By Mykola Balaban and Serhii Zhukov
The modern level of economic, political, and informational globalisation offers vast opportunities for development and progress. It also creates favourable conditions for influencing the emotions, beliefs, and behaviours of people worldwide due to the virtually unrestricted spread of information. Authoritarian regimes such as Russia weaponise informational influence tools in the same way they exploit economic dependencies, energy levers, and other resources to harm democracies. Ukraine, the EU, and the entire democratic world are forced to seek systematic solutions to effectively counter malicious foreign information manipulation and interference, or FIMI, in national and global information spaces.
Malicious influence on the information space is a crucial component of Russia’s aggressive war against Ukraine. Ukraine is subjected to the most aggressive and large-scale information attacks, where new FIMI technologies are tested in real-time. At the same time, Ukraine has unique experience in countering hostile information influences, which can be valuable for other democratic states.
Evolution of information warfare tactics
Russia began interfering in Ukraine’s information space and attempting to discredit it internationally long before its armed aggression. These operations aimed to destabilise Ukraine internally, sever its ties with partners, and isolate it on the international stage. In the early 2000s, the so-called ‘Kolchuga’ and ‘missile’ scandals negatively impacted Ukraine’s international reputation and its US relations. These alleged scandals were (unproven accusations, fuelled by Russia through disinformation campaigns, that Ukraine had sold radar surveillance systems and missile engines to Iraq and North Korea, respectively.
Russia also systematically targeted Ukraine’s efforts to deepen cooperation with NATO with disinformation campaigns. For example, pro-Russian political forces organised protests against military exercises on Ukrainian territory.
Just before and after the start of Russia’s armed aggression against Ukraine in 2014, Russian interference in the information space became significantly more aggressive. Russian efforts focused on spreading narratives both in Ukraine and abroad, including through claims of a ‘coup’, a ‘neo-Nazi Kyiv regime’, a ‘civil war’, and pseudo-historical and pseudo-legal justifications for Russia’s occupation of Crimea.
Preparation for the full-scale invasion in 2022 also included an information component aimed at justifying Russia’s claims against Ukraine and the West while shifting responsibility for the crime of aggression onto Kyiv. Key elements of this preparation included:
the intensified promotion of narratives about ‘one people’ and Ukraine as a ‘failed state’ (e.g., Putin’s article, ‘On the Historical Unity of Russians and Ukrainians’).
claims labelling Ukraine as a ‘terrorist state’ and a global security threat (e.g., allegations of Ukraine developing a ‘dirty bomb’ and biological weapons in ‘American biolabs’).
the Kremlin’s ultimatum to NATO in December 2021.
attempts to create a casus belli through accusations that Ukraine was preparing a large-scale offensive in Donbas, mobilisation in Russian-occupied territories, staged evacuations of civilians to Russia, the Kremlin’s recognition of pseudo-republics, and the collapse of the Minsk agreements.
An ‘information blitzkrieg’
When Putin announced the so-called ‘special military operation’ on 24 February 2022, he likely expected a quick victory. Consequently, information warfare and FIMI tactics were initially based on an ‘information blitzkrieg’ which included:
flooding the information space with ‘forecasts’ of rapid military success (‘take Kyiv in three days’);
spreading false reports about the capture of key cities, the mass surrender of Ukrainian troops, and exaggerations about the scale of Russian operations and the presence of sabotage groups (e.g., claims of Russian paratroopers landing in the Odesa and Lviv regions);
actions aimed at disorienting and overwhelming Ukraine’s Defence Forces and emergency services, provoking panic (e.g., false reports of ‘saboteurs disguised as medics’ or fake emergency hotline calls);
the dissemination of fake news about Kyiv’s surrender, including deepfake videos of President Zelenskyy.
During the first weeks of the full-scale war, the intensity of Russian information operations was extremely high, with Telegram serving as the primary platform for information manipulation. Russia created dozens of Telegram channels named after towns and regions it occupied or intended to occupy, publishing local news mixed with propaganda and disinformation disguised as rumours or ‘insider leaks’. Russian intelligence agencies also cloned Telegram channels of Ukrainian officials, military units, and other structures for information warfare purposes.
Information trench warfare and information exhaustion
From the fall of 2022 to early 2023, there was a shift towards ‘information trench warfare’. Russia redirected its FIMI efforts toward undermining public trust in Ukraine’s state institutions by exploiting issues such as power outages due to missile strikes on critical infrastructure, military mobilisation, and corruption.
Since late 2023, Russia has begun intensifying tactics that can be described as ‘information exhaustion’. This strategy involves emotional manipulation through AI-generated content, increased bot activity on social media, and attempts to immerse Ukrainian citizens in a state of permanent stress by amplifying war-related fears, eroding internal resilience and mutual trust, and provoking hatred and violence.
Key instruments of this strategy include:
spreading content about alleged mobilisation violations and calls for armed resistance to mobilisation (e.g., the false report in January 2024 about the ‘murder of a military recruitment officer in Kharkiv’);
manipulating corruption-related topics (e.g., leveraging high-profile corruption scandals in Ukraine’s medical examination system);
discrediting Western partners (e.g., manipulative narratives about military aid, its volume, and timeliness);
threatening nuclear blackmail (e.g., threats following the use of the ‘Oreshnik’ missile).
The ultimate goal of Russian FIMI is to convince audiences – both Ukrainian and international – that Ukraine’s resistance to Russian aggression is futile.
Key narratives
Russia’s main meta-narrative about Ukraine is: ‘Russia has legitimate rights to Ukraine and is protecting these rights.’ This idea is reinforced by supporting narratives about ‘one people’, ‘Russia’s natural sphere of influence’, and the ‘incapable’ Ukrainian state, among others. Centuries of systematic promotion have made this narrative a core part of Russia’s worldview and political culture. Additionally, it has significantly influenced how the region is perceived abroad and shaped foreign governments’ decision-making.
The Centre for Strategic Communications and Information Security, or CSCIS, has conducted continuous monitoring of the information space during the full-scale war and identified that the key targets of Russian FIMI attacks in Ukraine are state institutions and the resilience of Ukrainian society. Specifically, Russia aims at discrediting institutions and lowering public trust in them and the state as a whole, artificially segmenting and polarising Ukrainian society, and generating and escalating internal conflicts.
The ultimate goal of FIMI is to push Ukrainian society into a state of ‘war of all against all’ and to critically reduce the effectiveness of state institutions. Achieving this goal, in turn, is meant to validate the Russian narrative of Ukraine as a ‘failed state.’
Outlets promote this narrative both to foreign audiences and within Russia itself to justify the aggressive war and undermine international support for Ukraine. In influencing Ukrainian audiences, Russia uses narratives that serve the same purpose but often avoid the direct ‘failed state’ wording.
Russia employs a limited set of key narratives targeting both Ukrainian and international audiences. These mainly revolve around false claims regarding ‘Ukrainian Nazism’, ‘the 2014 coup d’état’, and other assertions of the ‘illegitimacy’ of Ukrainian authorities. Then there are unfounded allegations of war crimes committed by the Ukrainian army; the alleged discrimination against and persecution of Russian speakers, Orthodox believers, etc.; the total corruption and criminal nature of the Ukrainian government; the artificial nature of Ukrainian national and political identity; and claims that the Ukrainian population does not support the state.
Outlets use these narratives and their combinations both to destabilise Ukraine internally and to denigrate its influence and support abroad.
Spreading disinformation through Facebook adverts
In 2024, the CSCIS, together with the Centre for Democracy and Rule of Law, or CEDEM, presented the results of a joint study on the spread of destructive Russian narratives through Facebook adverts. Based on an analysis of nearly 600 adverts targeting Ukrainian audiences and published between March and November 2023, the study identified 12 key thematic areas in which these narratives were promoted.
Five of these 12 themes accounted for approximately 75% of the total volume of advertising. These themes were: ‘Front,’ ‘The West,’ ‘Mobilisation,’ ‘Corruption,’ and ‘Government.’ Within these themes, adverts promoted the following narratives:
‘Ukraine is suffering enormous losses on the front line’;
‘The government has decided to fight until the last Ukrainian’;
‘The Ukrainian Armed Forces’ command is incompetent’;
‘It is not worth fighting for a corrupt government’;
‘Mobilisation equals guaranteed death’;
‘The West benefits from the war’;
‘The government is profiting from the war’.
The goal of promoting these narratives was to influence public opinion and the behaviour of Ukrainians and to avoid mobilisation into Ukraine’s Defence Forces. These narratives aimed to exploit natural fears and shift the focus from defending the homeland to ‘defending a corrupt government’.
Focus on corruption
In fact, corruption is a key theme used in FIMI targeting Ukraine. The narrative portraying Ukraine as a ‘totally corrupt’ country or even ‘the most corrupt country in the world’ is a component of the failed state narrative. Its promotion aims to undermine trust in state institutions, discredit international aid to Ukraine, and influence citizens’ behaviour, particularly regarding mobilisation.
A 2024 study by CSCIS, based on an analysis of over 130,000 messages, identified the following key corruption-related narratives:
‘Volodymyr Zelenskyy is involved in corruption / covers up corruption within his administration’;
‘Ukraine is selling Western weapons’;
‘Ukraine is losing the war because of corruption’;
‘Ukraine and the West are tied together by corrupt dealings’.
These narratives continue to be disseminated using various tools and techniques designed to increase audience trust in the manipulated information.
A group of Russian-language channels, some of which are affiliated with the Russian special services and have previously appeared in research on disinformation and information attacks.
FIMI ecosystem
Research conducted by CSCIS has identified and analysed the tools used to spread harmful narratives, as well as the networks that form the ecosystem of information manipulation.
To achieve destructive objectives, the following methods are employed:
pseudo-Ukrainian resources, including clones of well-known media outlets and official pages of public figures; fake Ukrainian platforms (primarily Telegram channels); pseudo-patriotic social media pages and groups; and anonymous resources, profiles, and pages of little-known bloggers;
bot farms and other tools for coordinated and synchronised content distribution such as identical posts and comments on social media;
Russian resources, including federal and other media; Telegram channels that openly reveal their Russian origins; and the pages and profiles of pro-Kremlin bloggers.
Key actors in promoting Russian narratives and information manipulation include:
Russian officials (including Vladimir Putin), as well as the information resources of diplomatic missions;
official Russian government platforms such as ministry websites, social media pages, and state-controlled media;
Russia’s international broadcasting system, including RT and Sputnik.
The blocking of Russian TV channels since 2014 and social media platforms since 2017 in Ukraine has pushed Russia to adopt alternative platforms for influencing Ukrainian audiences. This has led to increased activity on foreign social media platforms such as Facebook and Twitter. And from at least 2018, Russia has systematically developed an ecosystem of pseudo-Ukrainian Telegram channels both on the national and regional levels.
A network of regional and country-wide telegram channels administered by user A_MENEJER and his group based on the orders of Russian secret service.
Sanctions, the blocking of Russian international broadcasting channels, and website restrictions in the West have not prevented Russia from reaching foreign audiences. Beyond its ecosystem of bots and Russian/pro-Russian profiles on X (Twitter), Facebook, Reddit, TikTok channels, and other social media, the Kremlin exploits alternative online platforms. Since 2023, a network of websites under ZOV / Pravda has been in operation. ZOV sites disguise themselves as regional Ukrainian news outlets, while the Pravda network spreads Russian content in English, French, Spanish, and other European languages.
Additionally, outlets use foreign media and bloggers to legitimise disinformation campaigns. For example, the false claim that Olena Zelenska purchased Cartier jewellery worth $1 million was spread by the Nigerian website The Nation, which cited an almost empty Instagram profile. Similarly, the fake story about Zelenskyy’s mother-in-law owning a luxury villa was shared by Egyptian blogger Mohamed Al-Alawi.
Another practice creates fake news websites that closely resemble or even copy existing or defunct media outlets to conduct information attacks. For instance, to spread the false claim that Olena Zelenska purchased a Bugatti, a website called Verite Cachee France was registered under the .fr domain. Likewise, the fake story that Volodymyr Zelenskyy bought Hitler’s ceremonial car was published on the dubious website Seattle Tribune.
Disinformation campaigns rely not only on fake news but also on real news events, which are distorted to serve manipulative narratives. Key tactics include using manipulative wording and misleading generalisations, cherry-picking facts, manipulating their sequence, and establishing false cause-and-effect relationships. Such messages also try to appeal to audience emotions, citing so-called ‘experts’ and unreliable sources. Even real events, such as the exposure of corruption schemes or the arrest of suspects, are exploited to reinforce the Russian narrative of ‘total corruption’ in Ukraine.
How Ukraine has adapted to information threats
During the war, Ukraine has mobilised resources to counter Russian aggression, including information threats, by leveraging both its own experience and the expertise of its partners.
Ukraine’s methods to counter FIMI aim to enhance effectiveness by shifting the perspective on information threats. Legislative regulation of the media space, sanctions against Russian media and social networks, debunking false information, and promoting media literacy are essential but insufficient measures under current conditions. This is because harmful influence is exerted not only through fake news and direct disinformation but also through truthful information used to manipulate audiences.
Overall, Ukraine’s response to information threats involves the state, civil society, media, and individual citizens who are not part of institutionalised initiatives. Among state actors, key institutions include:
the Ministry of Culture and Strategic Communications and its subordinate Centre for Strategic Communications and Information Security, or CSCIS;
the Ministry of Defence, the Armed Forces of Ukraine, or AFU, and their communication units;
the National Security and Defence Council, or NSDC, and its Center for Countering Disinformation, or CCD;
the National Council on Television and Radio Broadcasting;
security agencies, including the Security Service of Ukraine, or SBU, the Defence Intelligence Directorate, or HUR, the Foreign Intelligence Service, and the State Special Communications Service.
These state institutions develop and implement Ukraine’s communication strategy, regulating the information space (e.g., blocking Russian resources and imposing sanctions), monitoring the information space, identifying and neutralising threats, detecting and prosecuting individuals involved in FIMI operations ,and providing timely public information and debunking disinformation .
Civil society and independent media play a critical role in countering disinformation. Key actors include:
fact-checking and OSINT (open-source intelligence) organisations such as StopFake, InformNapalm, Molfar, and OSINT Bees;
NGOs and media watchdogs including the Institute of Mass Information, Detector Media, and the Centre for Democracy and Rule of Law;
national and regional media that create original content on information threats and provide informational support to government efforts and independent initiatives.
Additionally, Ukrainian journalists, bloggers, and social media users work to neutralise information threats, counter Russian hybrid influence abroad, and advocate for Ukraine’s interests.International assistance plays a crucial role in Ukraine’s fight against disinformation.
The European Union, through various programmes, provides institutional, organisational, and financial support to analyse and neutralise FIMI threats, strengthen strategic communications, and improve media literacy and public awareness. This comprehensive approach has helped Ukraine adapt and strengthen its resilience in the face of ongoing information warfare.
FIMI as a tool of hybrid warfare
The threat of Foreign Information Manipulation and Interference (FIMI) goes beyond spreading false information and fake news, most of which can be debunked relatively easily. The real danger lies in embedding destructive narratives into the public’s consciousness. These narratives are particularly insidious because any information, including selectively framed or manipulated truthful facts, can be used to reinforce them. As a result, individuals who adopt these narratives tend to trust information that aligns with their beliefs while rejecting facts that contradict them, regardless of accuracy or intent. They can also develop a presumption of distrust toward state institutions, official sources of information, and even fellow citizens.
Russia’s ongoing aggression against Ukraine cannot be viewed in isolation from its broader hybrid warfare against NATO and EU countries which includes information operations, active measures, sabotage, and other destabilising tactics. Viewing war solely as a conflict over territorial control is an outdated perspective. Modern warfare is about controlling reality by imposing narratives that shape collective perceptions and behaviours. Information security is one of the most critical and vulnerable components of national security. To strengthen societal resilience, strategic communications efforts must focus on restoring trust in institutions, promoting constructive and beneficial narratives, and countering the influence of destructive information campaigns. At the same time, democratic states must not only counter existing threats but also prevent future ones by depriving Russia and its allies of the resources needed to wage hybrid aggression against democracies.
Mykola Balaban is a veteran of the Russian-Ukrainian war, a historian, and an expert in hybrid warfare. Since 2021, he has served as Deputy Head of the Center for Strategic Communications and Information Security of Ukraine, where he coordinates efforts between government institutions, civil society, and international organizations to counter Russian disinformation and strengthen strategic communications. Previously, he headed the Situation Center at the Ministry of Foreign Affairs of Ukraine, overseeing global media monitoring and crisis communication strategies. Dr. Balaban holds a Ph.D. in History from the Ukrainian Catholic University and was a Junior Visiting Fellow at the Institute for Human Sciences in Vienna. His research and publications focus on information warfare and large-scale violence in Ukraine.
Serhii Zhukov, Ph.D., is an Ukrainian journalist and expert in countering disinformation and strategic communications. Не is an analyst of Centre for Strategic Communication and Information Security. He has formerly held various positions in leading Ukrainian media. As an analyst of Centre for Strategic Communications he have made researches about russian genocidal rhetoric, spreading disinformation through Facebook ads, influence operations etc.
Article and pictures first time published on the EUvsDisinfo web page. Prepared for publication by volunteers from the Res Publica - The Center for Civil Resistance.
