A «Telegram Empire» run by Russian intelligence during the big war

Detector Media started researching anonymous Telegram channels back in 2020. It was already then that a number of anonymous Telegram channels stood out in terms of their rhetoric favouring Russia. Frequency with which these channels quote each other, as well as simultaneous promotion of the same messages by them indicates close links between them, as well as their centralized management. Moreover, descriptions of these channels sometimes contain references to the same manager, who can be contacted for ad placement. In February 2021, cyber specialists at the Security Service of Ukraine uncovered a large-scale agent network working for Russia's intelligence agencies. The Service claims that over a dozen anonymous Telegram channels focusing on politics in Ukraine are working for the Russian military intelligence. Their task is to destabilize domestic political situation in Ukraine and promote messages that are favourable for the Kremlin. Therefore, Detector Media decided to analyse whether the war’s new phase reflected on the rhetoric of the GRU-run channels, the volume of their audience, as well as their significance in the Ukrainian segment of the Telegram.

Which channels of the Ukrainian segment of Telegram does the SSU consider hostile?

Such channels may be roughly divided into national (since they focus on the national agenda with an emphasis on central authorities) and regional ones (these mainly focus on certain cities, although from time to time they cover the national political situation, too). The first of these categories includes such popular channels as “Legitimnyi” (“Legitimate”), “Resident”, “Cartel”, “Splentitsa” (“Gossip Girl”), “Chornyi Kvartal” (“Black Quarter”) and “Politicheskiy Rasklad” (“Political Landscape”). The second one includes “Netipichnoye Zaporozhye” (“Non-mainstream Zaporizhzhia”), "Trempel Kharkov”, “Odesskiy frayer” (“Odessa shill”), “Dnepr Live”, “Nikolaev Live” and "”Kherson Live”.

Although for the purposes of this study we only focus on channels from the SSU list, a preliminary analysis of Russian disinformation on Telegram indicates that the network is much wider. “Sheptun” (“Whisperer”), “ZeRada” (“ZeCouncil”), “Zhenshchina s kosoy” (“Woman with a Plait") and many other anonymous Telegram channels regularly disseminate Russian disinformation and quote each other.

Did the GRU-run Telegram channels continue operation after February 24?

Yes, the national Telegram channels continued their operation. Moreover, during the first weeks of the big war the number of posts published thereon increased significantly. Notwithstanding the fact that such channels do not usually publish news, rather specializing on dissemination of inside information, speculative analysis of the domestic political situation and political forecasts, they published updates from the frontline during the first weeks of the war.

Some channels of the regional network resumed their operation after having previously suspended it: “Krivoy Rog Online”, “Nikolaev Live” and “Kherson Live” simultaneously stopped posting updates on July 7, 2021, while “Trempel Kharkiv” and “Dnepr Live” did so on ​​July 21, 2021. “Netipichnoye Zaporozhye” followed on September 13, 2021. “Kherson Live” was the first one to revive in April 2022, followed by two more, “Krivoy Rog online" and “Nikolaev Live,” in early June.

Has the popularity of the GRU-run Telegram channels increased since the beginning of the big war?

Yes, almost all channels have gained more audience, but the growth rates differ significantly. For instance, “Resident” and “Legitimnyi” have increased their audience 2,5–fold between February 24 and June 9. Some regional channels saw only a dozen new followers in the same period of time.

Although most Telegram channels have seen a significant growth of audience in the three months that have passed since the start of the war’s new phase, there are grounds to believe that some of their followers are bots. It is impossible to check if followers on Telegram are bots, since the platform does not reveal the list of profiles following a channel. However, one can judge about the authenticity of a channel’s popularity based on other indicators, like, for instance, the dynamic of subscriber growth. Thus, against the backdrop of the natural increase of their audience, some Telegram channels managed by Russia’s intelligence agencies have seen major surges in the number of new followers. One of these happened on May 2, when 50 thousand new subscribers followed the “Legitimnyi” channel. However, there were far fewer posts on the channel that day than usual, and all of them had to do with widespread manipulations: “Ukraine's partition by neighbouring countries,” “Ukraine is engaging Transnistria in war” and “cessation of arms procurements.” In other words, there were no exclusive or viral posts that could provoke a surge in the number of followers. Hence, we can assume that Telegram channels increase their audience at the expense of bots rather than real users.

Interestingly, surges in the number of new followers are synchronized between channels. For instance, there were simultaneous surges in the audience of such channels as “Legitimnyi,” “Resident”, “Spletnitsa” and “Cartel” on March 15-18 and May 13-18. That is to say, the number of new followers the mentioned channels saw was two or three times bigger than the one they usually see. Also, all these channels, except for “Resident”, did not see a single new follower on March 4, although citation rates of the channel’s posts that day were higher than usual. A similar simultaneous decrease took place on April 6-10.

Things are even more obvious with the regional Telegram channels managed by Russian intelligence services. “Krivoy Rog Online”, “Nikolaev Live” and “Kherson Live” simultaneously stopped posting updates on July 7, 2021, while “Trempel Kharkiv” and “Dnepr Live” did so ​​on July 21, 2021. The channel “Non-mainstream Zaporozhye” lasted a little longer and published its last post on September 13, 2021. Both the growth and decrease of these channels’ audience was quite dynamic. Of all these channels, “Kherson Live” was the first one to revive on April 7, 2022. On that same day there was a surge in the number of its followers. Two more channels, “Krivoy Rog online” and “Nikolaev Live” came to life in early June. It is noteworthy that their audience had grown a little earlier, on May 15-17 (i.e. simultaneously with that of such channels as “Legitimnyi,” “Resident,” “Spletnitsa” and “Cartel”). At the same time, “Odesskiy Frayer” was the only Telegram channel in the regional network that did not stop its operation. There was only one surge in the number of its subscribers, on April 24. However, this can be attributed to the fact that on April 23 the Russian military launched a missile attack on Odesa, resulting in the death of eight people, including a three-month-old child and a media worker, as well as 18 wounded.

Has the rhetoric of the GRU-run Telegram channels changed since the start of the big war?

During the first days of the big war, the channels tried to be neutral, meaning that their coverage was pro-Ukrainian and did not contain any blatantly pro-Russian appeals. Despite the fact that these channels did not condemn Russia's full-scale invasion of Ukraine directly, they continued to pretend to be of Ukrainian origin – for instance, by often using wordings like “our troops.” Hence, some may have got an impression that these Telegram channels had switched to the Ukrainian side.

The one exception is “Kherson Live” that, unlike other channels, does not simulate being a Ukrainian channel. Its content is similar to that of other channels created by the occupants since the beginning of the war’s new phase.

However, don’t get too excited too soon. After almost a week of relative neutrality, these Telegram channels gradually resumed dissemination of disinformation and conspiracy theories. At first, they actively published photos and videos from the frontline, but often added manipulative wordings such as “This is claimed to have been done by Russians, but we cannot confirm it.” They also actively speculated on the issue of blasted bridges, implying the question about who was going to rebuild them. Stories discrediting the government and particularly Zelensky followed, as did efforts to discredit Ukraine’s armed forces and territorial defence. It was no later than in March that the usual conspiracy theories about “external governance” came back. One can see that the extent of disinformation is growing every week. In June, the entire network has resumed dissemination of “rumours” and “landscapes” filled with Russian misinformation.

Another topic stood out among reports on Russia’s war against Ukraine, namely the coronavirus epidemic. Fakes and manipulations about the coronavirus disease were especially common on the “Spletnitsa” channel. They usually had to do with vaccination and its supposedly “terrible consequences.” Later, the channel started covering monkeypox-related issues, too. Authors of these publications did not try to embed them into the context of the war (although Russian media have indeed disseminated a fake about the US having allegedly “been developing viruses, including monkeypox, at Ukrainian biolaboratories”). Most of them were about “conspiracy” of governments, pharmaceutical companies, etc.

What kind of disinformation are the GRU-run Telegram channels spreading now?

Detector Media has collected key disinformation messages disseminated by the GRU-run Telegram channels. It is worth noting that some messages contradict each other, which is fairly common for Russian disinformation.

• “The West has abandoned Ukraine”. Like all these years, Russian propaganda keeps demonizing Ukraine's partners, using both the old messages (“The West is trying to reach an agreement with Russia,” “The West wants to force Ukraine to make concessions,” “Ukraine is a tool to fight Russia,” “No one expects Ukraine in the EU”, etc.) and some new ones that have emerged during the war. They were predominantly employed with regard to the issue of weapons to insinuate that partners do not help Ukraine, delay the process of arms provision or provide Ukraine only with bad and old weapons. Among other things, the channels covered debts that “the West does not want to write off.” These attacks were aimed at the EU as a whole, while the US, Great Britain, Turkey, Moldova and Georgia were mentioned separately. At the same time, France was mentioned quite softly in this context, if at all.
• “Sanctions do not work” or “The West is easing sanctions”. Russia has been trying to downplay sanctions for the past eight years: it has been squashing cheese with tractors and buying seafood from Belarus. In 2022, history repeats itself, but without the mentioned “special effects”. In Russia, they are once again talking about the alleged ineffectiveness of sanctions or that they are “detrimental to the West, so it is going to ease them” (here comes the issue of gas). This is done by everyone, starting from junk media all the way to political leadership. However, at the end of the day this message is aimed not at Ukrainians, but rather at Russians – these latter are the ones that need to be convinced. It ends up in the Ukrainian information space only from time to time to reinforce the previous message or create the illusion of Russia’s “invincibility”(more on this below).
• “Partition of Ukraine” by neighbouring countries. This message is particularly about the alleged plans of Poland and Lithuania to “snatch a piece of Ukraine’s territory,” with Romania and Hungary being mentioned in this respect more rarely. Russia has been promoting this message for a long time, but it reached its peak in April 2022. The more often the authorities of neighbouring countries criticized Russia or supported Ukraine, the more actively this message was disseminated. After all, almost every move made by Poland – be it a statement by Duda or a bill for the provision of aid to Ukraine - becomes an occasion for Russian propagandists to promote this message.
• Ukrainian authorities did not evacuate civilians on purpose, and where such evacuation was organized, it was ineffective. This message was promoted during the better part of spring. The channels sought to reach almost all Ukraine’s residents with it: those who could not leave during the first days or whose relatives could not get out of the cities near which hostilities had broken out. At first, the purpose of this message was to show the “unpreparedness of the authorities” for the war; later it evolved into one of the main “arguments” that “the government has abandoned the people.” In order to discredit the authorities, the channels also disseminated fakes about Zelensky’s having allegedly taken his family abroad, as well as inflated the issue of “the elites’ departure” in general. Moreover, in cities where fighting intensified, the channels tried to discredit not the government but the military. For instance, in Mariupol, Azov was accused of allegedly disrupting the evacuation of civilians. These messages were later used to spread fakes about civilians being allegedly "used as a “human shield”
• Glorification of collaborators. This message was disseminated in contradiction to the opposite one. Parallels were sometimes drawn and a failed evacuation was sometimes compared with the occupation of small towns, which had allegedly taken place “without casualties.” Heads of villages or communities were used for such cases, implying that they had “surrendered the city, but saved people.”
• “Bad Ukrainian refugees” is a new message of Russian propaganda. The issue of refugees is sensitive, so Russia manages to easily speculate on it. Manipulative elements of this message are often spread by Ukrainian users themselves, who criticize their compatriots for “bad behaviour”, “impoliteness”, “fastidiousness,” etc. It is these exact words that Russia and the Telegram channels controlled by it resort to. In contrast, they promote a message that "”the West treats Ukrainian refugees badly,” implying that “excessively bureaucratized countries provide bad conditions for Ukrainians, thus forcing refugees to return home.”
• “Despotism of Territorial defence”. This topic was actively promoted during the first months of war. At first, there were attempts to persuade Ukrainians not to join territorial defence, because “then you will stop being civilians and get yourselves killed,” as well as calls “not to die because of politics.” Then intimidation of civilians followed: “Weapons have been distributed to every Tom, Dick and Jerry – and they will kill you.” Finally, there were attempts to refocus anger from the Russian military to territorial defence fighters. This was achieved with fakes about alleged looting committed by territorial defence fighters or attribution to these latter of crimes committed by occupants.
• To demoralize Ukrainians, the following messages are also disseminated: “Russia is stronger, so Russia will win,” “Ukrainian authorities lie about victories,” “Ukraine runs out of everything,” “Ukrainian government has given away all grain,” “Ukrainian authorities sell procured weapons,” “No new weapons will be provided to Ukraine because the military do not know how to use them.” All of them are aimed at promoting disappointment so that Ukrainians do not see the point in resisting. The danger of such messages is that they imperceptibly find their way into dinner table conversations. Naturally, people get tired of war, even if they are far from the frontline. Such messages increase that fatigue, confusion and uncertainty.

Who has quoted the “GRU-run Telegram channels”?

After the launch of Russia’s full-scale military invasion, the amount of times that the Telegram channels managed by its intelligence agencies were quoted has significantly increased. The said channels had previously reposted each other’s publications or these latter had been disseminated by pro-Russian anchors from TV channels owned by Medvedchuk and Murayev (for instance, Diana Panchenko or Max Nazarov). In short, there was a kind of a network members of which re-posted each other’s posts. Starting with March, though, the situation has changed – posts from these channels have started being shared more actively than before via  channels from the occupied parts of Donetsk and Luhansk regions, as well as via newly created or rebranded channels marked with letter “Z” indicating their pro-Russian position. Simultaneously with Russia's attempts to drag Moldova into the war, contents of the “Legitimnyi” and “Resident” channels caught on with Moldovan pro-Russian groups and propagandist media (“KP Moldova”, “Sputnik Moldova”), while Telegram channels related to Transnistria saw even a bigger amount of reposts. You will recall that it was namely there that, according to Ukrainian law enforcement agencies, one of the centres for these channels’ management was situated.

What is to be done with the “GRU-run Telegram channels”?

Telegram has been one of the major sources of news consumption in Ukraine since the big war broke out, so the “Telegram empire run by GRU” may further threaten Ukraine's national security. The tactics these Telegram channels have adopted since February 24 help them disguise in the media space, since they do not contain any blatant calls for the support of Russia. Instead, there is incitement and exploitation of frustration and fatigue that are natural both for each individual and for the nation as a whole in times of war.

Telegram hardly resorts to blocking channels. Even a considerable amount of complaints from users may not always affect the platform’s decision. Attempts were made to close these channels through a Ukrainian court. Despite the fact that the court ordered blockage of access thereto, that order is technically impossible to implement, since Ukrainian providers cannot block access to a particular channel or group of channels. Only the Telegram headquarters can do that. This led to discussions about possible blockage of Telegram in Ukraine. However, since the start of the war’s new phase, the platform has been actively used by government and military agencies to communicate with the society. It is almost impossible to spread footage of most of Russia's war crimes on other social networks, as it violates their rules. Instead, Telegram is not triggered by such content, which is useful for Ukrainians, because this way both Ukrainians and foreigners are able to see shocking photos and videos.

It is important to raise awareness among Ukrainians about the Telegram channels run by the enemy. Also, even if you know that a channel is run by the enemy, but you want to consciously monitor Russian disinformation, do not follow it. Each follower contributes to the legitimization of these channels, because when a new user finds one of them he sees hundreds of thousands of followers, which, of course, adds to the channel’s influence and motivates one to follow, too.