Infamous Russian Troll Farm Appears to Be Source of Anti-Ukraine Propaganda

by Craig Silverman and Jeff Kao

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Just before 11 a.m. Moscow Standard Time on March 1, after a night of Russian strikes on Kyiv and other Ukrainian cities, a set of Russian-language Twitter accounts spread a lie that Ukraine was fabricating civilian casualties.

One account created last year, @Ne_nu_Che, shared a video of a man standing in front of rows of dark gray body bags that appeared to be filled with corpses. As he spoke to the camera, one of the encased bodies behind him lifted its arms to stop the top of the bag from blowing away. The video was taken from an Austrian TV report about a climate change demonstration held in Vienna in February. But @Ne_nu_Che claimed it was from Ukraine.

Four Russian-language Twitter accounts posted a video that they claimed showed Ukrainian media had faked reports of civilian casualties. It is actually an unrelated clip from an Austrian TV report in February. The accounts were later removed by Twitter for violating its platform manipulation and spam policy. (Screenshots captured by ProPublica)

“Propaganda makes mistakes too, one of the corpses came back to life right as they were counting the deaths of Ukraine’s civilians,” the tweet said.

Never miss the most important reporting from ProPublica’s newsroom. Subscribe to the Big Story newsletter.

Eight minutes later, another account, @Enot_Kremle_Bot, tweeted the same video. “I’M SCREAMING! One of the ‘corpses’ came back to life during a segment about civilian deaths in the Ukraine. Information war is reaching a new level,” they said.

Two other accounts created last fall within a few days of @Enot_Kremle_Bot soon shared the same video and accusations of fake civilian casualties. “Ukrainian propaganda does not sleep,” said one.

The Twitter profiles are part of a pro-Putin network of dozens of accounts spread across Twitter, TikTok and Instagram whose behavior, content and coordination are consistent with Russian troll factory the Internet Research Agency, according to Darren Linvill, a Clemson University professor who, along with another professor, Patrick Warren, has spent years studying IRA accounts.

The IRA burst into the American consciousness after its paid trolls used thousands of English-language accounts across social media platforms to influence American voters during the 2016 presidential election. The IRA was at the center of a 2018 Department of Justice criminal indictment for its alleged effort to “interfere with elections and political processes.”

“These accounts express every indicator that we have to suggest they originate with the Internet Research Agency,” Linvill said. “And if they aren’t the IRA, that’s worse, because I don’t know who’s doing it.”

An analysis of the accounts’ activity by the Clemson Media Forensics Hub and ProPublica found they posted at defined times consistent with the IRA workday, were created in the same time frame and posted similar or identical text, photos and videos across accounts and platforms. Posts from Twitter accounts in the network dropped off on weekends and Russian holidays, suggesting the posters had regular work schedules.

Many of the accounts also shared content from facktoria.com, a satirical Russian website that began publishing in February. Its domain registration records are private, and it’s unclear who operates it. Twitter removed its account after being contacted by ProPublica.

Russian Twitter Accounts That Disseminated Propaganda Posted Mostly During Working Days

While Twitter sees relatively constant use throughout the week, these accounts posted mostly during Russian working days.

Note: Data includes posts on Twitter from 28 accounts identified in the Clemson Media Forensics Hub and ProPublica analysis as exhibiting coordinated or bot-like behavior. The accounts were removed by Twitter. Source: Twitter. (Jeff Kao/ProPublica)

The pro-Putin network included roughly 60 Twitter accounts, over 100 on TikTok, and at least seven on Instagram, according to the analysis and removals by the platforms. Linvill and Warren said the Twitter accounts share strong connections with a set of hundreds of accounts they identified a year ago as likely being run by the IRA. Twitter removed nearly all of those accounts. It did not attribute them to the IRA.

The most successful accounts were on TikTok, where a set of roughly a dozen analyzed by Clemson researchers and ProPublica racked up more than 250 million views and over 8 million likes with posts that promoted Russian government statements, mocked President Joe Biden and shared fake Russian fact-checking videos that were revealed by ProPublica and Clemson researchers earlier this week. On Twitter, they attacked jailed Russian opposition leader Alexei Navalny and blamed the West for preventing Russian athletes from competing under the Russian flag in the Olympics.

Late last month, the network of accounts shifted to focus almost exclusively on Ukraine, echoing similar narratives and content across accounts and platforms. A popular post by the account @QR_Kod accused the Ukrainian military of using civilians as human shields. Another post by @QR_Kod portrayed Ukraine as provoking Russia at the behest of its NATO masters. Both tweets received hundreds of likes and retweets and were posted on the same day as the body bag video. At least two Twitter accounts in the network also shared fake fact-checking videos.

Twitter accounts such as @QR_Kod shared memes that echo propaganda spread domestically by Russian state media. @QR_Kod was later removed by Twitter for violating its platform manipulation and spam policy. (Screenshots captured by ProPublica)

The findings indicate that professionalized trolling remains a force in domestic Russian propaganda efforts and continues to adapt across platforms, according to Linvill.

“I can’t stress enough the importance of understanding the way that this is a tool for Putin to control narratives among his own people, a way for him to lie to his own people and control the conversation,” Linvill said. “To suggest that the West is blanketly winning this information war is true only in some places. Putin doesn’t have to win the information war, he just has to hold his ground. And these accounts are helping him do that.”

After inquiries from ProPublica, all of the active accounts were removed from TikTok, and nearly all were suspended by Twitter. Meta said it removed one Instagram account for violating its spam policy and that the others did not violate its rules. None of the platforms attribute the accounts to the IRA. Twitter and TikTok said the accounts engaged in coordinated behavior or other activity that violated platform policies.

A TikTok spokesperson said the initial eight accounts shared with it violated its policy against “harmful misinformation.” TikTok removed an additional 98 accounts it determined were part of the same pro-Putin network.

“We continue to respond to the war in Ukraine with increased safety and security resources to detect emerging threats and remove harmful misinformation,” said a statement provided by the company. “We also partner with independent fact-checking organizations to support our efforts to help TikTok remain a safe and authentic place.”

TikTok removed at least three additional Russian-language accounts that Clemson researchers said are part of the same network. The company declined to say how many accounts in total it removed as part of this action.

A Twitter spokesperson called the roughly 60 accounts it removed “malicious” and said they violated its platform manipulation and spam policy, but declined to be more specific. They said the company had determined that the active accounts shared by ProPublica had violated its policies prior to being asked about them. Twitter decided to leave the set of 37 accounts online “to make it harder for bad actors to understand our detections,” according to the spokesperson.

The accounts were removed by Twitter within 48 hours of ProPublica contacting the company about them. The week before, Twitter removed 27 accounts that the Clemson researchers also identified as likely IRA accounts.

“Our investigation into these accounts remains ongoing, and we will take further action when necessary,” said a statement from a Twitter spokesperson. “As is standard, when we identify information operation campaigns that we can reliably attribute to state-linked activity, we will disclose this to the public.”

Twitter declined to offer more details on why it left roughly 30 accounts that it identified as violative online to continue spreading propaganda. It also declined to comment on connections between the roughly 60 accounts in this recent network and the hundreds of accounts flagged by Linvill and Warren last spring as possible IRA profiles. Linvill said he identified the recent accounts largely based on their commonality with the previous set of 200.

“I connect these current accounts to the ongoing activity over the course of the past year by carefully tracking accounts’ tactics, techniques and procedures,” he said.

Platforms may be hesitant to attribute activity to the IRA in part because the agency has adapted and made its efforts harder to expose, according to Linvill. But he said social platforms should disclose more information about the networks it removes, even if it can’t say with certainty who is running them.

“In every other area of cybersecurity, dangerous activity from bad actors is disclosed routinely without full confidence in the source of the activity. We name and disclose computer viruses or hacker groups, for instance, because that is in the public interest,” he said. “The platforms should do the same. The Russian people should know that some sophisticated and well-organized group is covertly using social media to encourage support for Putin and the war in Ukraine.”

The Internet Research Agency is a private company owned by Yevgeny Prigozhin, a Russian entrepreneur known as “Putin’s Chef.” Prigozhin is linked to a sprawling empire ranging from catering services to the military mercenary company Wagner Group, which was reportedly tasked with assassinating President Volodymyr Zelenskyy. The IRA launched in St. Petersburg in 2013 by hiring young internet-savvy people to post on blogs, discussion forums and social media to promote Putin’s agenda to a domestic audience. After being exposed for its efforts to influence the 2016 U.S. election, the IRA attempted to outsource some of its English-language operations to Ghana ahead of 2020. Efforts to reach Prigozhin were unsuccessful.

But it never stopped its core work of influencing Russian-speaking audiences. The IRA is part of a sprawling domestic state propaganda operation whose current impact can be seen by the number of Russians who refuse to believe that an invasion has happened, while asserting that Ukrainians are being held hostage by a Nazi coup.

Prior to the invasion, accounts in the network identified by the Clemson Media Forensics Hub and ProPublica celebrated Russian achievements at the Olympics.

“They were deep in the Olympics, tweeting about Russian victories and the Olympics and how the Russians were being robbed by the West and not allowed to compete under their own flag,” Linvill said.

After the invasion began, they moved to unify people behind Putin’s war.

“It was a slow shift,” he said. “And this is something I’ve seen from the IRA before: When a significant world event happens, they don’t always know immediately how to respond to it.”

By late February, the network had found its voice in part by echoing messages from Russian officialdom. The accounts justified the invasion, blamed NATO and the West and seeded doubts about civilian death tolls and Russian military setbacks. When sanctions kicked in and Western companies began pulling out of Russia, they said it was good news because Russian products are better. (Two Twitter accounts in the network shared the same video of a man smashing an old iPad with a hammer.)

Accounts in the network responded to sanctions by posting videos disparaging Western products. (Screenshot captured by ProPublica)

“These accounts were sophisticated, they knew their audience, and they got engagement far surpassing the number of followers that they had,” Linvill said.

Paul Stronski, a senior fellow in the Russia and Eurasia Program at the Carnegie Endowment for Peace, reviewed content shared by more than two dozen of the Twitter accounts prior to their suspension. “A lot of this is the type of stuff I would expect from Russian trolls,” said Stronski, who reads and speaks Russian.

He said many of the accounts adopt an approachable and humorous tone to generate engagement and appear relatable to younger audiences present on social media.

“They’re very critical of prominent Russians who have criticized this war, questioning their patriotism,” Stronski said. “They’re saying in effect that during wartime you shouldn’t be criticizing your own. You should be lining up behind the state.”

When President Biden flubbed the pronunciation of “Ukrainians” during his recent State of the Union address, several of the accounts on Twitter, TikTok and Instagram shared the clip and mocked him. While that clip spread widely outside of the suspected IRA network as well, the accounts often spread more obscure content in coordination. Multiple Twitter accounts, for example, shared a screenshot of a Russian actor’s tweet that he cared more about being able to use Apple Pay than the war in Ukraine. The accounts criticized him, with one warning that “the internet remembers everything.”

Before the account takedowns, the Russian government had begun closing off the country from global social media and information sources. It restricted access to Twitter and blocked Facebook. The Russian legislature passed a law that allows for a 15-year sentence for people who contradict the official government position on the war. As a result, TikTok announced it would pause uploads of new videos in Russia.

Some of the accounts in the network saw the writing on the wall and prepared their audience to move to Telegram, a Russian messaging service.

“Friends! With happiness I'd like to tell you that I decided to make the t.me/enot_kremlebot channel, in which you will see analytics to the fullest extent. Twitter could block us any minute!” tweeted @Enot_Kremle_Bot on March 5. “I really don’t want to lose my treasured and close-to-my-heart audience! Go to this link and subscribe.”

This content originally appeared on Articles and Investigations - ProPublica and was authored by by Craig Silverman and Jeff Kao.