Support us
The investigation began with posts that appeared to come from ordinary users: a photograph from Ukraine, a claim about battlefield losses, or a short video accusing Kyiv of hiding the truth. Individually, the accounts looked small and unremarkable. Together, they formed a coordinated information operation designed to make Russian war propaganda appear organic.
This is the story of an investigation that traced Russian war propaganda to a social media farm by following patterns rather than relying on a single suspicious post. Researchers compared account behavior, publication times, visual material, language, and the rapid movement of identical claims across platforms.
The findings offer a practical view of modern influence operations. They also show why independent journalism and open-source investigation matter when governments, anonymous networks, and platform algorithms compete to define reality.
The earliest warning signs were not necessarily false statements. Some posts repeated genuine news while placing it beside misleading captions, distorted images, or unsupported accusations. The stronger clue was repetition: accounts with different names and profile pictures published nearly identical wording within minutes.
Investigators mapped these posts across several platforms. Accounts that claimed to be located in different countries were active during the same narrow hours, used similar punctuation, and promoted the same obscure websites. Some profiles had been created within days of one another, while older accounts suddenly changed their names and began posting about the war.
A social media farm is built to create the appearance of public agreement. Operators can manage dozens or hundreds of accounts, schedule content, recycle videos, and use engagement to push selected narratives into recommendation systems. The objective is often less about persuading every reader than about making a claim seem unavoidable.
The investigation separated content production from distribution. A small group appeared to prepare themes and media assets, while a larger layer of accounts amplified them. This structure helped explain why posts appeared in several languages and why the same story could be aimed at audiences in Ukraine, Europe, and North America at the same time.
Researchers treated each account as one part of a wider digital trail. They archived posts before deletion, compared image metadata where available, searched for earlier versions of photographs, and recorded links between profiles. They also examined public records and technical details without claiming access to private information.
| Signal | What Investigators Compared | Why It Mattered |
|---|---|---|
| Timing | Posting intervals and activity peaks | Revealed synchronized publishing |
| Language | Repeated phrases and translation errors | Suggested shared scripts or operators |
| Images | Cropping, captions, and older versions | Exposed recycled or misrepresented material |
| Account history | Creation dates and sudden name changes | Identified disposable or repurposed profiles |
| Links | Domains promoted across accounts | Connected separate-looking personas |
Geography provided another useful check. Posts often claimed to come from local residents, yet their references to streets, weather, or daily life were vague or inconsistent. Even basic open-source comparisons can test such claims; a climate comparison guide can help researchers assess whether a supposedly local description fits the place and season being discussed.
The farm did not rely on one permanent message. Its themes shifted with events. A military setback could produce claims of corruption, while a diplomatic meeting might trigger allegations that Ukraine had been abandoned by its allies. The common thread was an attempt to weaken trust in Ukrainian institutions, independent media, and democratic governments.
This approach reflects a broader pattern in authoritarian information systems. The goal is frequently to exhaust audiences with contradictory stories until evidence itself appears impossible to verify. Understanding the characteristics of an authoritarian government helps place these tactics in context: concentrated power depends heavily on controlling narratives and discrediting independent scrutiny.
Tracing a network does not mean every account can be publicly assigned to a specific intelligence service. Investigators distinguished between what they could demonstrate and what remained probable. Shared infrastructure, repeated content, and coordinated behavior could establish an organized campaign, while direct Kremlin control required stronger evidence.
That distinction strengthened the reporting. Instead of presenting speculation as fact, the investigation showed its archive, explained its methods, and identified gaps. This standard is especially important in wartime, when inaccurate attribution can damage legitimate researchers and provide fresh material for propagandists.
The investigation’s value extends beyond one network. It gives journalists, educators, and social media users a repeatable way to examine suspicious campaigns without amplifying them unnecessarily.
Independent newsrooms can add value by publishing the evidence trail in a clear, accessible format. Training in digital verification also helps local reporters challenge coordinated manipulation while keeping attention on the people and events affected by the war.
A social media farm thrives in the space between speed and certainty. Supporting independent Ukrainian journalism helps close that space with documented reporting, transparent investigation, and voices grounded in the communities facing Russia’s aggression. Donate to Free Press Foundation and help sustain the work that makes information operations visible.
