Support us
The investigation began with a familiar pattern: polished Spanish-language websites publishing apparently local news, then sharing the same claims across Telegram, Facebook and X. Their stories addressed migration, crime, elections and the war in Ukraine, yet their wording, images and publication schedules pointed to a coordinated source.
Researchers followed the trail across several Latin American countries, comparing domain registrations, archived pages, social media activity and repeated phrases. What looked like a collection of independent outlets gradually emerged as a distribution system designed to manufacture credibility and widen the reach of pro-Kremlin narratives.
For Australian readers, the case offers a useful warning. Disinformation rarely arrives wearing a label that says propaganda. It often appears as a news alert, a translated opinion piece or a video shared by someone in a local community group.
The inquiry focused on outlets that presented themselves as regional publications. Some used national flags, local phone numbers and bylines attributed to journalists who were difficult to verify. Their pages mixed genuine local stories with articles portraying Western governments as corrupt, Ukrainian officials as criminals and Russia as a victim of international aggression.
A key clue was repetition. The same unusual expressions appeared in different countries, sometimes within hours of one another. Images were also recycled, occasionally showing events from another city or an entirely different year. Investigators treated these small errors as evidence of a shared editorial pipeline rather than isolated mistakes.
Researchers collected articles before they disappeared, preserving screenshots, page code and timestamps. They compared headlines and paragraphs with material published by Russian state media and pro-Kremlin commentators. Machine translation helped identify similarities, but native Spanish speakers were essential for recognising unnatural phrasing and regional vocabulary.
The network’s strength came from distribution. A story placed on a little-known website could be reposted by dozens of accounts, then cited as proof that “the media” was reporting a particular claim. This circular referencing created the impression of independent confirmation while keeping the original source obscure.
The outlets did not publish only political propaganda. They also produced travel, health, weather and lifestyle articles that helped them look ordinary to search engines and casual readers. A harmless-looking page about cities with similar weather can illustrate how broad-interest content attracts visitors before a site introduces more polarising material.
This tactic resembles content farming: publish frequently, target popular search terms and build a large archive. Once a site has accumulated traffic, its political stories can travel further. For readers in Sydney or Melbourne, the lesson is similar to checking a supermarket product’s label: a familiar presentation does not guarantee a trustworthy source.
Telegram channels played a central role because they allowed administrators to distribute material quickly and with limited editorial scrutiny. Facebook groups and X accounts then repackaged the same posts for different audiences. Short videos added emotional force, even when their captions misrepresented the original footage.
The investigation also found signs of coordinated engagement. Accounts posted at unusual times, used nearly identical wording and promoted the same links. That activity did not always rely on sophisticated artificial intelligence. Basic scheduling tools, copied scripts and disciplined account management were enough to make a weak claim appear popular.
The messaging was adapted to regional anxieties. Posts referred to inflation, migration, public safety and distrust in political institutions. Russian narratives were inserted into existing debates rather than presented as foreign policy lectures. This made the material feel relevant to readers’ daily concerns.
That approach has clear parallels in Australia, where content about housing costs, energy prices or migration can spread rapidly during election campaigns. A claim shared in a Brisbane community group may seem local even when its original wording was produced overseas. References to Australian institutions such as the ABC, Parliament House or the Australian Electoral Commission can also be copied to create a veneer of authority.
No single clue proved the entire operation. The case rested on a chain of connections: overlapping administrators, shared technical infrastructure, repeated language, synchronized publication and links to Russian state-aligned sources. Investigators used open-source intelligence methods rather than relying on anonymous allegations.
They also distinguished between deliberate coordination and ordinary republication. Some users may have shared false stories without knowing their origin. That distinction matters because effective media literacy should expose the system’s mechanics without treating every person who encountered its content as a willing participant.
The investigation showed how a disinformation network can exploit gaps in local journalism. When communities lack reliable reporting in their own language, fabricated outlets can occupy the space quickly. Transparent methods, source checking and collaboration across borders make it harder for those operations to remain hidden.
Independent organisations help document these patterns and train journalists to investigate them responsibly. Readers who want to support that work can learn about projects and reporting initiatives through the Free Press Foundation, which promotes independent journalism about Ukraine and global affairs. The central finding is simple: propaganda succeeds when its infrastructure remains invisible, and careful reporting makes that infrastructure visible.
