Russia's disinformation campaign targets Ukraine with fake Der Spiegel, Fox News, and RBC websites

Author: Nina Avdeenko

A flood of spam content has recently emerged on the social network X (previously known as Twitter), promoting the idea that Ukrainians should call for a ceasefire with Russia. The large-scale attack began on October 25th and saw tweets being sent out at a rapid rate of 2.5 tweets per minute, as reported by the analytical project Bot Blocker / antibot4navalny, which analysed the publications. The spam materials are being shared on fake websites that look like well-known news outlets — not only in Ukraine but also in Western countries. Simultaneously, “For Demobilization” protests were suddenly held in various Ukrainian cities, with women holding identical placards demaning to send Ukrainian soldiers home. Analytical data relating to the posts was made available to The Insider.

Columns on strange websites

Some of the posts contain links to various pseudo-news and analysis articles. Analysts have pointed out that these posts are shared on websites that are deceptive imitations of well-known Ukrainian news sources. These articles consistently claim that Ukraine's defeat in the war is imminent, suggesting that Western military and financial aid intended for Ukraine will be redirected to Israel, leaving Ukrainians without essential services such as heating, pensions, and salaries during the winter. Furthermore, they allege that in the absence of military equipment, the authorities in Kyiv are sending thousands of soldiers to the slaughter solely to maintain their grip on power.

The themes in these articles read as follows:

• There is no need to hold Avdiivka, as Russia is pulling in reinforcements; Ukraine has been forced to go on the defensive and is suffering huge losses. There will be less Western aid as a lot of resources have been pulled away by Israel. Avdiivka may become another Bakhmut and Soledar: first huge human losses, then the loss of the stronghold itself. Here’s an example of one of these articles.
• Ukraine no longer interests the West, Israel is more important — it will get weapons that were meant for Ukraine. Ukraine’s allies will induce Kyiv to negotiate with Moscow. Here’s an example of one of these articles.
• Ukrainian President Volodymyr Zelensky profits from military aid and war funding. The allocation of funds for the war . In order not to lose the financial inflows from the West, Zelensky will create the appearance of successful battles. Here’s an example

It's not just Ukrainian sources that are being counterfeited. Pseudo-analytical columns predicting Ukraine's apparent defeat are also being disseminated on counterfeit versions of well-known Western publications — including fake sites resembling Der Spiegel, Die Welt, Fox News, Le Parisien, Walla, and others. The links shared in the tweets direct users to these fake websites, which further redirect to the clone pages. Western audiences are being presented with a similar narrative: waning interest in the Russia-Ukraine conflict, a shift of attention towards Israel, and a belief that the Biden administration will no longer provide Kyiv with financial and military assistance.

This represents a large-scale spam campaign featuring pro-Kremlin content aimed at both Ukrainian and Western audiences. Several dozen articles have been distributed in English, French, German, and Hebrew.

The same accounts responsible for sharing these fake articles also promote direct Kremlin propaganda, including a video from the website ukraine inc portraying Vladimir Zelensky as a “drug addict.”

Two brothers

Bots have circulated a video about “two brothers” who were “separated due to the Ukraine coup / political crisis.” The video was initially posted on social platform X on October 25th, accompanied by links to the Russian social network VK and, in some cases, to Vimeo. The tweets were uniform in their messaging, claiming that “YouTube had removed the video, concealing the truth from us, and this is an essential story that we have the right to know.” Each account's entire tweet history was essentially a string of these links featuring the same video clip. These tweets appeared without any discernible pattern, appearing as responses to various posts and comments, not exclusively in Russian.

According to the narrative, two brothers found themselves at war in Ukraine because of “political events.” Eventually, they encountered each other during an assault, fighting on opposing sides. Then one died near Horlivka, leading civilians out from under fire, and the second, who had gone to Kyiv before the war, was killed by shelling. The story is conveyed by a character identified as the “mother,” portrayed by Russian actress Olga Toroshchina, with one of the “brothers” played by Russian actor Roman Volynsky. The video only briefly alludes to the “political events,” including a clip of Russian President Boris Yeltsin's speech at the 16th second, in which he commits to “leading Russia to better times.” This statement comes from Yeltsin’s speech after being elected chairman of the Supreme Soviet of the RSFSR on May 29, 1990.

As the project's analysts explained to The Insider, the rapid and high-volume publication of these tweets suggests an automated process at work.

“Unlike traditional 'salary trolls' that we’ve been studying for over a year, this spam attack is purely based on automated publishing. That means it's very cheap to multiply it by 10, 100, or 1,000 times. The current volume of the spam per minute is roughly comparable to what the ‘troll factory’ usually produces on Twitter. But live trolls at keyboards are expensive and difficult to scale, while automated spam is relatively straightfoward.”

Fostering anxiety

These identical accounts are not limited to spreading anti-Ukrainian sentiments; many have also posted a photograph depicting a building wall adorned with the Stars of David. These accounts frequently post this image in the comments section of various posts. Across different languages, the descriptions of the photo are the same. Some common quotes include expressions like, “Sad to see the conflict has extended this far,” and “A sad reality of how global conflicts can impact ordinary lives.”

According to analysts at the Bot Blocker / antibot4navalny project, in this way is pumping up anxiety and shifting attention to the Arab-Israeli conflict from Ukraine.

“Our interpretation is that this is anxiety-inducing for Europeans: 'Don't think that the conflict in the Middle East is somewhere far away and won't affect you. Jewish pogroms are already knocking on the door of your neighbor's house. Are you ready for the next one to be yours?’ This is presented as ‘we are all in favour of a peaceful settlement and ceasefire; we don't want pogroms at all’ — but the reference to pogroms here is precisely a means of intimidation. It's like Russia Today during the coronavirus pandemic: we tell Western audiences how many side effects there are from vaccinations, how badly the authorities are handling the crisis, and tell Russian audiences how important it is to get vaccinated, how perfectly tested the vaccines are, how the Ministry of Health is clearly in control of everything. This is what’s happening here: we scare the West with war, while what happens at home is the concern of the office next to us [in reference to the Russian government — translator’s note].”

The Kremlin is behind the attacks

Hackers from Russia’s military intelligence agency, the GRU, have been planting disinformation and carrying out phishing attacks through fake international media websites for many years, and these attacks have only intensified after the full-scale invasion of Ukraine. The Insider previously wrote about this work of the agency in its investigation Attack of the clones: GRU begins large-scale cyberattack on Ukraine.

The project's analysts also note that, to all appearances, the pro-Russian fake columns and the video about the “brothers” were commissioned by the Russian authorities. Several signs point to this:

• The notes have Ukrainian-language and Russian-language versions. The links lead to Ukrainian-language sites, but the titles of the articles in the links are in Russian, as if the editorial staff's main language is Russian.
• There is no reason for real Ukrainian speakers and journalists to post articles on third-party websites.
• The accounts are mostly subscribed to major Kazakhstani media / authorities. That indicates that they were created by a Kazakhstani contractor or from under a VPN with access to a server in Kazakhstan.
• The profiles sharing the video featuring the “brothers” and related posts tend to have minimal or empty subscription lists. In most cases, they include just one or two large Kazakhstani accounts. Typically, there are a total of three accounts in their subscriptions, with the third one being Elon Musk. X (formerly Twitter) routinely prompts new users to follow Musk immediately upon registration. These accounts were established on the social network between September and October 2023.

Narratives in the articles:

• Western weapons from Ukraine end up in third countries.
• Zelensky is profiting from the war.
• Military aid from the West will be redirected to Israel, and Ukraine will practically stop receiving it.

Narratives in a video about the “brothers” originally posted on VK:

• The collapse of the USSR is the greatest catastrophe.
• The cause of the war is the illegal change of power in Ukraine.
  

Propaganda narratives in videos on ukraine.inc:

• Volodymyr Zelensky is a drug addict and alcoholic.
• People are sent to the front with any degree of disability.

The use of clone websites to spread fakes is not new

Media website cloning is a frequently employed political strategy, particularly evident during election campaigns. For instance, during the 2016 Russian State Duma elections, the occupied Crimea saw the emergence of cloned pages resembling local publications Primechaniya and Forpost. The first website was linked to Oleg Nikolaev, a businessman hailing from St. Petersburg and Krasnodar, who was in opposition to Sevastopol's ”governor” at the time, Sergey Menyaylo (now the head of North Ossetia). The second was associated with businessman Alexei Chaly, who was installed as the “people's mayor” of Sevastopol during the region's annexation by Russia. While both played active roles in the annexation, they later became adversaries of Menyaylo and his backer, former Ukrainian Defense Minister Pavlo Lebedyev. Nikolaev decided to run for the State Duma, while Menyaylo and Lebedev aimed to promote their own candidate. Consequently, media clones representing Nikolaev and Chaly were established, spreading content intended to undermine their credibility.

The objectives of these websites are not always political. In 2020, the Organized Crime and Corruption Reporting Project (OCCRP), an organization specializing in investigating corruption and various fraud schemes, published an article detailing how clones of well-known media outlets were used to spread fake news promoting get-rich-quick schemes, directing potential bitcoin investors to dubious brokers and scammers. They even featured purported endorsements from celebrities. One such article, masquerading as a piece from a reputable newspaper, presented Sweden's most famous TV stars, Fredrik Skalvan and Philip Hammar, advocating an apparently foolproof opportunity to invest in bitcoin, guaranteeing riches. After those who read the material sent through their contact details, they were contacted by the scammers who presented a “convincing financial model,” leading people to transfer them money.