Support us
For months, a string of YouTube channels looked harmless. Their thumbnails showed smiling presenters and recycled news segments. Behind the polished exterior, investigators found something different: a coordinated influence operation pushing Kremlin-friendly narratives into dozens of languages, including English content aimed at viewers in Sydney and Melbourne.
The discovery began with a single suspicious upload. A journalist noticed that several channels were sharing identical scripts with slightly different voices. The team followed hosting records and corporate filings. The threads converged on a small office in Limassol, where a company registered as a media consultancy was running a propaganda factory.
What made the operation unusual was its geographic sleight of hand. Cyprus offered convenient EU access, English-language business infrastructure and a regulatory environment easy to navigate. For an Australian reader, the case is a reminder that foreign influence operations rarely target only the country where the conflict is happening. They reach living rooms in Parramatta and Adelaide as easily as anywhere else.
The investigation mapped more than forty channels, dozens of bank accounts and several shell entities. It also raised questions about how YouTube's recommendation engine amplifies such content, and what responsibility platforms carry when their algorithms deliver state-aligned narratives to unsuspecting viewers.
Earlier work by the Free Press Foundation had already uncovered a similar Russian troll operation based in Belgrade, where a covert media outfit had rented offices in the Serbian capital. That investigation showed how operators used local contractors and Western payment processors to launder the origins of their content.
The Cyprus case followed a similar playbook. The team noticed the same voice actors appearing on multiple channels under different names. Cross-referencing tax identification numbers in the EU business registry revealed a parent company in Nicosia with links to the Belgrade network. The full report is available through the foundation's investigative archive.
Once the corporate connections were mapped, payments could be seen flowing from a Moscow-based PR agency to a Cypriot intermediary, and then to freelancers across Europe. Each layer added distance between the original sponsor and the final upload.
The channels were designed to look like ordinary news and opinion outlets. Some specialised in Middle Eastern affairs, others in European politics, and a handful targeted English-speaking audiences in Australasia. Videos were uploaded in batches, timed to major news cycles.
Investigators discovered the network exploited YouTube's monetisation system. By producing large volumes of content quickly, the operators generated steady advertising revenue while burying genuine reporting. Several Australian advertisers, identified through ad libraries, had unknowingly funded Kremlin-aligned videos.
The operators also used private communities on Telegram and VKontakte to coordinate uploads. A schedule circulated among producers dictated which narratives should be pushed on which day, allowing the network to flood algorithms with consistent messaging.
The content was carefully calibrated. Some videos questioned sanctions against Moscow, others amplified conspiracy theories about Western military aid to Ukraine, and a few promoted the idea that European Union expansion threatened Orthodox Christian traditions. For English-speaking audiences, the tone was softer, using familiar formats such as panel discussions.
Researchers found that several uploads were specifically tailored for Russian-speaking diaspora communities in cities like Sydney, Melbourne and even smaller centres such as Hobart. Many comments beneath these videos came from accounts registered in Australia, suggesting the operation was reaching its intended audience.
The team also identified attempts to manipulate trending topics. By uploading videos with keyword-rich titles during slow news cycles, the operators pushed their content onto recommended panels.
Australia is far from Cyprus, but digital borders mean little to a well-funded influence operation. Many viewers in Australia consume news through global social platforms, making them natural targets. The country's diverse migrant communities, including a large Russian-speaking population in New South Wales and Victoria, are particularly attractive to operators.
Australian media scholars point out that the country's foreign interference laws, strengthened through the Espionage and Foreign Interference Act of 2018, give prosecutors tools to act when operations touch Australian soil. However, legal jurisdiction often ends at the border, making prevention and media literacy the first line of defence.
Organisations such as the eSafety Commissioner have published guidance for spotting coordinated inauthentic behaviour. Schools in Adelaide and Perth have begun incorporating this guidance into digital literacy classes, reflecting awareness that the threat extends beyond election interference.
Cyprus opened an initial inquiry after the investigation was shared with local authorities. The country's media regulator has limited powers over foreign-registered online platforms, but financial investigators began examining whether the corporate structures complied with EU anti-money-laundering rules. Similar probes have led to asset seizures and the removal of business licences.
YouTube removed a portion of the identified channels once evidence was presented, citing violations of its policies against deceptive practices. By the time content is removed, it has often been viewed millions of times and shared across other platforms.
In Australia, the Australian Competition and Consumer Commission has shown interest in how advertising dollars flow to foreign-influence operations. Discussions about mandatory disclosure for political advertising now include proposals to extend transparency rules to online video platforms.
The Cyprus investigation is part of wider work that gives journalists and citizens tools to verify what they see online. Open-source intelligence techniques, corporate registry searches and linguistic analysis have become essential skills for reporters covering influence operations.
For the Free Press Foundation, supporting such work is central to its mission. Readers who want to learn more about the organisation's broader projects can explore the Free Press Foundation homepage.
Ultimately, the Cyprus case is a reminder that propaganda networks adapt quickly and hide behind plausible corporate fronts. The most effective response combines patient investigative work, cross-border cooperation and audiences willing to question what they see on their screens.
