Spilnota Detector Media

Disclosure Unknown people are sending letters with a message about Russia's repeated attack on the Kyiv region

According to the Department of Strategic Communications of the Armed Forces of Ukraine, the enemy is trying to sow panic among residents of Ukrainian cities who have been liberated from occupation. "We have sent out text messages about the possible re-attack of the aggressor in the Kyiv region. Do not succumb to provocations! The Armed Forces of Ukraine are closely monitoring the actions of the Russian army at the borders, control the situation, and are always ready to meet again with the Russian occupiers." reported the administration.

Disclosure Fake letters are allegedly sent to Volyn entrepreneurs from the regional state administration. In Volyn, entrepreneurs receive fraudulent letters allegedly on behalf of the Volyn Regional State Administration

According to the regional state administration, the fraudsters tried to extort funds "from the Armed Forces of Ukraine."

"It became known about the letters on fundraising for the Armed Forces of Ukraine, which are received by entrepreneurs in Volyn allegedly on behalf of the Volyn Regional State Administration. Be careful! These are scammers. The Volyn Regional State Administration did not send such letters, " said in the statement. According to the fact-checking project "Brekhunets," the regional state administration's economic department told them that several entrepreneurs had applied to the regional state administration with such a problem. As it turned out, fraudsters sent many similar letters.

Disclosure Russian special services are trying to intimidate the Ukrainian military by sending threatening messages to personal numbers

 The General Staff of the Armed Forces of Ukraine has warned that Russia's special services are trying to intimidate the Ukrainian military by sending SMS, telegram, Viber, Signal, and WhatsApp messages to personal numbers threatening to break an oath, give up, surrender or side with the enemy. The General Staff of the Armed Forces of Ukraine explained that these threats are aimed primarily at morally destabilizing units of the Defense Forces of Ukraine, sowing doubts and reducing morale. "Threats of personal data (surname and name of the person, taxpayer's code, place of registration and, sometimes, data on the number and composition of the family) are increasing," the General Staff of the Armed Forces said. - The text of the threats refers to the alleged exact location of the person who received the message; it is noted that, in case of continuation of service, missile strikes will be fired at the exact residence of the telephone owner and his family. " At the same time, the personal data in these reports are usually outdated (the person has already changed the place of registration, moved to another location, changed the military unit, etc.). 

Disclosure In Popasna, the Russians attributed Bohdan Khmelnytsky to the "national battalion"

Russian occupiers were so impressed by the district museum of local lore in Popasna in the Luhansk region that they shot a video about it and disseminated it in the pro-Kremlin media, including Ria Novosti. According to them, the museum has a whole hall about one of the most common inventions of Russian propaganda about Ukraine - the so-called national battalions. To which, to their ridicule, they attributed Bohdan Khmelnytsky. In the video, the Russians show part of the exhibition dedicated to the anti-terrorist operation and the events of 2014-2017, in the center of which are the books "History of Ukraine," "Battle for Konotop" by Vladyslav Karnatsevych from the series "Famous Events of Ukrainian History" and "Archaeological war." The last book is a methodological recommendation of the Institute of Archeology of the National Academy of Sciences of Ukraine, which is designed to guide the military in a situation where the threat of destruction of archaeological heritage and how to minimize it.

Disclosure Cyber ​​attacks were again carried out on the state authorities of Ukraine

According to the State Special Service, employees of state organizations in Ukraine receive new dangerous e-mails with the file "changes in wages with accruals.docx." Experts say that the document's opening threatens to damage the computer with malicious software Cobalt Strike Beacon. It is known that the document contains a link to an external object (HTML file containing JavaScript code), the opening of which will lead to the launch of the PowerShell command, download the EXE file "ms-msdt.exe," and damage the computer. The State Special Communications Service and Information Protection of Ukraine asks employees of state organizations to be careful and work on blocking the domain name and the corresponding server.

Disclosure Content that discredited Ukrainian refugees and promoted Russian narratives was broadcast on 27 Polish-language telegram channels

Givi Gigitashvili and Esteban Ponce de Leon, specialists from the Digital Forensic Research Laboratory (DFR Lab) of the Atlantic Council, identified 27 Polish-language Telegram channels that disseminated misinformation about refugees from Ukraine. It is reported that several channels initially published content in Russian but eventually switched to Polish. According to experts, the promoted content is unfounded because of anti-refugee, pro-Kremlin and anti-vaccination theses. According to researchers, the purpose of the channels is to influence public opinion about people who come to Poland from Ukraine. Read more.

Disclosure Through loyal Western experts, Russia is promoting the narrative of its imminent victory and the need for Ukraine to make concessions

According to the Center for Countering Disinformation, in particular, the French Center for Intelligence Research has published an analytical report that partially promotes the Kremlin's narratives about "inexperienced Ukrainian soldiers" and the "professional Russian army"; Former US Senator Richard Black spoke in an interview with English-language media about Russia's imminent victory, as "Russia cannot afford to lose because of the threat of NATO enlargement"; Italian General Leonardo Tricarico called on the EU to abandon the "crazy idea of ​​winning the war in Ukraine" and persuade Ukraine to surrender so as not to provoke Russia to use weapons of mass destruction; The German Schiller Institute held an international discussion on the threat of World War III, and the participants concluded that "the confrontation with Russia is detrimental to Germany and the EU." It will be recalled that this is not the first time that Russian propaganda has tried to promote its narratives through “Western experts.” In this way, the propagandists want to create the appearance of support for Russia's actions by the Western world.

Disclosure Russian invaders are given manuals in which they are taught to answer the questions of Ukrainians in the occupied territories.

The word "war" is recommended not to be used and admit that they are Russians.

In the village of Dymerka (Kyiv region), liberated from Russian aggressors, the National Museum of Ukrainian History staff found manuals explaining how to answer questions from the local population. The NotaYenota project published two pages of these manuals, and their existence was confirmed to Detector Media by the museum staff. According to them, the document was found in the village council, which the Russians seized.

These “guidelines” recommend that occupiers not use the words "war" and "murder.” Answer all the questions so that "the residents believe that the Ukrainian authorities have left the local population without pensions, social benefits, protection, electricity, and water."

We must also avoid explicit recognition that the occupiers are Russians; we must answer that the invaders are "both Russians and Ukrainians, but most importantly - that they are Orthodox," as well as Ukrainians. The primary purpose of such answers is to make people doubt the Ukrainian government and shift the responsibility for the war to the government or the president.

These methods are another proof of the information war against Ukrainians and an example of military information and special psychological operations conducted by murderers in the Ukrainian occupied territories.

Disclosure The French ex-military man lies when he talks about the "war crimes" of the Ukrainian military, which he allegedly witnessed

Fact-checkers from CheckNews, a subsidiary of the French newspaper Liberation, have exposed lies and manipulation by former military man Henry Boke, who has recently appeared on television in foreign media as a witness to "Ukrainian war crimes, including the Azov," who seem to have seen with their own eyes. In particular, he claimed to have seen members of Azov "systematically shoot at the feet of captured Russian soldiers and then execute Russian officers" - all of which, according to Boke, took place in Bucha. The publication checked his message - and found no evidence that he could even see anything of what he was telling a foreign audience. Yes, the fact-checkers received information that Boke was in Ukraine several times, but most of his trips were for one day - he entered and left on the same date, for example, April 4. All border crossings took place in the Lviv region. And even the only time he was in Ukraine for almost three days (less than 72 hours from April 17 to 19), he was in Lviv and witnessed the Russian shelling of the city on April 18, as evidenced by his photos. He could not physically reach Bucha once when he was in Ukraine. Also, there is no evidence that he communicated with the Ukrainian military - only photos of checkpoints in his photo.

Researchers also spoke to his former colleagues in the military unit he served, claiming he lied a lot. You can read more about Boke here.

Disclosure The head of the Lviv regional military administration, Maksym Kozytskyi, said three fake chatbots "Shos letyt" appeared in the telegram

According to him, in these bots, attackers try to convince users that the real chatbot does not work. The “Shos letyt” chatbot, developed by Lviv Regional Military Administration specialists and IT specialists at the request of “Zahid” Air Command, is running smoothly. The bot works only in the mobile version of the telegram application. It allows all willing residents of the Lviv region to report the threat in the sky (missile, drone, or plane) and Ukrainian defenders - to neutralize it. You must log in through the "Diia" application to report a hazard.

Disclosure Telephone scammers “offer help in the release from captivity" of the Ukrainian military for money

The General Staff of the Armed Forces of Ukraine warned about attempts by scammers to get rich at the expense of relatives of the Ukrainian military. "Relatives of soldiers of the Armed Forces of Ukraine have started receiving suspicious phone calls and messages," the General Staff of the Armed Forces of Ukraine said. - Using the emotional state of relatives and friends, the attackers call from hidden numbers and offer to "provide information" about the military and "facilitate the release from captivity" for a monetary reward. The scammers are also trying to find out the personal data of Ukrainian defenders, allegedly as clarification. "

Disclosure Marianna Vyshemirska from the Mariupol maternity hospital debunks the fakes of Russian officials

The photo of a pregnant woman escaping from a bombed maternity hospital has become one of the symbols of the bloody war in Ukraine. The heroine of this photo, Marianna Vyshemirsky, immediately found herself at the center of a fierce disinformation campaign, as a result of which she was flooded with hatred from Internet users. In an interview with the BBC, the Russian service debunked the false claims of Russian officials. It is her first interview with popular Western media since being evacuated to her hometown of Donetsk, a territory controlled by pro-Russian separatists. Denis Seleznyov, a blogger who actively supported pro-Russian separatists and was interviewed after fleeing Mariupol, helped organize the conversation with the woman. Did the explosion happen near the maternity hospital, which did not work? The Kremlin has repeatedly stated that the blast took place near the maternity hospital №1, which did not actually work with patients at that time. According to the BBC's disinformation department, Marianne was in the maternity hospital №3. Marianne confirms that the hospital where the maternity hospital was located was operating and had patients. The Russian authorities claimed that it no longer functioned as a medical facility.

Did the Azov Regiment seize the maternity hospital? Russia has claimed that the Azov Regiment seized the building, which Moscow calls a "Nazi" organization, which Ukraine denies. From Marianne's interview with Denis Seleznyov, Russian officials chose isolated phrases to create a narrative that Ukrainian soldiers allegedly used Marianne and other pregnant women as a human shields. Marianne tells the BBC that there were no soldiers in the building where she was. According to her story, she saw Ukrainian soldiers in the oncology department, located across the building from the maternity ward. Still, she did not know whether they had a base there. However, Marianne's phrases from an interview with Denis Seleznyov were used by the Kremlin to come up with a new lie.

Russian officials used her words, saying that she does not think an airstrike caused the hospital bombings. It was a Ukrainian shelling, they said.

"The characteristic sound of an airplane when it flies, it is impossible not to hear it," Marianne said in an interview, adding that she had not heard such a sound.

But journalists from the Associated Press documented evidence that the plane crash was - including in the video, where the sound of the plane can be heard. In addition, the military and police are talking about the airstrike on video at the scene. In addition, the photos show a giant funnel, which, according to weapons experts, could remain only after the bomb.

"I haven't seen this funnel, but I've seen the video," said Marianne.

"In fact, I can't blame anyone because I didn't see with my own eyes where it came from," she added.

This controversial moment caused another wave of bile from the trolls.

"On the one hand, I was considered an actress. On the other hand, they thought I was lying that there was no airstrike,” explained Marianna.

Did Marianne take part in the production? Before the war, Marianne advertised cosmetics on her blog. One pro-Kremlin telegram channel lied that the photos from the delivery room were staged. Based on the fact that Marianne was a beauty blogger, the authors said that she was an actress, which made up for the victim. This lie has been repeated many times by high-ranking Russian officials and Russian state media. "It was unpleasant to hear because I really went through it," said Marianne.

Among the people she considered friends were those who did not believe her. For example, beauty blogger Yaroslava, who lives in Russia, believes Russian television claims that Marianne took part in the production.

"I think Marianne played her part. Ukraine needed so that the Ukrainian military could blame Russia for everything," Yaroslava said. Since then, she has unfollowed her former friend on Instagram and no longer talked to her.

"It`s sad, of course, when acquaintances believe in something I haven't done, and I'm not capable of because, for me, my conscience has always been above everything," Marianne replied.

Disclosure Foreign journalists in the Kherson region turned out to be Putin's fans

A Russian propaganda channel called Channel One aired a story about alleged "foreign journalists" who visited the occupied Kherson region. In fact, it turned out that these "journalists" are bloggers - fans of Putin, who have been living in Russia for many years. Ilya Shepelin, a former journalist for the Dozhd TV channel, drew attention to this. He wrote about it on his Twitter page - “Thomas Roper and John Dugan, whom they described as "foreign journalists," did not work for any media outlet.”

"Channel One showed a story about how enthusiastic" foreign journalists "visited the occupied Kherson region. In fact, these "journalists" were Putin's bloggers, who have lived in Russia for many years - Thomas Roper and John Dugan, who do not work in any media, " Shepelin wrote.

Before that, the propagandists made headlines about Roeper as a "journalist for Anti Spiegel from Germany." However, in reality, it is his blog, which was also created on a domain registered in Russia. In this blog "loyal to Putin," Roper rebroadcasts all the Kremlin's methods written on the Telegram channel "Trukha Ukraine."

Disclosure Russia promotes the narrative that the world and Ukraine need to make concessions and negotiate with it through loyal foreign experts

This is reported by the Center for Combating Disinformation at the National Security and Defense Council of Ukraine.

The National Interest has published material by USA intelligence veteran Paul R. Pillar. He states that "humiliating" Russia with sanctions and removing Putin from power "will harm the whole world."

Serbian political scientist George Vukadinovic, interviewed by Kremlin media abroad this week, also spoke about Russia's greatness. Vukadinovic claims that NATO "should be held responsible for the war" in Ukraine. In a Politico article, scientists Patrick Portman, Justin Logan, and Benjamin M. Friedman suggested that Ukraine should return to "negotiations with Russia" because the West was giving Ukraine "false hopes of victory" in this war, hiding that it could not help money and weapons for so long.

Disclosure The SSU has received evidence that the rocket attack on the Kramatorsk railway station was committed from the occupied Donetsk region

The Security Service of Ukraine received irrefutable evidence of the direct involvement of the Russian occupiers in the shelling of the railway station in Kramatorsk on April 8, which killed 61 people and injured 121 people.

Due to many studies on the missile's trajectory, it was established that the rocket attack was made from the Donetsk region, which has been under temporary Russian occupation since 2014.

Experts confirmed that a 9M79-1 guided single-stage solid-fuel missile with a cartridge charge was used for the shelling. It is widely known as "TMC Tocka U."

According to the SSU, several complexes with "TMC Tocka U" are located in the occupied territories of Donbas and have been used by invaders for eight years.

Disclosure Fake bitcoin "hoaxes" and messages about allegedly accruing monetary aid to Ukrainians from different countries are spread in the networks of telegram channels in Rivne region

In this way, they are trying to increase the audience of telegram channels, taking advantage of the current vulnerability of Ukrainians in terms of finances, the Brekhunets project fact checkers write. In particular, the "ads" for money attach links to which you need to click to receive funds - in one version it is the age of the person, in another - the bank. Once the link is clicked, no money is involved. In the case of "crypto" anonymous organizers without mentioning the beginning and end of the draw offer to fulfill simple conditions: subscribe to the channel and put "+" in the comments. On the channel to which they offer to subscribe, there is no mention of cash equivalents, the end date of the drawing is indicated (not a close date) and all the content is in Russian. Read more

Disclosure In Mariupol, the Russian military is preparing the biggest falsification of "witness testimonies"

According to Petro Andryushchenko, advisor to the mayor of Mariupol, the Russian army will collect testimony from Mariupol residents that Mariupol was destroyed by the Ukrainian army. Andryushchenko reports that remained in the city in writing. "For such an operation Russian kafirs announced the beginning of registration for compensation for the destroyed housing and / or loss of a family member. For housing - 500 thousand rubles (approx. 6 thousand dollars), for the deceased family member - 3 million rubles (approx. 33 thousand dollars).

Registration of applications for compensation is carried out in the premises of school №9. However, when submitting a handwritten application, Mariupol residents must necessarily note that the property "was destroyed by the Ukrainian military" and that the relatives "were killed by the Ukrainian army". In the absence or refusal of such a note, the Kafirs inform them that no compensation will be made. Given the psychological pressure and the state of information blockade, Mariupol residents hopefully submit applications with relevant notes," Andryushchenko wrote.

He added that Russia ends up with tens of thousands of handwritten "testimonies" about the "atrocities of the Ukrainian army," which are to be used to influence international opinion, including with extensive publicity through propaganda media channels that continue to operate in the EU.

"In reality, it is not possible to carry out such compensation. To fulfill these promises to the people of Mariupol alone, Russia must spend at least $2.5 billion. Which in the current state of Russia's economy is impossible," Andryushchenko writes. As a reminder, Russia has repeatedly tried to justify the crimes of its army and accuse the Ukrainian military of them. In particular, Russian propaganda tried to pass off as a resolution of the AFU all the atrocities that the Russians committed in Bucha.

Disclosure Fraudsters offer for passing the survey 5000 hryvnia state subsidy, which allegedly can be used at "OKKO" gas stations

  According to VoxCheck, users of social networks spread information about allegedly state subsidies at "OKKO" gas stations for 5000 hryvnia. In order to get the money, users are offered to take a short survey. However, this is a fraud. The company OKKO denied information about the state subsidies for 5000 hryvnia. As the factchecker writes, OKKO network reported that it had nothing to do with this action. You can find out about the campaign on the official website, in a message from loyalty program Fishka or on pages in social networks. More details.  

Disclosure Fraudsters are trying to steal payment card data - through the resource "TSN" offer monetary aid from the UN.

The government emergency response team of Ukraine CERT-UA, which operates under the State Special Communications Agency, warns of a new fraudulent scheme. A fraudulent page was found in Facebook, which imitates the resource of the TV channel "TSN". On the page offers to take part in a survey. To do this, you have to click on the link and allegedly receive "monetary aid as part of the UN social program". Later the user will be asked to provide personal information and make an additional payment.

As a result, the payment card data will be compromised.

The State Special Communications Agency cautions:

1. Never enter payment card details on unfamiliar and suspicious websites. Set control over movements of funds (activate SMS-informing, set transaction limits).

2. If the data of payment card were entered erroneously on the fraudulent website, block the payment card immediately using mobile application, bank hotline (the phone number is indicated on the back of the card) or via internet-banking.

3. Remember to always follow the basic rules of cyber hygiene.

In April, fraudsters used a similar scheme. Then they pretended to be the popular TV channel Ukraine 24 and used the theme of financial aid from EU countries.

Disclosure Russian hackers are sending out dangerous emails with the subject line "About a revenge action in Kherson!".

As reported by the government response team to computer emergency events in Ukraine CERT-UA, a grouping associated with the Russian Federal Security Service UAC-0010 (Armageddon ) carries out a new cyber attack As stated in the message, the hackers are sending dangerous emails with the theme "About the action of revenge in Kherson!", which contain attachments in the form of a file "Plan Kherson.htm".

If a person opens the file, a new file is created on the victim's computer - "Herson.rar" with the shortcut "Plan of approach and laying explosives on critical infrastructure facilities in Kherson.lnk". And as an end result, the GammaLoad.PS1v2 malware is downloaded. The UAC-0010 (Armageddon) hacker group is among those that have been actively attacking our country's critical information infrastructure since the beginning of Russia's full-scale military invasion of Ukraine. During cyber attacks, hackers use topics that are painful for Ukrainians. There have also been cases of cyber attacks by this group against EU countries," the State Security Service reported.

Disclosure Fraudsters are sending out a fake chatbot E-support.

According to the Center to Counteract Misinformation under the National Security and Defense Council, they spread a link to a fake bot online with the following text: "ATTENTION! The Center to Counteract Misinformation under the National Security and Defense Council of Ukraine clarifies in which areas, according to the government decision, IDPs can receive state support". According to the Center, at the end of the message adds a link to a simulated chatbot leading to a fake "PrivatBank" page.

"We inform you, in all of its messages about payments, the Center did not provide a link to any chatbot, emphasizing that payments will be made only through the app "Action". In turn Action" no Telegram bots "Epitrumka_bot", explain in the Center.

Disclosure The Kremlin is trying to minimize the presence of the U.S.

According to StopFake, Russian media on the day of the signing of the historic decision to provide large-scale U.S. economic aid to Ukraine under the "Lend-Lease," produced only a few dry publications. Slightly more was expressed by pro-Kremlin telegram channels.

"For Russian propaganda, the very fact that the Ukrainian Armed Forces received additional weapons is almost the biggest irritant. But the Kremlin does not want to talk much about the lend-lease for Ukraine. Many Russian media practically ignored this event on the day the law was signed. RBC, TASS, RT, and other propaganda media mentioned only formally, without revealing details, that Joe Biden had granted the lend-lease to Ukraine on May 9, and Vladimir Zelensky called this decision "historic." But some Russian information resources, apart from drawing historical parallels with 1941, still decided to remind their audience of the disastrous economic and even military consequences of this decision for Ukraine and its army," the fact checkers write. Earlier, Russian propaganda had already spread the idea that many future generations of Ukrainians would pay for the weapons the U.S. would bring to Ukraine under lend-lease. More details

Disclosure In Mariupol, the occupants use the name and logo of the newspaper Priazovsky Rabochiy to spread propaganda.

Olena Kalaitan, editor-in-chief of the Priazovsky Rabochiy newspaper, reported, that the publication had temporarily stopped coming out due to the Russian occupation. However, it recently became known that along with the "humanitarian aid" in Mariupol a fresh issue of the newspaper was distributed. "Well, our editorial board predicted in advance that the occupiers would use the trust of our readers gained over the years and the authority of the "Priazovsky Rabochiy" newspaper, which we have been carefully developing, cherishing and preserving. Dear readers - I ask you not to take everything that the collaborationist authorities are now passing off as our position - the Ukrainian editorial board of "Priazovsky Rabochiy" has no line of this new-found newspaper," Kalaitan said.

Disclosure Russia distributed a fake video of survivors of the Moskva cruiser. It was taken before the sinking.

Journalists of Radio Liberty exposed the lies of the Russian command about the sunken missile cruiser Moskva. The reason for this was the published photo of conscript Sergei Grudinin, who "disappeared" after the destruction of the ship.

Despite the fact that members of the soldier's family still know nothing about his whereabouts, the command published a video of the "Moscow" sailors who allegedly survived the sinking of the warship.

The video raised doubts about its authenticity. At the same time, members of Grudinin's family say they still know nothing about his whereabouts."It seems to be a shot from the same video, but the sailor depicted in it has not returned to his family, and his mother, after first being told that he survived, was later told that he was missing, and even later that he was dead," Radio Liberty writes.

Grudinin's aunt, Tatiana Grudinina, told the radio station in late April that her nephew was still missing. She said that his mother Tamara Grudinina had been told by the Defense Ministry hotline that her son was alive, but later she received a telephone call from a man who called himself Vakula (the last name of the deputy captain of the Moskva) and said that Grudinin had disappeared. Some time later, another representative of the Russian Navy called the woman and told her that her son had "drowned with the ship. Radio Liberty's Krym.Realii contacted Grudinin's parents in Amur Region in the Russian Far East and asked them to confirm that the man in the photo was their son. They said they did not want to talk to journalists, citing psychological trauma.

"Grudinin was an enlisted man, which means by law he should not have been sent to a war zone. At a time when Russia is waging war against Ukraine, with some fighting taking place on the Ukrainian coast of the Black and Azov Seas, the Defense Ministry said that the ship did not take part in hostilities," the publication reported. As a reminder, on April 13, the Ukrainian Armed Forces struck two Neptun missiles at the Moskva missile cruiser. As a result of the strike, a large fire broke out on the flagship of the Russian Navy and its ammunition detonated. The very next day Russia had to admit that the cruiser sank. It later became known that the crew of the Moskva cruiser, which had sunk, had not been evacuated. It was reported that more than 500 crew members could have been on board.

Disclosure Cybercriminals are sending out new dangerous emails in droves to steal data and "scare" of a chemical attack.

CERT-UA, a Ukrainian government emergency response team under the State Customs Service of Ukraine, revealed a mass distribution of "chemical attack" emails. The e-mails contain a link to an XLS-document with a macro, the opening of which will result in the computer being infected by the malicious program JesterStealer. CERT-UA specialists note that files are downloaded from compromised web resources. The JesterStealer program steals authentication and other data from Internet browsers, MAIL/FTP/VPN-clients, cryptocurrency wallets, password managers, messengers and game programs. Stolen data is sent to attacker in Telegram. After stopping the program is deleted.