin. Russia established centralized media control in the occupied regions through a gradual, non-linear process, which started in 2014 after the annexation of Crimea and the formation of the so-called Donetsk and Luhansk People’s Republics (DPR and LPR). The DPR and LPR were the first occupied territories where control was implemented through information ministries and media holding companies such as Republican Media Holding and Luganmedia. Thus, the creation of information ministries and regional media holdings ensured that local media operated at the Kremlin’s behest.      

These new information ministries emerged with varying levels of activity. For example, they were highly active in occupied Kherson but mostly symbolic in occupied Zaporizhzhia. Russian First Deputy Chief Sergey Kirienko oversaw information policy in occupied territories, while Russian propagandist Alexander Malkevich served as a key operator by connecting local collaborators with Russian media resources, recruiting Ukrainian youth for media projects, and rapidly establishing new television channels. Malkevich created three stations in just three months: Tavria TV in Kherson (later relocated to Henichesk), Za! in Melitopol (now part of the media holding ZaMedia), and Mariupol 24.

Why comments?

In the context of wide-ranging attempts to control the information environment, inauthentic comments, including those published by automated means, serve as a means to manipulate the perception of public opinion within the occupied territories, an aspect of computational propaganda referred to as “manufacturing consensus” by Samuel Woolley. A high volume of comments expressing a certain viewpoint can create the impression that it represents the majority opinion in a community, regardless of whether that is actually the case. There is evidence to suggest that online comments can shape users’ opinions during crises, and that the prevalence of a certain view in existing comments can empower users with similar views while discouraging others from expressing contrary views. Inauthentic comments powered by bots thus become an important tool for implementing Russian propaganda.

These are particularly desirable effects for an occupying authority, as it is in its interest to control the local population’s perception of events and encourage support for the occupation. As Russia looked to consolidate its control over occupied Ukrainian territory, automated pro-Russian comments in local chats became a tool for manufacturing consensus in support of Russian control and against any expression of dissent.

While dedicated pro-Russian channels also served these aims, bot commenters have several practical advantages on Telegram, which has no home feed where users can easily encounter content from unfamiliar channels. Rather than having to build their own audience and persona, bot commenters simply insert themselves into existing channels with active participants. Bot commenter accounts are also relatively disposable assets; they are easy to create and replace if detected and deleted by Telegram.

Methodology

To analyze how Russia attempts to control public perception and opinion in occupied Ukraine, OpenMinds and the DFRLab used the Telegram API via the Telethon library to collect an initial dataset of 2.9 million comments posted between January 1, 2024 and April 1, 2025 in 110 Telegram channels. The initial set of 110 channels was drawn from a broader list of information-focused Telegram channels operating in occupied regions—primarily in Kherson, Zaporizhzhia, and Donetsk (with an emphasis on Mariupol), as well as a smaller number of channels associated with Kharkiv, Odesa, and Mykolaiv. The two key criteria for including channels in the dataset were the presence of open comment sections at the time of data collection and a clear association with an occupied city or region, either through the channel’s stated location or its role in representing official figures or occupation authorities. In this dataset of 2.9 million collected comments, 96,684 comments were identified from 3,634 accounts exhibiting consistent bot-like behavior, such as posting unusually high numbers of comments or repeatedly posting identical comments, especially across multiple accounts. A more detailed description of indicators of bot-like behaviors can be found in the next section.

To better examine how these accounts behaved, the dataset was broadened to include other channels where the accounts were active. Further comments made by these accounts were retrieved from an archive of 4,500 additional Telegram channels provided by the TeleZip project, expanding our total dataset to approximately 3.37 million comments. OpenMinds then manually identified and mapped an additional 144 channels, representing all occupied regions, including those under long-term occupation (Crimea, Luhansk, and Donetsk), in an expanded dataset. This resulted in 316,790 bot comments from channels associated with occupied territories on which to conduct analysis.

To better understand the narratives disseminated by these bot accounts, the authors analyzed the comments to identify recurring themes through a combination of automated and manual methods. By applying the topic modeling framework BERTopic to the initial set of bot comments from the initial 110 channels, the authors identified a preliminary set of thematic topical clusters. These clusters were then manually refined and consolidated to merge semantically similar groupings, resulting in a final typology of sixty-nine distinct narrative themes (see appendix).

To ensure robustness, the authors manually annotated a stratified random sample of 3,450 comments from the originally identified 110 channels, comprising fifty comments per topic as labeled by a trained classifier. This annotated subset served as the foundation for further classification of the full dataset. Additional comments were categorized using a combination of keyword matching and GPT-4-assisted classification, based on prompts crafted from the manually labeled examples. These methods allowed for nuanced detection of topic boundaries and the ability to recognize paraphrased or subtly framed versions of the same narratives. Quality-control steps were implemented throughout, including iterative prompt tuning and manual validation checks to minimize false positives and thematic drift.

In parallel, the authors manually labeled the 3,450 comments to indicate whether or not they contained explicitly pro-Russian content, defined as messages expressing positive propaganda in support of Russia. This binary annotation of pro-Russian vs. non-pro-Russian was used to fine-tune an additional classifier based on the cointegrated/rubert-tiny2 model, which was then applied to the full dataset of 3.37 million comments to distinguish between comments containing pro-Russian propaganda and those that did not. The classifier demonstrated strong performance, with an overall F1 score of 0.96. (A model with perfect precision and recall will have an F1 score of 1.00.)

Indicators of bot-like activity

Accounts exhibiting bot-like behavior were identified through a combination of inauthentic characteristics in account activity and appearance.

One of the best initial indicators of a potential bot is a very high volume of account activity. While being an active commenter does not necessarily guarantee that an account is automated, the higher the volume of comments made by an account, the greater the likelihood that it is automated. Seven observed accounts posted more than 1,000 comments in a single day, for example, yet their user IDs did not appear in the investigated dataset, suggesting the comments may have been de-platformed by Telegram. While there is no way to confirm this, Telegram does detect and block new accounts with suspicious or unusually high activity patterns, forcing network operators to continually generate new accounts.

We observed at least two waves of bot removals and subsequent account regeneration in the dataset:

• April 8-10, 2024: 208 accounts showed their last activity during this period, while at least 110 new ones appeared around the same time.
• September 3, 2024: 124 accounts stopped activity on the same day. On September 5–6, 159 new accounts became active.

Graphic depicting the activity of 3,634 Telegram users identified as bots based on behavioral patterns. (Source: OpenMinds; Telegram)

Removed Telegram accounts were often marked as “deleted” on the platform, leaving only the comment itself, unless the group administrator deleted the account. Other accounts remained active, continuing to post for extended periods, or became inactive but retained their profiles for potential future use.

Screenshot of a Telegram post with bot-like amplification. Five out of six comments under this post were made by bot-like accounts promoting the narrative classified as “terrorist drone attacks on civilian infrastructure.” As of May 2025, four of the five bots had already been deleted. (Source: @nashenergodar/archive)

Bot operators must strike a balance between propagating messaging at scale and avoiding platform detection. Most of the bots that remained active were more restrained in their behavior, as it appears that posting less frequently allowed them to avoid de-platforming. Nevertheless, the bot accounts in the dataset published an average of eighty-four comments per day (median: fifty) to occupied territory-based channels.

Graph depicting the distribution of the daily number of comments for bot accounts. (Source: OpenMinds; Telegram)

Odd or inconsistent profiles are also potential indicators of inauthentic accounts. The accounts in the dataset rarely had profile photos; when they did, the picture was often inconsistent with the account name (for example, a female profile picture would appear with a traditionally male username).

Profile of a user where a female profile picture accompanies an Eastern European male name that is not traditionally used by females. Blur added. (Source: Telegram)

The names attached to these accounts frequently changed, while their usernames or handles remained the same. The usernames were typically a random string of Latin characters and numbers with no apparent meaning. This suggests the possibility of automatically generated usernames, as it would be time-consuming to create authentic-sounding usernames for thousands of accounts that would also remain consistent with the profile if the user’s persona changed.

A change in persona for user “kewalian” from female-presenting “Maria Gorbunova” on December 10, 2024 to male-presenting “Xaro. T” by May 9, 2025. Aside from this change, the account has been dormant since October 20, 2024. (Source: kewalian, left; kewalian/archive, right)

The most common username pattern in the network applied a random combination of Latin letters, typically eight to thirteen characters in length. The DFRLab identified several usernames of this type belonging to this network (kewalian, padraysherta, juragrelat) as probable bots in a previous investigation. Other username patterns included a first name followed by random characters and numbers after an underscore, such as Renee_75nen and Calvin_62lnv, as well as combinations of names and surnames that resembled Russian names, such as Konst_Solivey and VoronovVova​​.

Graphic displaying usernames of the 250 most active accounts in the subset, many of which were characterized by seemingly nonsensical strings of characters. (Source: OpenMinds; Telegram)

While patterns in the timing of posts were once a fairly reliable indicator of bot-like activity, campaign operators have become increasingly sophisticated about concealing identifiable temporal patterns. The timing of bot comment publication in this dataset did not differ significantly from that of real users, suggesting that they were scheduled to appear active during regular daytime hours, much like authentic accounts based in the region.

Graph depicting the distribution of posting times for accounts identified as authentic versus bot accounts. For the comparison of posting time distributions, the authors used a random sample of non-bot comments from the channels represented in the dataset, equal in size to the number of bot comments. The time zone is GMT+4, Moscow time. (Source: OpenMinds; Telegram)

The average bot comment length was 120 characters, distinguishing it from authentic comments, which tended to be shorter in length. This was determined by comparing bot comments to an identically sized random sample of non-bot comments from the same channels.

A graph depicting the differences in distribution of comment length between accounts identified as authentic versus bot accounts. For comparison of comment length, the authors used a random sample of non-bot comments from the same channels, matched in size to the number of bot comments. (Source: OpenMinds; Telegram)

Artificial narratives

The primary characteristic of the accounts was their narrative-driven messaging. These narratives were crafted to promote a unified message of a strong and successful Russia and a corrupt Ukraine that had forgotten about its people within the occupied regions. Unlike social media bots that sometimes leverage large language models (LLMs) to engage in ideological debates with real users in comment sections, these bots spread predefined narratives through isolated, individual comments that did not engage with other commenters. These were intended to craft and curate the appearance of general consensus without provoking contradictory responses from other commenters.

At the time of publishing, automatically identifying bots through identical messages is becoming increasingly difficult; LLMs are often used to rewrite a single message and turn it into hundreds of unique variations. Still, the core idea and narrative remain the same, and these messages often repeat the same patterns, allowing for the identification and tracking of general posting trends.

In the channels from the occupied territories, out of the 316,000 comments left by bots, approximately one-third (106,598) were unique.

Using LLMs to rewrite comments to make them unique can sometimes work against bot operators, as generative AI sometimes makes mistakes, resulting in unusual phrasing, as shown in the table below.

While on the surface, many of the comments formed complete sentences that made grammatical sense, their context was often absurd, or even telling, as some comments inadvertently ended up being anti-Russian in nature. At the same time, other comments made little sense to a human reader and presented a slightly more organized jumble of words with limited cohesive meaning. While some mistakes and inconsistencies could be attributed to language barriers, the clear use of grammar alongside mistakes in meaning suggests a high probability that the comments were not made by a human, with the errors more consistent with an incorrect machine interpretation that was never proofread. Occasionally, these comments promoted the same link, leading to Russian media articles favorable to Russia or reiterating Russian propaganda. The duplication of these links in the comments was likely intended to gain visibility for the articles and redirect users to popular Russian online news outlets, such as Izvestia, RIA Novosti, or RBK. Notably, a significant number of comments also redirected towards articles in the New York Times, potentially attempting to add validity to the comments themselves by including a mainstream Western source.

A graphic displaying the top ten websites linked in the identified bot comments. (Source: OpenMinds; Telegram)

Narrative themes

Pro-Russian vs anti-Ukrainian propaganda

All the bot comments could be divided into three mutually exclusive narrative categories:

1. Positive propaganda promoting Russia and its government;
2. Hostile anti-Ukrainian propaganda—including narratives that portray Ukraine as a failed state, personal attacks on Ukrainian President Volodymyr Zelenskyy, and accusations of terrorism, among others;
3. Neutral messages ranging from comments with emojis only, to neutral statements about the horrors of war and the need for peaceful coexistence between nations (without directly pushing pro-Russian narratives).

Pro-Russian propaganda

Pro-Russian propaganda narratives ranged from general praise of the country’s leadership, economy, or military to more localized messages about improvements made by specific politicians or political parties.

This category can be roughly divided into two subsets. The first is general pro-government content found across various Telegram channels, including support for Putin, admiration for the Russian army, discussions of national unity, and mentions of Russia’s strong diplomatic ties with countries such as India and those in Africa. The second type is more specific to the occupied territories and focuses on local issues, including repairs to infrastructure, access to medicine, reconstruction efforts, the work of local administrations, quality of mobile connectivity, and support for curfews. These narratives aimed to portray life under Russian control as improving and to highlight the state’s active assistance to people in the region.

When isolating the share of pro-Russian narratives among all comments, the accounts promoted this type of messaging almost twice as often in occupied territory channels as in other channels where the bot accounts were also active.

A graph depicting the percentage of pro-Russian messages on occupied territory channels as opposed to other channels on which they were active. (Source: OpenMinds; Telegram)

The ratio of pro-Russian to other types of comments was inconsistent over time. In March and April 2024, the bots sharply increased the number of messages positively boasting about various aspects of the occupation administration and life under occupation. In contrast, the share of propaganda promoting positive messages on other Telegram channels within Russia also grew, but not as dramatically.

A graph depicting the dynamics of posts containing pro-Russian messaging on occupied territory channels as opposed to other channels. (Source: OpenMinds; Telegram)

One reason for this discrepancy can be attributed to a separate group of accounts created specifically to target the occupied territories and promote pro-Russian narratives. This group is clearly visible on the chart below, clustered in the upper-right quadrant, characterized by a high share of comments in occupied territory channels and a larger proportion of positive pro-Russian propaganda content. These bots were predominantly active in the occupied territories, and their comments primarily focused on pro-Russian propaganda.

A graph depicting clusters of bot accounts containing pro-Russian messaging on temporarily occupied territories (TOT) channels. (Source: OpenMinds; Telegram)

The accounts promoting pro-Russian narratives shared one key feature with the rest of the bot network: a high volume of comments aimed at discrediting Zelenskyy. Overall, though, their messages were more focused on pro-Russian propaganda rather than explicitly anti-Ukrainian rhetoric.

Alongside the emergence of this new group of bots, new themes began to appear in a coordinated manner starting in early April 2024. Some of the recurring themes included the restoration of water, electricity, and gas services, as well as infrastructure repairs and upgrades, and the creation of job opportunities for local residents.

A collection of graphs depicting the dynamics of daily posts from bot accounts promoting the top 20 identified pro-Russian narratives. (Source: OpenMinds; Telegram)

Anti-Ukrainian and anti-Western comments

While pro-Russian messages showed a fair degree of variety, anti-Ukrainian messages concentrated on a few key themes. Nearly fifty thousand comments—almost every sixth comment—mentioned Zelenskyy, using typical narratives from Russian propaganda ranging from personal attacks and accusations of corruption or drug use to claims of illegitimacy or tyranny.

Beyond Zelenskyy, the anti-Ukrainian comments also promoted broader hostile narratives, most notably accusations of Nazism and extreme Ukrainian nationalism. However, this particular narrative gradually declined in frequency over time, suggesting either a shift in messaging priorities or a reduction in effectiveness.

A graph depicting the dynamics in the number of daily comments from bot accounts promoting the narrative accusing Ukraine of Nazi ideology. (Source: OpenMinds; Telegram)

Accusations of terrorism, shelling of civilians, and deliberate provocations were also common, all serving to delegitimize Ukraine’s leadership and shift blame for the war onto Ukrainian actions.

Anti-Western messaging, meanwhile, targeted broad entities such as the West and specific countries, including the United States and the United Kingdom. Bots frequently accused Western governments of fueling the war for their gain by profiting from arms sales while sacrificing Ukrainian lives. NATO was framed as a hostile bloc, while politicians like former UK Prime Minister Boris Johnson or figures like Elon Musk were mentioned to reinforce the idea that the West, not Russia, was the actual aggressor. Together, these narratives created a dual image of Ukraine as a reckless proxy and the West as a cynical puppeteer.

Examining the most frequently mentioned names in bot-generated comments revealed a clear pattern. After Zelenskyy and Putin, the majority of references were to foreign politicians seen by Russia as adversarial. Figures such as former US Secretary of State Antony Blinken, Johnson, former US President Joe Biden, and US President Donald Trump appeared regularly, often in the context of blaming the West for escalating the war or exploiting it for geopolitical or economic gain.

A graph depicting the top 10 most frequently mentioned public figures in bot comments. (Source: OpenMinds; Telegram)

Mentions of historical or ideological figures such as Stepan Bandera were also common, typically used to reinforce narratives about Ukrainian nationalism or Nazism. Meanwhile, Ukrainian officials like Mykhailo Podolyak or Oleksiy Danilov were targeted as representatives of what the bots framed as a deceitful or extremist regime. Overall, the prominence of these names highlights how the bots utilized recognizable individuals to personalize the narratives and enhance emotional engagement with broader propaganda themes, as these individuals and figures from the current Ukrainian presidential administration could be perceived as enemy entities or symbols of larger societal issues.

In contrast, pro-Russian propaganda was far less personalized. With the notable exception of Putin, who was consistently praised in comments for his leadership, stability, and support for the occupied territories, such messaging rarely revolved around specific individuals. Instead, it tended to highlight institutions, infrastructure, or abstract notions like national strength and unity.

Active vs. reactive propaganda in Russian vs. occupied channels

Reactive propaganda in Russia-focused channels

To better understand Russia’s broader strategy of using bots for information influence, we analyzed the activity of the same accounts across 4,500 additional Telegram channels that were primarily based in Russia.

Broadly speaking, these bots adapted their messaging to align with specific political events and dates, such as increasing their activity ahead of Putin’s re-election, on the anniversary of the full-scale invasion, or after the terrorist attack at Russia’s Crocus City Hall.  

A graph depicting the number of messages of identified bot accounts on Telegram on a daily basis across the broader dataset. (Source: OpenMinds; Telegram)

An example of event-driven messaging occurred following the launch of a Ukrainian offensive in the Kursk region in the summer of 2024. During this time, the bots active in Russia-based channels suddenly began praising the Russian government’s support for local residents. As shown in the graph below, messaging activity from pro-Kremlin bot accounts rose sharply in late July and remained elevated for weeks. These accounts deployed a coordinated campaign to project calm, reinforce trust in the authorities, and depict an effective state response, highlighting themes such as emergency payments, access to medicine, and medical institutions functioning as usual.

The messaging was emotionally reassuring and politically strategic: users were told not to panic, and that regional officials were doing everything possible to support residents. This narrative technique, aimed at defusing public anxiety and shielding the regime’s image during moments of perceived vulnerability, mirrors Russia’s broader information tactics in occupied Ukrainian territories, where bots similarly promote a sense of normalcy and state competence in the midst of disruption.

A graph depicting bot activity over time on all channels promoting the narrative of Russia aiding residents of the Kursk region. (Source: OpenMinds; Telegram)

A similar pattern emerged after the terrorist attack at Russia’s Crocus City Hall in March 2024. Bot accounts active in Russia-based channels rapidly mobilized around keywords related to the event, flooding comment sections with praise for Russian security services and shifting blame onto Ukraine. This swift, coordinated reaction aimed to frame the Kremlin as both capable and under threat, deflecting responsibility while reinforcing narratives of external aggression.

Another topic that emerged in direct response to external events was the official accession of Sweden and Finland to NATO. Bots began downplaying the move as a threat to Russia, emphasizing that it was less provocative than the potential accession of Ukraine. Their argument typically emphasized that joining NATO was not inherently dangerous; what mattered, they claimed, was whether NATO military bases would appear on that country’s territory. Although Finland joined NATO in April 2023 and Sweden in March 2024, bot comments consistently referenced both countries together as part of the same narrative.

A graph depicting the dynamics of the number of messages over the whole monitored period that include narratives about Sweden and Finland joining NATO. (Source: OpenMinds; Telegram)

An additional example is a wave of comments praising Russia’s alleged success in combating corruption. Notably, this narrative effectively went dormant during the period before and after Putin’s re-election, further illustrating a degree of strategic coordination behind these messages.

A graph depicting dynamics of number of messages over the whole monitored period that include narratives praising Russian anti-corruption efforts. (Source: OpenMinds; Telegram)

Narrative campaigns in the occupied territory channels

In the occupied territory-based channels, however, the overall dynamics differed from the Russia-wide pattern. Aside from the anniversary of the invasion, most activity spikes were tied to the launch or intensification of a specific information campaign or narrative.

A graph depicting the daily volume of posts from pro-Russian bot accounts to channels identified as operating in the TOT. (Source: OpenMinds; Telegram)

One of the spikes in occupied territory bot activity occurred in early March 2024, when the bots amplified apocalyptic narratives about an impending World War III. These messages were filled with alarmist language and existential warnings (“the clock is ticking,” “if it happens, no one will be left alive”), framing Russia as a reluctant but prepared actor on the global stage. At the same time, the bots revived the long-running narrative blaming Ukraine and the West for the collapse of the Minsk agreements. The comments portrayed Russia as the only party genuinely interested in peace, repeatedly accusing Ukraine of ignoring ceasefire commitments and framing Western support as duplicitous. By merging two narratives—global catastrophe and betrayed peace accords—the bots sought to position Russia as both a victim of international hypocrisy and the last defender of global stability. Below is an example of one such message that was shared 103 times by different bot accounts across different occupied territory channels.

Another visible peak came at the end of May 2024, coinciding with a surge in coordinated praise for Putin. Bots across occupied territory channels launched a campaign portraying residents of the so-called “new Russian regions” as deeply grateful to the Russian president. Commenters repeated variations of the same message: Putin had “done so much” for the occupied territories, brought them “into a strong and modern state,” and was “widely respected” by locals. The example below depicts a message shared by account @RareHandleHub on an occupied territory channel, with the message itself duplicated thirty-three more times across different channels.

Some narratives, which may have initially appeared to be reactive responses to specific problems or disruptions, have become persistent fixtures due to the enduring nature of these issues. A notable example includes repeated comments about restoring electricity, gas, and water supplies. Many occupied regions continue to suffer from serious infrastructure problems; the bots appear to be aimed at easing public frustration and managing tension with the occupying administrations.

Graphs depicting dynamics of number of messages over the whole monitored period that include narratives about restoring water supply (top) and electric and gas supplies (bottom) to occupied territories. (Source: OpenMinds; Telegram)

A case study in high-impact bot messaging

A Telegram account with the username @nieucqanoberr offers a clear illustration of how short-lived yet high-impact bot activity works. The account was active for just one day—May 11, 2024—during which it published 1,391 comments across sixty-five Telegram channels and chats, including twenty-nine messages in occupied territory channels. Its activity continued from 09:49 to 23:47 Moscow time (GMT +4), averaging one comment every thirty-six seconds.

Unlike simplistic bots that spam identical messages, this account adapted its content to the context of each conversation. It pushed various narratives while responding to previous messages and tailoring its replies to reinforce pro-Kremlin talking points. As a result, it did not focus on a single topic; instead, its comments touched on forty different themes from the sixty-nine thematic categories identified in our analysis (see appendix). Roughly four hundred messages were classified as pro-Russian propaganda, while nearly one thousand were either anti-Ukrainian or neutral. Notably, 24 percent of the comments mentioned Zelenskyy, often in a critical or mocking tone.

The chart below shows a timeline of the account’s activity across the twenty Telegram channels and the chats where it was most active. Each dot represents a published comment, illustrating not only the intensity of the account’s posting but also its near-continuous engagement throughout the day.

A graph depicting the dynamics of all 1,224 comments made by one bot over twenty Telegram channels in a span of one day. (Source: OpenMinds; Telegram)

Highly active accounts, such as @nieucqanoberr, were often quickly removed, offering a small sign of Telegram’s efforts to de-platform coordinated disinformation, although their removal came only after thousands of messages had already been posted.    

Conclusion

Russia’s manipulation of the information environment as a tool of occupation and its assumption of control over telecommunications services make it difficult for people in occupied Ukraine to receive factual information and retain their connections with the outside world, increasing their potential susceptibility to pro-Kremlin propaganda. As Ukraine and Russia circle a possible peace agreement, one of the key issues remains the control of these regions. Manufacturing an artificial consensus in favor of Russia on social media and messaging platforms could serve as a justification for Russian control of the occupied regions.

The active spread of pro-Russian and anti-Ukrainian narratives on a popular platform like Telegram is yet another way for Russia to ensure it is capturing the attention of as many occupied Ukrainian residents as possible, making its propaganda insidious and unavoidable. The use of bots makes these messages easier to spread, allowing for mass spamming in channels used by locals on a daily basis. While we have seen efforts by Telegram to de-platform bots and limit inauthentic activity, Russia’s ability to continue creating new accounts shows the limitations of these actions, given the persistent creation of bots.

This also creates an additional complication for Ukrainian authorities in their attempts to reach their citizens in occupied territories and provide them with accurate and up-to-date information about the war and possible peace negotiations. With many bots operating within groups and channels used by people in occupied Ukraine, there is a need to identify ways of mitigating their potential negative influence on the general population.   

Yuliia Dukach, PhD, is head of disinformation investigations at OpenMinds. She is an expert in disinformation research with over five years of experience in
investigative data journalism, applying advanced skills in Python and machine learning to analyze computational propaganda and online misinformation.

Iryna Adam is a research associate at the Atlantic Council’s Digital Forensic Research Lab. Adam researches disinformation centered around weapons of mass destruction, with a focus on Ukraine, Russia, and Eastern Europe. 

Meredith Furbish is a visiting researcher at the Atlantic Council’s Digital Forensic Research Lab.  Her work focuses on synthesizing qualitative and quantitative methods to investigate Russian propaganda and information manipulation.

Layla Mashkoor, deputy director of research at the Atlantic Council’s Digital Forensic Research Lab

Sviatoslav Hnizdovskiy, CEO and founder of OpenMinds

OpenMinds is a cognitive defence tech company countering authoritarian influence in the battle for free and open societies. OpenMinds works with over 30 governments and organizations worldwide, including Ukraine, the UK, and NATO member governments, leading StratCom agencies, and research institutions.

The Atlantic Council’s Digital Forensic Research Lab (DFRLab) has operationalized the study of disinformation by exposing falsehoods and fake news, documenting human rights abuses, and building digital resilience worldwide.

learn more

The Eurasia Center’s mission is to enhance transatlantic cooperation in promoting stability, democratic values and prosperity in Eurasia, from Eastern Europe and Turkey in the West to the Caucasus, Russia and Central Asia in the East.

Learn more

Appendix A: Full list of narrative themes

Related Experts: Iryna Adam

Image: Photo by Max Kukurudziak on Unsplash