100 days of war: Information war peaked during Russia’s invasion of Ukraine

False narratives, manipulated photos, and fabricated videos have all become part of the Ukraine-Russia conflict. The war is not only on the ground but also on the internet. Disinformation is becoming a major tool for manipulating the perception of a targeted audience.

Social media platforms have been used as weapons to change the narrative of war. Russia’s disinformation and propaganda ecosystems propagated false narrative against Ukraine. Several cyberattacks on Ukrainian government infrastructure were carried out in order to weaken their defence. Ukraine also retaliated with official and unofficial cyber and information technology (IT) teams established by the government and private networks.

Social media and its widespread adoption have changed the nature and practice of human interaction for much of the world. The spread of intentionally false information on social media is often exacerbated by automated or “bot” accounts.

COORDINATED SOCIAL MEDIA CAMPAIGN

In the first week of March 2022, Twitter was flooded with a coordinated campaign promoting a pro-Putin and anti-Ukraine narrative using the hashtag #IStandWithPutin.

An investigative report published by the US-based Digital Forensic Lab (DFR Lab) said that the pro-Russian hashtag trended globally after being amplified by a suspected network of accounts, many of which were based in India.

Screenshots from several accounts using identical text and similar images. The tweets on top copied both text and media from the original poster (in red) while the tweets on the bottom reused media from other viral tweets while keeping the text (Source: DFR Lab)

THE PROPAGANDA WAR

Fabricated civilian casualty narrative

Another campaign began on March 1 after a night of Russian strikes on Kyiv and other Ukrainian cities, when a group of Russian-language Twitter accounts spread the lie that Ukraine was fabricating civilian casualties.

The social media campaign promoted a video purportedly from Ukraine, in which a man stands in front of body bags filled with corpses. While the man spoke to the camera, an encased body made an arm movement.

According to a report published by the US-based investigative media site ProPublica, the video is taken from an Austrian TV report about a climate change demonstration held in Vienna in February.

Video from Bucha

It was clear that the Russia-Ukraine war had become a breeding ground for a series of disinformation campaigns, with Russia attempting to justify their war crimes in Bucha by changing the narrative and claiming it was Ukraine’s propaganda against them.

Ukrainian President Volodymyr Zelenskyy accused Russia of carrying out a massacre against civilians in Bucha, a town outside of Kyiv. Several videos and photos of bodies on the streets of the town were circulating on the internet.

The viral videos claimed that men seen lying down on Bocha Street pretending to be dead were part of Ukraine’s propaganda.

Aurora Intel, an OSINT investigation site, analysed the video and found that the men were indeed dead.

Getting fed up of this “it’s a moving arm” bullsh.. it’s a raindrop on the windscreen, alongside an inverted channel version for more clarity. The whole arm moving thing is just ridiculous. pic.twitter.com/ZiuEX4rFWc

— Aurora Intel (@AuroraIntel) April 3, 2022

According to BBC journalist Shayan Sardarizadeh, many Russian handles, including those of the Russian Embassy and the government, promoted this false narrative. Alexander Alimov, Russia’s permanent representative to the United Nations in Geneva, also posted the video on April 3, but it was later removed.

It’s day 39 of Russia-Ukraine war.

1) Dozens of Russian embassy and government accounts as well as pro-Kremlin activists are claiming videos coming out of Bucha are fake or staged because the bodies can be seen moving or sitting up.

So, Let’s take their claims one by one. pic.twitter.com/SrwvNTCWOM

— Shayan Sardarizadeh (@Shayan86) April 3, 2022

Fake IEDs

On February 22, 2022, an improvised explosive device (IED) was reported to have detonated on the highway between Donetsk and Horlivka in Ukraine’s separatist region. Three people were killed in this incident.

Experts from the investigative media site Bellingcat debunked the claim of an IED explosion. “This was an apparent IED attack used by separatists and Russian media as evidence of Ukraine’s aggression, including the staged use of cadavers and likely faked IED damage,” they said.

Russian fake fact checks

According to the report published by ProPublica, the fake fact-check videos capitalise on these efforts to persuade Russian-speaking viewers that Ukrainians are widely and purposefully disseminating false claims about Russian airstrikes and military losses. Transforming debunking into disinformation is a new tactic that has not previously been documented during the current conflict.

THE CYBER WAR

Several hacking groups have been targeting Ukraine’s infrastructure in order to cause more outages and disruptions to all services.

CERT-UA, Ukraine’s government team for responding to computer emergencies, is constantly notifying and releasing reports on Russian cyberattacks.

Cyberattack on satellite KA-SAT network

The European Union has accused Russia of carrying out the cyberattack on the KA-SAT satellite network.

According to the EU Council, the cyberattack occurred an hour before Russia’s unprovoked and unjustified invasion of Ukraine on February 24, 2022, facilitating military aggression. It had a significant impact, causing unnecessary interruptions and disruptions to communication for several public authorities, businesses, and users in Ukraine, as well as affecting several EU Member States.

Cyberattack on state authorities of Ukraine

CERT-UA issued a report on April 28 informing of a cyberattack on Ukrainian state authorities using the metasploit framework. The pattern of this attack suggests a link to the UAC-0098 hacking group.

Cyberattack on Ukraine’s electrical substation

According to the CERT-UA report, Sandworm Group (UAC-0082) launched a cyberattack on Ukrainian energy facilities in April, employing the malicious programmes INDUSTROYER2 and CADDYWIPER. Sandworm, also known as Unit 74455, is allegedly a Russian cybermilitary unit of the GRU, Russia’s military intelligence organisation.

Mass distribution of JesterStealer malware

Another CERT-UA report, issued on May 7, warned of the widespread distribution of emails containing attachments containing the JesterStealer malware. This programme steals authentication and other information from web browsers.

Phishing campaign conducted by Russia linked Armageddon APT

On May 12, 2022, the Ukraine Computer Emergency Response Team (CERT-UA) reported a phishing campaign involving an email with the subject “On revenge in Kherson!” and a file attachment named “Plan Kherson.htm.”