Russia appears to be behind claims that Ukrainians are torturing each other

A thread claiming to show Ukrainians mercilessly beating men, women, and children has gone viral. It appears tied to Russian state media and was shared over 20,000 times before it was removed.

Mar 22, 2022

NOTE: This is a working paper and has only been published early to prevent false narratives from spreading.

Updated: Shortly after 9 pm ET, Twitter suspended one of the accounts spreading the graphic disinformation videos, but the narrative was allowed to spread long after Twitter became aware of the account. The platform had deleted other earlier posts.

Update-2: Twitter suspended another account in this report. The original poster of the videos is telling people in the Telegram channel to post the videos from Telegram to Twitter.

Updated-3: Multiple suspended accounts have been reinstated on Twitter and are engaging in coordinated amplification of false narratives about Ukraine.

Videos claim to show Ukrainians torturing each other

A thread claiming to show Ukrainians mercilessly beating men, women, and children has gone viral. That Ukrainians could even be outside their homes with the non-stop shelling beggars belief. Still, I found a lot of questionable details about this account and the post, followers, and retweeters.

Account history

Archive history shows the user claimed to be from Scotland earlier but has since removed that from the profile. The account used to have a listed name that looked something like “Elon Musk,” at which point it promoted links for “eloninvest.org.” The account went dormant for a years-long period, as is common with inauthentic accounts.

The user is clearing 400 tweets per day, with the majority of tweets in support of pro-Kremlin narratives. This is an exceptionally high number of tweets, especially from an account that had no tweets for years before this.

TruthNest assesses the account as highly active and highly influential. Content from this user may be designed to reduce support for Ukrainians by portraying them as Nazis or violent. EUvsDisinfo covered “denazification” as one of the key long-term narratives for the Kremlin. The crisis actor claims didn’t work out, so maybe this is trying something new.

All of the user’s most popular tweets promote the idea that "the media" are conspiring to lie about what is happening in Ukraine. Almost all of the user’s tweets are pro-Kremlin. Genuine users — even when they are zealous activists — rarely focus on a singular topic like this. A "sole tweeting purpose" is a recognized indicator of inauthentic activity.

The percentage of activity from this account from replies is unusually high. Sometimes this can mean the account is a "reply guy.” Whether “the media” report on this or not, we can see what is happening in Ukraine from satellite.

A pinned tweet is a new pro-Kremlin OSINT account

The author of the pinned tweet is new and appears to be an OSINT account, possibly to gain traction using the popularity of OSINT accounts in gaining independent intelligence on the war.

The user has a backup account listed in the user’s bio. Already the account was suspended for Ukraine disinformation. It used a backup account to evade the ban and did so openly. Ban evasion is a policy violation so this account remaining online is disappointing.

Following and Followers

The account follows multiple Russian state media outlets and also employees, but used to appear to be from Scotland. Today it follows Spanish-language Russian state propaganda channels and hosts and is exceptionally focused on the situation in Ukraine—especially how much people don’t approve of Russian aggression. Additionally, the account follows a host from Iranian state TV and an account for the so-called People’s Republic of Lugansk.

Retweeters

Perhaps the most relevant connection is that an early retweeter of the torture videos also retweeted the account that seeded the maternity hospital disinformation narrative in the days before the attack (possibly suggesting foreknowledge) and spread false claims about one of the victims after the bombing. Russia has now repeated the pattern of claiming a location is a military base, bombing it, and then sowing incoherent narratives about what happened.

Some of the earliest accounts interact with the thread by tagging news outlets or highly influential figures in far-right politics or anti-vaccine movements. Another user who quote tweeted one of the disinformation tweets is posting about Lia Thomas, a transgender athlete, and vaccine requirements.

Older posts showing the torture content had been removed, but Twitter has allowed some of the accounts posting this content to increase and spread doubt about the claims of people being killed in Ukraine. It’s clear Twitter is aware of the account because it has removed other posts with similar videos.

One account that retweeted the original thread had a Telegram channel, so I looked at it.

Account has a preference for Russian state-affiliated author

The retweeter’s Telegram channel shares content from Andrew Korybko, who writes for at least a dozen Russian-state affiliated outlets, including Sputnik News to OneWorld.Press.1

The Telegram post link is an outlet recognized as controlled by the GRU. One World had the InfoRos logo in its directory. The GRU controls InfoRos. The US Treasury said of InfoRos:

The GRU operates InfoRos. InfoRos calls itself a news agency but is primarily run by the GRU’s 72nd Main Intelligence Information Center (GRITs). GRITs is a unit within Russia’s Information Operations Troops, which is identified as Russia’s military force for conducting cyber espionage, influence, and offensive cyber operations. InfoRos operates under two organizations, “InfoRos, OOO” and “IA InfoRos.”

Denazification narrative

Korybko circulated false claims about denazification recently. He’s still on Facebook spreading pro-Kremlin disinformation but should have been removed a long time ago for promoting 2020 election disinformation. At least two of these outlets are linked to Russian intelligence.

The channel is spreading disinformation about the Syrian use of chemical weapons and sharing content from authors affiliated that work for Russian-state media and an outlet affiliated with the GRU. The channel link history shows content from Global Research and Grayzone. Tribune.com.pk frequently published Russian state-affiliated authors.

Time is of the essence, so I'm sharing this now.

Hoaxlines Lab