While Russia’s physical war against Ukraine continues, so too has the Russian information war intensified as the country seeks to shift international and domestic framing of the invasion. In a recent assessment, MIT Technology Review noted the scale of the propaganda war appeared to have eclipsed the scale of the cyberwar in Ukraine. While Russia has tried to control, confuse, and derail the narrative around the war with Ukraine by employing its usual influence strategy, Ukraine has succeeded in countering Russian information operations by taking a novel approach to competition in online spaces. Online campaigns framing the Ukrainian people as resilient, humorous, and heroic, all while naming and shaming Russian narrative attacks, appear to have successfully swung the pendulum of international support and solidarity in favor of Ukraine. How the information war unfolded during Russia’s invasion of Ukraine and its subsequent impact on the physical realities of the war marked a new era of conflict. In an increasingly digitally connected world, information operations have become an expected and essential element of warfare, which will continue to shape conflicts.

LEARN MORE: What Is A Narrative Attack?

Russian Information Warfare Tactics

Russia’s information operations efforts leading up to and during the invasion of Ukraine followed an expected pattern of behavior based on tactics employed in previous Russian information operations against Ukraine and other target countries. Russian influence efforts have historically sought to weaken or destabilize targets by exacerbating social and political cleavages and thereby inflaming tensions or by sowing confusion and chaos in the information environment. Often, these operations succeed by casting doubt about what is real and what is not – because if the truth is unclear, it can be challenging for competitors to respond to a crisis. During the invasion of Ukraine, Russian narratives sought to confuse international and domestic communities by purporting a host of unusual grievances against Ukraine – that radical elements and neo-Nazis had overrun their government, that the Ukrainian government was corrupt, and that Ukrainian forces had been committing atrocities against ethnic Russians and civilians in separatist territories.
‍

In an effort to shape the story around the invasion, Russia has employed several routine tactics to spread narrative attacks in multiple languages across digital platforms (some of these tactics have been previously detailed at length in CSIS’s publication on Russian and Chinese state influence operations entitled Influence and Escalation). In the lead-up to the invasion and during the war, Russia has employed the use of false flag operations—a tactic in which a malicious actor seeks to shift blame for an atrocity or hostile action to another actor by fabricating stories or manufacturing evidence of their involvement. In the weeks ahead of Russia’s invasion, the White House asserted that U.S. intelligence indicated Russia was preparing a false flag operation accusing Ukrainian forces of committing violence against civilians in the Donbas, to be accompanied by a video showcasing graphic images of corpses and wounded individuals.

In support of this observation, during Blackbird.AI’s investigation of Russian language conversations mentioning Ukraine and conflict-related terminology from February 1 to March 1, 2022, the Blackbird team noted that anonymous accounts circulated several narratives asserting Ukrainian forces were acting aggressively against the people of the Donbas region. Ukrainian officials, OSINT investigators, and other experts have refuted these claims.

In the earliest period of the dataset, from February 1 to 7, the Blackbird team detected higher than normal levels of abnormal activity – a term that refers to content that circulates online atypically and can indicate an information campaign. Many of these strange posts were published by Russian media and anonymous accounts, some of which asserted an affiliation with Donbas separatist forces. These accounts purported that the Ukrainian troops were seeking to “solve the problem of the Donbas by force”. They were amassing troops along the line of contact between separatist-controlled territory and Ukrainian government-controlled territory in preparation for military action to take back these areas. Accounts also asserted that Ukrainian forces were shelling residential areas, cutting off water and electricity, and otherwise exacerbating problems in the region.
‍

From February 22 to March 1, Blackbird.AI noted similarly higher-than-normal levels of anomalous activity. Among the posts flagged as abnormal, pro-Russia accounts circulated the narrative that the war in Ukraine had started eight years ago in 2014 when, to quote one account: “the democratically elected Ukrainian government was overthrown by Obama in an illegal coup and replaced with an anti-Russian regime that would go on to commit daily war crimes against ethnic Russians in Donbas.” These accounts did not provide any evidence or verification of their claims.

Russian accounts also coordinated to flood the zone in their online campaigns. This refers to a method in which accounts flood social media with false information, spam, or unrelated news to drown out critical commentary or coverage of events that could cast the actor in a negative light. In an example that surfaced in Blackbird.AI’s investigation, from February 26 to 27, pro-Russia social media accounts attempted to flood the hashtag #НетВойне (#NoWar) with pro-Russia support; this included spinning up the pro-Russian forces hashtag #ДаПобеде (#YesVictory) for use in direct competition to the anti-war hashtag. These efforts were quickly overtaken when pro-Ukraine accounts across social media flooded out the #YesVictory hashtag with condemnations of Russia, Putin, and the invasion.

Pro-Russia narratives were also amplified through the use of bot networks. Using this tactic, bot accounts shared and interacted with pro-Russia narratives across social media to expand the reach of these narratives and to get pro-Russia narratives trending, likely to create the illusion of widespread support. The Blackbird team noted several instances of pro-Russia bot-like accounts retweeting narratives to amplify them. According to Blackbird’s data, from February 1 to 22, several bot-like users on social media amplified narratives that NATO and Kyiv were planning aggressive acts to take back Crimea or separatist-held territory. These accounts also amplified narratives that the U.S. and NATO were deliberately trying to drag Russia into conflict with Europe to impose harsher sanctions than were currently politically acceptable or as a pretext to move NATO into Ukraine and closer to Russian borders. Certain bot-like accounts also amplified narratives claiming that Ukrainian forces were committing genocide in the Donbas region.

In the data from February 22 to March 1, which covers the outbreak of war, bot-like accounts circulating pro-Russia narratives began to focus more heavily on amplifying posts asserting that Ukrainian forces had been committing atrocities against the people of the Donbas region for the past eight years. Additionally, during the hashtag mentioned above war from February 26 to 27, bot-like accounts frequently retweeted posts promoting the pro-Russia #YesVictory hashtag.

Pro-Russia narratives were also promoted through amplification via state-run media outlets, public officials, and other public figures. Russia frequently uses official sources to broadcast state positions and legitimize unverified claims. This often includes the involvement of state-run media outlets, which share statements from Putin and other government leaders, general news, and narrative attacks to grant it credibility. Public officials—such as members of the cabinet, diplomats, and other formal representatives of the state—and other public figures also circulate these narratives via their official accounts for the same purpose. In one example, EU vs. Disinfo reports that on March 1, two Russian Foreign Ministry websites hosted an explicit and violent video purporting to show the “genocide” that Ukrainian forces were waging against the people of the Donbas region. Russian diplomatic accounts across social media also shared the video, employing the new hashtag #DonbassTragedy and posting in multiple languages. Independent Russian media have repeatedly debunked claims of Ukrainian forces deliberately targeting civilians in the Donbas; additionally, Donbas conflict data from the UNHCR and the OSCE Special Monitoring Mission to Ukraine does not support these claims, as EU vs. Disinfo reports.

During the current war with Ukraine, evidence suggests that pro-Russia accounts might also be publishing false information in demoralization campaigns against Ukraine. In one potential example, on February 27, social media accounts began circulating news that the mayor of Kyiv announced the capital was encircled by Russian forces. Several verified accounts—including European and American public figures—retweeted the news. Later, the mayor of Kyiv released a statement denying that the city had been encircled. While the leaking of this false information regarding Kyiv’s encirclement cannot be attributed to any specific actor, experts in Russian influence operations note that Russian actors have employed this demoralization tactic in the past.

Officially adopted Russian state positions regarding Ukraine also employ the use of specialized language and framing to distance themselves from responsibility and portray the current situation in a way that is more favorable to Russian interests. In their framing of the current war, Putin, Russian leadership, and the state media apparatus have referred to the invasion as a “special military operation” and a “denazification” and “demilitarization” effort to liberate Ukraine from a corrupt power structure. In Blackbird’s monitoring of online conversations related to the war, accounts circulating pro-Russia narratives on social media began using this specialized phrasing more and more frequently after the invasion began on 24 February, including frequent use of Russian language terms and hashtags such as “genocide,” “#NoNazism,” “fascists,” and “Banderites” (a reference to a faction of right-wing Ukrainian nationalists).
‍

Ukrainian Response to Russian Information Warfare

In contrast to the Russian campaign—which stuck closely to a time-tested model of Russian information operations strategy—the Ukrainian response saw a shift in strategy as the war unfolded. Since Russia seized Crimea in 2014, Russia has consistently targeted Ukraine through information operations, giving Ukrainian leadership extensive time to develop counter-narrative attacks efforts. While Ukraine employed some familiar tactics, Russia’s invasion led Ukraine to employ a few novel strategies against these operations, ultimately meeting the world stage with great success.

Ukraine has continued to name and shame false information about the invasion as it arises and, when possible, directly attribute these narratives to malicious actors. During the current war, Ukrainian officials have published videos on social media naming what they refer to as “fakes,” as in the previous example of the Kyiv mayor stating that he had never said that Kyiv was encircled. Additionally, President Volodymyr Zelensky has also refuted statements and actions attributed to him, including that he had fled the country to Poland and had possibly been killed by Russian forces.

In the past, Ukrainian officials have also strongly favored de-platforming to address narrative attacks. In February 2021, Zelensky announced his administration would ban three Ukrainian media outlets—112 Ukraine, ZIK, and NewsOne—known for spreading misleading and false information. After Russia’s invasion, Ukrainian officials called on social networks to ban Russian access entirely, arguing that Russian actors have been prolific in spreading narrative attacks across the platform and have targeted countries beyond Ukraine in past operations. Many social networks ultimately denied this request, arguing that cutting off access for the whole country would “silence important expression” for Russian citizens amid the ongoing war.

In Blackbird.AI’s analysis of social media conversations around Ukraine, impending conflict, and the subsequent outbreak of war, from February 1 to 22, pro-Ukraine accounts primarily focused on calling out and questioning pro-Russia narratives circulating on social media. During the first week of the reporting period, these accounts most often provided basic fact-checks and coverage of developments, such as circulating information and evidence of Russian troops amassed on the border, coverage of diplomatic talks, and refutation (corroborated by OSINT evidence) of claims that Ukrainian forces were committing atrocities in the Donbas region. These accounts also circulated responses to Putin’s public statements regarding concerns around impending NATO aggression and militarization of Ukraine. In one popular rebuttal, an account asserted NATO’s expansion to Estonia did not elicit the same response from Russia, despite the fact Estonia also borders Russia and NATO has had a presence there for almost 20 years.
‍

Ukraine’s strategy in countering Russian narrative attacks shifted when the invasion became a reality. Through the employment of new tactics as necessitated by war, Ukrainian official accounts, state media, citizen accounts, and supporters were ultimately able to present an overarching “feel-good” counter-narrative that firmly centered Putin as the villain of the story and the Ukrainian people and leadership as heroes overcoming unspeakable and seemingly insurmountable hardship. Memes shared across social media—including one in which a Ukrainian man hauls a Russian tank away with a tractor and another in which a man slowly and calmly walks a mine allegedly planted by Russian forces on a bridge into the woods as a cigarette hangs from his mouth—added a humorous element to the narrative that gave these stories virality, regardless of whether or not these memes accurately depicted the context of the war in Ukraine.
‍

Ukrainian accounts—including those of officials, state organizations, and regular citizens—amplified stories with strong emotional pull, utilizing images and videos of injuries, bombings of residential areas, children killed, people and their pets hiding out in bunkers and in metro stations; as well as depictions of ordinary people joining the war effort, such as couples getting impromptu married and fighting for their cities together, fathers parting with their children at the train station. At the same time, they stayed behind to fight, and so on. Some of these stories were further amplified on social media by Ukrainian officials, including President Zelensky and Foreign Minister Dmytro Kuleba, who added personal touches in the form of sarcasm, further emotional appeals, debunking of rumors and false information, and firm calls to action.

Blackbird’s investigation of data from February 22 to March 1 indicated that pro-Ukraine narratives on social media garnered significantly more engagement and shares than their pro-Russia counterparts, indicating generally higher support for Ukrainian narratives. The pro-Ukraine narratives for this period invoked emotion much more than was evident in the earlier dataset from February 1 to 21. For instance, several accounts posted variations of an excerpt of a Zelensky speech in which he stated: “We just want our children to live. Sixteen children died, and Putin will continue to claim that only military facilities are being attacked. Where are our children, in what military factories do they work? What missiles? Maybe they are driving tanks? You killed 16 children.” Similar posts circulated with coverage—including videos and photos—of Russian forces’ attacks on residential areas and resources essential to the survival of local civilian populations.
‍

Counter-narratives identified in the Blackbird data also directly confronted and flipped Russian narratives on their head, as in the case of one post—since deleted—which asked, “Vladimir Putin carries out wild denazification in Ukraine: Russian troops raze cities with predominantly Russian inhabitants from the face of the earth and kill Russian people. Who is the Nazi here?”. Several high-engagement pro-Ukraine and anti-war hashtags also drove the conversation, including #StandWithUkraine, #IStandWithUkraine, #StopRussia, and #UkraineUnderAttack.

Notably, both pro-Russia narratives and pro-Ukraine narratives employed appeals to emotion. However, while Russian narratives primarily attempted to stoke fears and anxieties, Ukrainian counter-narratives more often highlighted the positive—elevating stories of hope, courage, sacrifice, and resilience in the face of an existential threat to the nation—which resonated more with international audiences. Additionally, given widespread global access to social media, the rise of professional and hobby OSINT researchers in the past decade, and a significant, diverse domestic and international media presence in Ukraine, Russia has been fighting an uphill battle to obfuscate the reality of the war in Ukraine.
‍

Information Warfare and the New Normal of Modern Conflict

Russian efforts to prime the information environment ahead of the invasion can be viewed as an attempt to justify the war to the domestic audience and to disrupt the response of Ukrainian allies. Russian narrative attack campaigns often seek to confuse, disorient, and overwhelm foreign audiences, making it difficult to determine truth from fiction. In this way, these campaigns can result in apathy and inertia from Russia’s purported competitors in responding to developments. Russia’s efforts to prime the information space failed this time, however – in part due to the Ukrainian response but also partly due to the unique approach that the U.S. took in addressing the invasion ahead of its commencement. In rapidly declassifying and sharing U.S. intelligence about the impending invasion, a healthy skepticism of anti-Ukraine narratives circulating online made it harder for Russian narratives to permeate the digital environment, leading to quick and resounding dismissals among international audiences. Once the invasion was underway, Ukraine’s allies were in some ways prepared for it, having been warned ahead of time an invasion was imminent and had likely been months in the making, meaning international condemnation was swifter than it otherwise might have been.

Additionally, effective counter-messaging by the Ukrainian government rallied a groundswell of international support. Meanwhile, the international community’s response against the Russian invasion has been rapid and unprecedented, with strict sanctions devastating the Russian economy, resulting in Russian entities being blocked from SWIFT, the freezing and seizing of Russian assets abroad, bans on many Russian imports, and the exit of many major global companies from Russian operations, among other things. Additionally, many countries have banned Russian aircraft from their airspace. Russia’s major flagship airline, Aeroflot, announced on March 5 that the company would be suspending all international flights, further isolating Russia from the rest of the world.

Russian leadership also clearly understands the danger of the shifting tide of narratives against them. In the days since Russia launched its invasion and global sentiment has overwhelmingly favored Ukraine, Russia has moved quickly to lock down and censor the domestic information environment. On March 1, Russia’s general prosecutor ordered the state censorship arm Rozkomnadzor to block the broadcasts and websites of Ekho Moskvy and Dozhd TV, the country’s two sole long-standing major independent broadcasters. On March 4, Roskomnadzor officially announced Russia would block social media sites access, claiming the platforms were “violating the rights and freedoms of Russian nationals.” Around the same time, Putin signed a law that made publishing what the government calls “false information” about the “special military operation” illegal – essentially banning media outlets from publishing accounts of the war that differed from those of military officials. It is more likely, however, that Russian leadership seeks to insulate the domestic audience from access to external media, perspectives, and coverage of Ukraine to prevent a widespread homegrown backlash against the war.

Information warfare will continue to play an integral role in the future of conflict. The battle for narrative control can affect how war develops and external support for the cause, as seen during Russia’s war with Ukraine. Counter-narrative attack efforts can shape action and response early on in these conflicts. As these high-stakes battles to control the narrative become the new normal of modern conflict, monitoring and early assessment of narratives will become essential in mitigating harmful impacts. Blackbird.AI continues to monitor the ongoing war in Ukraine to identify and expose disruptive narratives and influence strategies. Through tracking emergent and potentially destructive narratives, Blackbird seeks to contribute to the defense of digital integrity as this becomes an essential concern in future conflicts.

‍To learn more about how Blackbird.AI can help you with election integrity, book a demo.