Іра Рябоштан
Ксенія Ілюк
20.06.2022 14:00
A “Telegram Empire” run by Russian intelligence during the big war
A “Telegram Empire” run by Russian intelligence during the big war
With the launch of the full-scale invasion, the network of Telegram channels created and managed by Russia's GRU has revitalized, build up an audience and is disseminating messages of the Kremlin propaganda primarily targeting Ukrainians.

Українською текст читайте тут.

Detector Media started researching anonymous Telegram channels back in 2020. It was already then that a number of anonymous Telegram channels stood out in terms of their rhetoric favouring Russia. Frequency with which these channels quote each other, as well as simultaneous promotion of the same messages by them indicates close links between them, as well as their centralized management. Moreover, descriptions of these channels sometimes contain references to the same manager, who can be contacted for ad placement. In February 2021, cyber specialists at the Security Service of Ukraine uncovered a large-scale agent network working for Russia's intelligence agencies. The Service claims that over a dozen anonymous Telegram channels focusing on politics in Ukraine are working for the Russian military intelligence. Their task is to destabilize domestic political situation in Ukraine and promote messages that are favourable for the Kremlin. Therefore, Detector Media decided to analyse whether the war’s new phase reflected on the rhetoric of the GRU-run channels, the volume of their audience, as well as their significance in the Ukrainian segment of the Telegram.

Which channels of the Ukrainian segment of Telegram does the SSU consider hostile?

Such channels may be roughly divided into national (since they focus on the national agenda with an emphasis on central authorities) and regional ones (these mainly focus on certain cities, although from time to time they cover the national political situation, too). The first of these categories includes such popular channels as “Legitimnyi” (“Legitimate”), “Resident”, “Cartel”, “Splentitsa” (“Gossip Girl”), “Chornyi Kvartal” (“Black Quarter”) and “Politicheskiy Rasklad” (“Political Landscape”). The second one includes “Netipichnoye Zaporozhye” (“Non-mainstream Zaporizhzhia”), "Trempel Kharkov”, “Odesskiy frayer” (“Odessa shill”), “Dnepr Live”, “Nikolaev Live” and "”Kherson Live”.

Although for the purposes of this study we only focus on channels from the SSU list, a preliminary analysis of Russian disinformation on Telegram indicates that the network is much wider. “Sheptun” (“Whisperer”), “ZeRada” (“ZeCouncil”), “Zhenshchina s kosoy” (“Woman with a Plait") and many other anonymous Telegram channels regularly disseminate Russian disinformation and quote each other.

Did the GRU-run Telegram channels continue operation after February 24?

Yes, the national Telegram channels continued their operation. Moreover, during the first weeks of the big war the number of posts published thereon increased significantly. Notwithstanding the fact that such channels do not usually publish news, rather specializing on dissemination of inside information, speculative analysis of the domestic political situation and political forecasts, they published updates from the frontline during the first weeks of the war.

Some channels of the regional network resumed their operation after having previously suspended it: “Krivoy Rog Online”, “Nikolaev Live” and “Kherson Live” simultaneously stopped posting updates on July 7, 2021, while “Trempel Kharkiv” and “Dnepr Live” did so on ​​July 21, 2021. “Netipichnoye Zaporozhye” followed on September 13, 2021. “Kherson Live” was the first one to revive in April 2022, followed by two more, “Krivoy Rog online" and “Nikolaev Live,” in early June.

Has the popularity of the GRU-run Telegram channels increased since the beginning of the big war?

Yes, almost all channels have gained more audience, but the growth rates differ significantly. For instance, “Resident” and “Legitimnyi” have increased their audience 2,5–fold between February 24 and June 9. Some regional channels saw only a dozen new followers in the same period of time.

Although most Telegram channels have seen a significant growth of audience in the three months that have passed since the start of the war’s new phase, there are grounds to believe that some of their followers are bots. It is impossible to check if followers on Telegram are bots, since the platform does not reveal the list of profiles following a channel. However, one can judge about the authenticity of a channel’s popularity based on other indicators, like, for instance, the dynamic of subscriber growth. Thus, against the backdrop of the natural increase of their audience, some Telegram channels managed by Russia’s intelligence agencies have seen major surges in the number of new followers. One of these happened on May 2, when 50 thousand new subscribers followed the “Legitimnyi” channel. However, there were far fewer posts on the channel that day than usual, and all of them had to do with widespread manipulations: “Ukraine's partition by neighbouring countries,” “Ukraine is engaging Transnistria in war” and “cessation of arms procurements.” In other words, there were no exclusive or viral posts that could provoke a surge in the number of followers. Hence, we can assume that Telegram channels increase their audience at the expense of bots rather than real users.

Interestingly, surges in the number of new followers are synchronized between channels. For instance, there were simultaneous surges in the audience of such channels as “Legitimnyi,” “Resident”, “Spletnitsa” and “Cartel” on March 15-18 and May 13-18. That is to say, the number of new followers the mentioned channels saw was two or three times bigger than the one they usually see. Also, all these channels, except for “Resident”, did not see a single new follower on March 4, although citation rates of the channel’s posts that day were higher than usual. A similar simultaneous decrease took place on April 6-10.

Things are even more obvious with the regional Telegram channels managed by Russian intelligence services. “Krivoy Rog Online”, “Nikolaev Live” and “Kherson Live” simultaneously stopped posting updates on July 7, 2021, while “Trempel Kharkiv” and “Dnepr Live” did so ​​on July 21, 2021. The channel “Non-mainstream Zaporozhye” lasted a little longer and published its last post on September 13, 2021. Both the growth and decrease of these channels’ audience was quite dynamic. Of all these channels, “Kherson Live” was the first one to revive on April 7, 2022. On that same day there was a surge in the number of its followers. Two more channels, “Krivoy Rog online” and “Nikolaev Live” came to life in early June. It is noteworthy that their audience had grown a little earlier, on May 15-17 (i.e. simultaneously with that of such channels as “Legitimnyi,” “Resident,” “Spletnitsa” and “Cartel”). At the same time, “Odesskiy Frayer” was the only Telegram channel in the regional network that did not stop its operation. There was only one surge in the number of its subscribers, on April 24. However, this can be attributed to the fact that on April 23 the Russian military launched a missile attack on Odesa, resulting in the death of eight people, including a three-month-old child and a media worker, as well as 18 wounded.

Has the rhetoric of the GRU-run Telegram channels changed since the start of the big war?

During the first days of the big war, the channels tried to be neutral, meaning that their coverage was pro-Ukrainian and did not contain any blatantly pro-Russian appeals. Despite the fact that these channels did not condemn Russia's full-scale invasion of Ukraine directly, they continued to pretend to be of Ukrainian origin – for instance, by often using wordings like “our troops.” Hence, some may have got an impression that these Telegram channels had switched to the Ukrainian side.

The one exception is “Kherson Live” that, unlike other channels, does not simulate being a Ukrainian channel. Its content is similar to that of other channels created by the occupants since the beginning of the war’s new phase.

However, don’t get too excited too soon. After almost a week of relative neutrality, these Telegram channels gradually resumed dissemination of disinformation and conspiracy theories. At first, they actively published photos and videos from the frontline, but often added manipulative wordings such as “This is claimed to have been done by Russians, but we cannot confirm it.” They also actively speculated on the issue of blasted bridges, implying the question about who was going to rebuild them. Stories discrediting the government and particularly Zelensky followed, as did efforts to discredit Ukraine’s armed forces and territorial defence. It was no later than in March that the usual conspiracy theories about “external governance” came back. One can see that the extent of disinformation is growing every week. In June, the entire network has resumed dissemination of “rumours” and “landscapes” filled with Russian disinformation.

Another topic stood out among reports on Russia’s war against Ukraine, namely the coronavirus epidemic. Fakes and manipulations about the coronavirus disease were especially common on the “Spletnitsa” channel. They usually had to do with vaccination and its supposedly “terrible consequences.” Later, the channel started covering monkeypox-related issues, too. Authors of these publications did not try to embed them into the context of the war (although Russian media have indeed disseminated a fake about the US having allegedly “been developing viruses, including monkeypox, at Ukrainian biolaboratories”). Most of them were about “conspiracy” of governments, pharmaceutical companies, etc.

What kind of disinformation are the GRU-run Telegram channels spreading now?

Detector Media has collected key disinformation messages disseminated by the GRU-run Telegram channels. It is worth noting that some messages contradict each other, which is fairly common for Russian disinformation.


Who has quoted the “GRU-run Telegram channels”?

After the launch of Russia’s full-scale military invasion, the amount of times that the Telegram channels managed by its intelligence agencies were quoted has significantly increased. The said channels had previously reposted each other’s publications or these latter had been disseminated by pro-Russian anchors from TV channels owned by Medvedchuk and Murayev (for instance, Diana Panchenko or Max Nazarov). In short, there was a kind of a network members of which re-posted each other’s posts. Starting with March, though, the situation has changed – posts from these channels have started being shared more actively than before via  channels from the occupied parts of Donetsk and Luhansk regions, as well as via newly created or rebranded channels marked with letter “Z” indicating their pro-Russian position. Simultaneously with Russia's attempts to drag Moldova into the war, contents of the “Legitimnyi” and “Resident” channels caught on with Moldovan pro-Russian groups and propagandist media (“KP Moldova”, “Sputnik Moldova”), while Telegram channels related to Transnistria saw even a bigger amount of reposts. You will recall that it was namely there that, according to Ukrainian law enforcement agencies, one of the centres for these channels’ management was situated.

What is to be done with the “GRU-run Telegram channels”?

Telegram has been one of the major sources of news consumption in Ukraine since the big war broke out, so the “Telegram empire run by GRU” may further threaten Ukraine's national security. The tactics these Telegram channels have adopted since February 24 help them disguise in the media space, since they do not contain any blatant calls for the support of Russia. Instead, there is incitement and exploitation of frustration and fatigue that are natural both for each individual and for the nation as a whole in times of war.

Telegram hardly resorts to blocking channels. Even a considerable amount of complaints from users may not always affect the platform’s decision. Attempts were made to close these channels through a Ukrainian court. Despite the fact that the court ordered blockage of access thereto, that order is technically impossible to implement, since Ukrainian providers cannot block access to a particular channel or group of channels. Only the Telegram headquarters can do that. This led to discussions about possible blockage of Telegram in Ukraine. However, since the start of the war’s new phase, the platform has been actively used by government and military agencies to communicate with the society. It is almost impossible to spread footage of most of Russia's war crimes on other social networks, as it violates their rules. Instead, Telegram is not triggered by such content, which is useful for Ukrainians, because this way both Ukrainians and foreigners are able to see shocking photos and videos.

It is important to raise awareness among Ukrainians about the Telegram channels run by the enemy. Also, even if you know that a channel is run by the enemy, but you want to consciously monitor Russian disinformation, do not follow it. Each follower contributes to the legitimization of these channels, because when a new user finds one of them he sees hundreds of thousands of followers, which, of course, adds to the channel’s influence and motivates one to follow, too.