Hostile viral campaign to gather information about Ukrainian prisoners of war

Today’s post is going to be quite lengthy, so please have some patience, brew a cup of tea, and read through to the end. We’ve conducted this analysis in response to a request from our reader, Natalia Saranchuk, and it focuses on a hostile viral campaign orchestrated by the enemy to gather information about Ukrainian prisoners of war. The russians have created numerous Telegram channels and Facebook pages where they monitor comments made by Ukrainians: on who served alongside whom and information about family connections. Subsequently, they approach the relatives of these prisoners and blackmail them in order to coerce them into causing harm to their imprisoned loved ones. If possible, kindly share this post as widely as you can. It’s very important!

11 October 2023

SPECIAL PROJECTS

Previously, we discussed information scavengers who often post questionable content, all under the guise of patriotism. This includes both unverified information and outright malicious fakes. We have paid particular attention to posts calling users to share information about captured servicemen.

Today, we’ll talk about pages that seem to be an integral part of a broader russian information and psychological campaign, one that also targets captured servicemen.

“Start praying, people... Don't remain silent; create a post to remind everyone that silence can be deadly! We’ve just received information about some new prisoners. The lives of our defenders hang in a balance! The captives are still alive... perhaps someone will recognize a close relative. Photos of the guys are provided in the first comment,” the hostile post reads.

This post garnered an astonishing 32,000 shares, 9,000 likes, and over 1,200 heartfelt comments like “May God protect all our defenders.” These are numbers our counter-response could only wish for. This is why we appeal for your support through likes and shares, in an effort to somehow counteract this enemy attack, and to teach Ukrainians how to discern genuine pleas for assistance from russian propaganda.

This post was initially published on September 30 at 12:35 on the Information Zone page, which presents itself as a television program. The page was established last year on March 28 (right at the outset of russia’s full-scale invasion of Ukraine - coincidence?). Since then, it has amassed over a million followers and readers (sic!).

The page is administered by a team of six individuals: two from Armenia, one from the Netherlands, while the locations of the remaining three are concealed by the page managers (possibly due to ties with russia?).

Despite the recent efforts of russian propagandists to actively advance their hostile narratives through official Facebook advertisements, this page currently does not have any active ads (this can be verified in the “Information” section on each page).

Instead, it’s posted on the “Post - Be first to find out” page, which was established a bit later, on November 14, 2022. This may explain why it has half as many followers (580,000) and readers (576,000). However, this can’t compare to the popularity of Sova from Behind the News, which has just over 72,000 readers (please subscribe!).

Almost simultaneously, down to the very second, on September 30 at 12:35, the exact same post, word for word (even with identical photos), concerning prisoners of war and the hope that someone might recognize a relative, surfaced on this page. This is the same scheme to gather information for the purpose of blackmailing family members of the prisoners. The post was shared by over 2,200 people, and another 3,000 liked it.

Notably, the page has an active comment section, where visitor Mykola Kuzanov does not recommend the page, arguing that it contains “only advertising, zero information, just advertising, no one needs it.”

On the following day, a similar scenario took place. The Bomba 2 page, which identifies itself as an “entertainment site,” shared an identical post. The sole distinction lies in the absence of the phrase “Photos of the guys in the first comment,” and in a twofold increase in fingers pointing to the site where the photos of the prisoners are posted.

This page is the most recently created of the three - it was established on March 30, 2023. Consequently, it has much fewer followers and readers - 203,000 for each. Once again, we kindly request your support through likes and shares.

In contrast to the prior two pages, this one features a distinctive cover - a “Ukraine Now” inscription against a yellow backdrop. We’ve managed to uncover a Telegram channel with an identical name and questionable content.

Much like the preceding page, there’s a visitor review here. Ihor Manzhos doesn’t endorse the page either, as he believes it contains “questionable content” and uses links for information collection. He’s right, as the page is indeed gathering data in favour of russia, to the detriment of our nation and its citizens.

All three pages share similar content and endorse the “info24 co ua” and “top pndlmndlnews fun” trash websites, through which they draw in millions of people with their posts. We slightly altered the names of the sites to evade Facebook’s blocking measures. If only Facebook could tackle fake pages and posts like these so effectively! But no, it appears to focus on silencing critics (this statement is drawn from our own experiences).

What’s funny is that one of these sites published a post burying Kirkorov on September 9. This is an immensely popular scheme that we previously discussed. These types of posts populate social media, each directing users to its own site. Most of these sites are constructed using templates from platforms such as Wordpress, HitMag, Vercel.app, etc.

Their design is minimalistic, devoid of any contact information. In addition to the typical com.ua and info domains, these sites also include domains from russia (.ru), Armenia (.am), and even the former soviet union (.su). Beyond serving propaganda purposes, these sites can be leveraged for monetization. You can find more information on this topic here.

In the case of the two sites that promote the three pages we’re discussing today, the thematic top-level domain is “fun.” Within this domain, it’s possible to register domains in Cyrillic.

Take notice of the letter substitutions employed by pages and trash sites of this nature. In their posts, the kremlin minions replace Cyrillic letters with visually similar Latin counterparts: E, u, p, o, i, c, y, x, a. Furthermore, the letter “o” is transformed into “0” or zero.

This tactic is intentional; it’s a means to elude search engine algorithms capable of blocking fake news. In the past, such headlines weren’t indexed, thus remaining hidden from the system’s view. However, this lifehack has limited effect today, as the world continues to evolve, and search engines, too, adapt and improve. We discussed this topic in more detail previously (check out the interesting conversation in the comments).

To conclude, we’d like to say that the photo featured in these propaganda posts dates back to the onset of the war (not the full-scale invasion, but the war in August 2014). It depicts Ukrainian prisoners of war, forced by the occupiers, to clean up the russian-occupied town of Snizhne. This image is quite popular and is even employed by Ukrainian media as an illustrative photo in articles about the present war.

We’ve already given detailed and repetitive explanations regarding the potential harm associated with the publication of data concerning missing and captured servicemen:

https://bit.ly/3PMtoZC, https://bit.ly/3rxprjs and https://cutt.ly/QwnToBb1