The Internet advertises sites that are allegedly associated with the ex-commander of the Armed Forces of Ukraine Valerii Zaluzhnyi. Resources are located on different domains and created by anonymous users.

The Center for Countering Disinformation at the National Security and Defense Council reports that these sites are not associated with Zaluzhnyi, and Ukrainian law enforcement agencies have already been informed of their existence. Probably, behind the creation of these online platforms are Russians who are striving to split Ukrainian society, which is why they use different means to achieve this.

The sites lead to anonymous telegrams that collect information about users, which in the future can be used against citizens of Ukraine. The Center warns against registering on these resources and asks you to trust only verified sources.

Pro-Kremlin telegram channels are distributing videos depicting discreditable posters of Ukrainian President Volodymyr Zelenskyi and First Lady Olena Zelenska. This content is accompanied by the caption: “Rome, Italy. Our days. Zelenskyi is shown on all streets. Judging by the posters, he is not liked everywhere”.

The Center for Countering Disinformation under the National Security and Defense Council reports that such posters were posted by the Russian community in Italy to produce propaganda content. The Center learned about this after they submitted a corresponding request to the Ukrainian Embassy in Italy and the Ministry of Foreign Affairs.

The purpose of this slander is to create the illusion of fatigue from Zelenskyi and Ukraine. In addition, Russian propaganda systematically discredits the Zelenskyi family with the hope that Ukrainians will “eventually rise up against them”.

For now, the discreditable posters have been removed, and the Ukrainian Embassy in Italy is already working to prevent similar actions by Russians in the future. Previously, we refuted the information that the journalist who published the “investigation” of the purchase of a villa by the Zelenskyi family was allegedly “killed”.

In such messages, the authors, on behalf of the “prayer department”, offer to pray for the Ukrainian military who find themselves surrounded. For example, one of the messages talked about two Ukrainian brigades that were allegedly surrounded by 40 thousand Russian soldiers near Avdiivka.

The Center for Strategic Communications and Information Security reports that the vast majority of such messages are the work of Russian intelligence services.

This is evidenced by the following:

- sometimes messages are written in Russian, which may already be the first sign of it;

- in the structure of the Armed Forces of Ukraine there is no “prayer department” responsible for prayers;

- lack of specifics about the brigades and the time of the location of hostilities;

- the desire to evoke an emotional reaction in the reader in order to obtain maximum coverage;

- in the comments there may be calls for Ukrainians to give up.

Russians can manipulate even such intimate areas as religion, so you should not trust overly emotional messages and calls on this topic.

Pro-Kremlin telegram channels are distributing a video in which an unknown person in a Ukrainian Armed Forces uniform allegedly shoots a serviceman for allegedly refusing to participate in assault operations. As propagandists write, the victim of the “execution” seems to be a soldier of the 425th Special Operations Brigade “Skala” of the Main Intelligence Directorate of the Ministry of Defense of Ukraine.

However, after verifying the information together with the StratCom of the Armed Forces of Ukraine and other relevant structures of the Ministry of Defense and Armed Forces of Ukraine, the Center for Countering Disinformation reported that this video was fake. It is impossible to identify the characters and the area, as well as determine the nationality of the participants in the video. In addition, 425th Special Operations Brigade “Skala” is part of the Ground Forces of the Ukrainian Armed Forces, and not the Main Intelligence Directorate, as propagandists are trying to imagine.

Considering all the above-described signs of a fake and the fact that the video is being distributed by Russian resources, the Center reports that the video was probably shot by the Russians as part of the IPSO in order to discredit the Armed Forces of Ukraine. This is not the first time that fake videos have been created to demonize the Ukrainian army. Here, for example, is an analysis of a video in which the Russian military allegedly captured a pregnant Ukrainian female soldier.

Pro-Kremlin telegram channels are distributing photos of a letter allegedly from the SBU to the Ukrainian Embassy in Germany with a demand to provide information about all adult men participating in the rallies for further sending their data to the ​​Territorial centers of recruitment and social support.

After verifying the letter at the Ministry of Foreign Affairs of Ukraine, the Center for Countering Disinformation reported that this “document” was fake. The text of the letter contains signs of Photoshop; there is no electronic signature on the “document”, as well as errors in the formatting of the letter. In addition, the letter allegedly from the SBU was written on the letterhead of the Ukrainian Embassy in Germany, and this does not comply with the rules for organizing office work.

By spreading such fakes, Russian propagandists are trying to sow panic among Ukrainians abroad, in particular in Germany. It should be noted that this spread of misinformation occurred against the backdrop of a new version of the Mobilization Bill.

• Read also: In Ukraine they allegedly call on people to mobilize into the ranks of the Armed Forces of Ukraine with their entire families.

The Center for Strategic Communications and Information Security reports a new tactic for cybercriminals. Attackers specifically accompany the dangerous file with text containing general phrases that may seem familiar to business correspondence:

“Hello, I am sending documents at your request. Please provide the incoming correspondence registration number.

Sincerely,

Mobilization department.”

The names from which the letters come are ostentatiously invented, for example, Konotopenko Radyvoi Ratyborovych. The signature “mobilization department” can confuse and force one to click on the file.

Here are tips from the Center on how to protect yourself from cybercriminals:

- under no circumstances open files received from unknown addresses;

- install an antivirus and keep it activated;

- make backup copies of important documents and files to restore them in case of loss.

This was recorded by specialists from the Center for Strategic Communications and Security. They explained that unknown persons are sending phishing emails allegedly on behalf of the SBU - after all, in such messages users are asked to download malware with dangerous content. For example, Russian intelligence services can use this to collect private information about Ukrainian users.

The SBU department urged not to click on links or download anything when receiving such emails. If such a situation occurs, you should report it by phone: 0 800 501 482 or send an appeal by email: callcenter@ssu.gov.ua .

In the Ukrainian segment of Facebook, enemy groups and pages that masquerade as Ukrainian, but are actually controlled from Armenia, are again becoming popular. Specialists of the NotaYenota project drew attention to them. For example, on one of the pages there is the same type of text with different emotional photos generated by artificial intelligence. The messages also contain images of military or wounded people, but often these are photographs from open sources depicting people not involved in the war in Ukraine. Examples of the names of such pages are “We are Ukrainians, We are Strong”, “I am from Ukraine”, “Prayer”, “My Ukraine”, “Life is Beautiful”.

Moreover, project specialists pay attention to one of the messages containing the Russian-language caption “It’s a pity that this photo will score less than a naked singer”. This indicates that the pages are maintained by native languages. This message received more than 80 thousand likes, and according to NotaYenota, it was designed to emotionally influence the audience of the page.

The contact information of these pages indicates an email with the Russian domain mail.ru (the same on all pages). In addition, in some messages one can notice the replacement of Cyrillic characters with Latin ones, such as a, u, x, i, k, 0, which allows one to bypass blocking systems.

In general, according to NotaYenota, such groups are used by Russians for information interventions aimed at dividing society on trigger topics, testing the audience for vulnerability to patriotic and emotional fakes. People interacting with such content can then be used to target advertising campaigns and plan further information attacks using the discovered vulnerabilities.

This was recorded by the fact-checker of the Brekhunets (Liar) project. They explain that Ukrainians began to receive messages seemingly from Ukrposhta that their parcel was “detained because it does not have a number”. In order for it to be sent, one needs to update their address by clicking on the link.

The Ukrposhta main office previously warned that messages with similar content could be sent on their behalf. Ukrposhta specialists are convinced that in this way scammers are ready to obtain users’ personal data in order to take possession including, for example, of their funds. Therefore, one should not click on unclear links.

Attackers in the Signal messenger send messages to Ukrainian Armed Forces military personnel on the topic of recruiting for the Third Separate Assault Brigade of the Ukrainian Armed Forces and the Israel Defense Forces (IDF), containing malicious software.

The hackers’ messages contain archived files, the launch of which will lead to infection of the computer with REMCOSRAT and REVERSESSH malware. At the same time, the attackers try to make the names and contents of the archives interesting for the military: “interrogation of a prisoner”, “geolocation”, “encoding commands”, “claims”, etc. Specialists from the American-Japanese company Trendmicro showed suspicious activity back at the end of December 2023.

Afterwards, the Ukrainian government computer emergency response team CERT-UA, operating under the State Special Communications Agency, took action on a series of cyber attacks. The team also noted that if suspicious activity is detected on computers and in information and communication systems of the Armed Forces of Ukraine, the ITS Cyber Security Center (military unit A0334; email: csoc@post.mil.gov.ua ) should be immediately informed.

The name of such a chat is President’s Messenger. The leaflets themselves are distributed on behalf of the chairman of the Zaporizhzhia regional council, Olena Zhuk. They say that city residents can share all their problems and what worries them through a chatbot by clicking on the QR code on the leaflet, since “this is a quick way to draw attention to an existing problem”.

The Center for Strategic Communications and Information Security reported that the head of the local regional council, Olena Zhuk, called these leaflets fake, saying that she, her colleagues and the regional council have nothing to do with them, as well as with the President’s Messenger chat. In addition, Olena Zhuk asked citizens not to follow the QR code on the leaflets and not to transfer their personal data to unknown persons on the Internet. She also reminded residents of Zaporizhzhia about cybersecurity, urging them to observe the rules of digital hygiene.

An information attack in the form of mass SMS messaging is aimed at Ukrainians located in different countries of the world. The messages were created in the style of Lubianka linguists: next to the cliché about the need to work together “to revive Kyiv  Rus to harm our enemies” there are phrases like “take care of yourself and your loved ones” or “save the lives of people” - Russian propaganda and threat in one sentence.

The Main Intelligence Directorate notes that in addition to the provocative content with a call to help Moscow expel “American Satanists” from the “original Russian land”,  Kremlin intelligence officers add the cynical one: “from Russia with love”.

The purpose of this information attack is to intimidate, demoralize and disorganize Ukrainian citizens. If you receive such messages, we urge you to ignore them and think critically.

Moscow continues to recruit a number of lecturers under its control to organize the Knowledge Society in the temporarily occupied territory of the Luhansk region. The task of this propaganda structure, which has existed since the times of the USSR, is to brainwash the workers and students of the region.

The Center for National Resistance reports that propagandists organize lectures, the attendance of which is compulsory. At lectures, agitators tell a distorted story and promote the greatness of Russia and its leaders in the best traditions of totalitarianism. The occupation administration has already developed a plan for “lectures” for 2024 in local educational institutions. They want to pay special attention to the “information zombies” of young people and children.

In the temporarily occupied territories, Russian propaganda continues to promote its narratives. It is worth noting that propagandists also bear responsibility for the war that the Kremlin unleashed, and each such agitator will have to answer for their crimes before the people of Ukraine.

The Center encourages people to report any available information about the mentioned “lecturers” in the chat @sprotyv_official_bot.

Ukrainians began receiving notifications from foreign numbers on behalf of Ukraine's National Post that it could not deliver parcels due to an alleged lack of data on the delivery address. To enter one’s full address and receive “one’s” package, scammers encourage one to follow a link and fill out all the necessary data.

The Center for Countering Disinformation under the National Security and Defense Council urges people to never click on links of a dubious nature, since the goal of scammers is to obtain all the necessary information about users for further criminal actions. In addition, it is worth noting that not a single postal service in Ukraine sends messages to users from foreign numbers.

If you have become a victim of scammers and have lost access to your page on a social network, contact the cyber police or other competent authorities.

Ukrainians in Europe began to receive messages inviting them to gather for protests in European cities and take up posters with the inscriptions: “Give people peace”, “We want peace in Europe”, “Important people”, “Ukraine is the most tired of all”, “We demand peace!” and things like that. The senders of such messages claim that the demonstration itself will last only 5-10 minutes, and during this time it will also be necessary to shoot a video. In addition, there is a prepared text for the rally, after reading which presumably on camera the performer will receive as much as 100 euros. All other protesters are promised 50 euros each or “payment for the road and delicious coffee”.

The text, which is supposed to be read by one of the protesters, contains unusual constructions for the Ukrainian language. For example, “in Ukraine” or “the Hungarian branch of a public association of Ukrainians”. In addition, this text mentions the “voice of reason” of Arestovych, who allegedly “suffers attacks” from Zelenskyi. However, it is worth noting that the former adviser to the Office of the President of Ukraine was distinguished by his defense of “good Russians” and destructive statements about Ukraine, its authorities and the Armed Forces of Ukraine, therefore, as a result, the SBU began to deal with him.

Among other messages of planned rallies, the following should be heard: “war for them (ed. – the military-political leadership of Ukraine) is unlimited power, and for the common people it is a deep demographic catastrophe, daily horrors and impoverishment in a foreign land” or “if it’s difficult now to talk about peace, first we will discuss a ceasefire!”.

Unknown people expect to gather 30-35 Ukrainians for such rallies. We urge one not to fall for such messages and to respect the Ukrainian military, who at the cost of their own lives are protecting the citizens of Ukraine from the Russian invasion. Previously, we analyzed disinformation about alleged payments to all Ukrainians in the amount of 6,600 hryvnia.

On December 12, 2023, Kyivstar subscribers began to complain about communication failures, while at the same time the company’s website was unavailable for reasons unknown at the time. It turned out that the company was subject to a hacker attack. The Security Service of Ukraine has opened criminal proceedings into a cyber attack against a mobile operator. According to one version, Russian special services may be behind this.

Meanwhile, VoxCheck analysts recorded fraudulent messages that the operator was charging each subscriber a compensation of 200 hryvnia to their mobile account.

Kyivstar specialists wrote on their Facebook page that scammers have become more active on various platforms and are spreading false information about compensation. Because the company has not announced any such initiatives. Experts emphasized that users should not distribute personal data that could end up among scammers.

According to such reports, the next evacuation from Zaporizhzhia to “Odesa, Poland and Germany” was supposed to take place on December 11, 2023. However, after processing this information, the Center for Countering Disinformation under the National Security and Defense Council found out that in fact no evacuation is planned. Such messages are part of the Russian IPSO. By resorting to such cynicism, propagandists pursue the goal of sowing panic among the population of Ukraine. If such a notification is received, the Center calls on citizens not to click on the links and block the number from which the SMS came. More enemy speculation on the topic of evacuation of Ukrainians can be found here.

This was revealed by the Center for Strategic Communications and Information Security. Propaganda messages say that the commandant of the Lviv region, Taras Hren, allegedly asked the leadership of the Ivan Franko Lviv National University to provide information about all male students. And a photo of the corresponding “document” is added to the messages.

However, the Lviv Regional Military Administration explained that the commandant of the Lviv region or not a single unit of the Lviv Regional Military Administration sent such letters to higher educational institutions. So the document is fake.

This information was recorded by specialists from the Center for Strategic Communications and Information Security. They explained that pro-Kremlin telegram channels are disseminating information about the defeat of the Grim-2 OTRK launcher. Video evidence is added to the messages.

However, in fact, the primary source of such “news” was a satirical telegram channel, the description of which clearly states that all messages are only humorous in nature. But in fact, the video depicts the defeat of Russian equipment. On December 6, 2023, the Minister of Internal Affairs of Ukraine Ihor Klymenko published a video of the defeat of the Russian operational-tactical missile system on his telegram channel. It is most likely that the authors of the satirical channel used this particular video to create the news. And then the Kremlin resources replicated this.

Still, it is impossible to say that the Russians did not destroy Ukrainian equipment on the battlefield, because this is more than possible during the war. But propagandists deliberately exaggerate the significance of “destroyed” equipment on the battlefield, hinting at the supposedly low combat capability of the Ukrainian army. And they use supposedly reliable information to support such a thesis.

The head of the Main Directorate of Missile Forces and Artillery and Unmanned Systems of the General Staff of the Armed Forces of Ukraine, Serhii Baranov, in an interview with the military radio station Army FM, when asked whether the Grim-2 installation was at the development stage, replied that the installation was “being improved so let the Russians experience its effects on themselves”.

Read here on how Russian propaganda devalues the weapons that serve Ukraine.

The Center for Countering Disinformation under the National Security and Defense Council stated that Russia is planning a series of disinformation publications against the military-political leadership of Ukraine, which will be published on English-language resources. The materials are prepared by foreign journalists who have experience working in Russia, in particular, during the beginning of Putin’s power. The key goal of such actions by Russian propaganda can be considered an attempt to sow discord among Ukrainian society, discredit the government of Ukraine and demotivate Ukrainians to fight against Russia. Previously, we analyzed the manipulation that supposedly it was time for the Western world to admit Ukraine’s defeat in the war against Russia.

Pro-Russian resources are disseminating information that the Ukrainian authorities seem to have begun to prepare for the surrender of the central and western regions of Ukraine to Poland. This is evidenced by the fact that children began to be taught Polish in schools in the Poltava region. However, this is a fake.

This case was studied by specialists at the Center for Countering Disinformation. They managed to find out that the Polish language in the Poltava region is taught in only two schools, and not in all, as propagandists claim. This was reported by the Poltava City Council. Moreover, at the beginning of the school year, in addition to compulsory English, children in the region were offered to study Polish or German as a second foreign language, which indicates free choice and not coercion.

By claiming that Ukraine is ready to surrender its territories to Poland, Russian propaganda  is trying to demoralize Ukrainian society and assure everyone around that the defeat of the Ukrainian side in the war against Russia is inevitable. Propagandists also aim to create an image of Poland as an enemy among Ukrainians by spreading disinformation, as in this case. As part of the narrative that Poland will supposedly “absorb” Ukraine, we wrote about a conspiracy theory called “Ukrpolin”.

The number of telegram channels and pages on social networks promising to help in the search for captured or missing Ukrainian military personnel has recently increased. It is indicated that to complete this task they contact relatives and friends with questions about personal data and other information. This information is subsequently used by propagandists.

Specialists from the “Beyond the News” project cited the answers of the Coordination Headquarters for the Treatment of Prisoners of War to the most common questions. In particular, one cannot share their phone number and other contacts, residential address, social media profiles, brigade number, unit location, as well as photographs, including images with comrades from the army, to strangers.

The dissemination of such information could lead to a deterioration in the situation of military personnel. If scammers can simply profit from someone else's misfortune, representatives of enemy intelligence services can manipulate or resort to blackmail.

The project specialists note that no one on social networks, such as Facebook or Telegram, will effectively search for your loved one. This work is performed professionally and free of charge only by specialists authorized by government agencies. A Road Map is available on the official website of the Prisoner of War Coordination Headquarters, which details what a family should do in cases where a family member is captured, missing, or killed.

Propagandists are spreading images on social media of a purported cover of the Turkish satirical magazine LeMan, depicting a dead Biden and a calm Xi Jinping. Along with the illustration is a Turkish phrase: “If you sit by the river for a long time, you can see the body of your enemy floating by”. The reports came after Biden met with Chinese leader Xi Jinping from November 15 to 17 in San Francisco, during which Joe Biden called him a dictator. However, this image is fake.

Specialists from the VoxCheck project drew attention to it. They found out that LeMan magazine had not published an issue with such a cover. It contains the following data - date and issue number: November 17, 2023, issue 45 since the beginning of the year, as well as another issue number - 1652. However, they did not find confirmation of this cover on the official LeMan pages on social networks. VoxCheck also checked to see if issue number 45 or 1652 was published on November 17th and found that LeMan had not published any new issues at that time. Issue number 45 (or 1652) did not appear until November 22 and had a different cover dedicated to living conditions in the hostels.

By spreading such fake news, propagandists want to create the impression that the foreign press is skeptical not only of the United States, but of the West as a whole. Creating false covers of foreign publications is a regular practice of Russian propagandists, as Detector Media has repeatedly written about. 

The Center for Strategic Communications and Information Security writes that unknown people created an anonymous feedback bot on Telegram, allegedly on behalf of the Ministry of Defense of Ukraine, for complaints and suggestions from Ukrainians and other persons. Its name is @rustem_umerov_bot. However, Umierov does not have an account on Telegram, and the created bot is not official and has no relation to the Ministry of Defense of Ukraine, the ministry said.

It is likely that the information collected can be used for Russian IPSO directed against Ukraine. Nothing prevents the enemy from resorting to innovative methods of conducting hybrid warfare, so collecting information for his own purposes is possible in this way. The Ministry of Defense of Ukraine asked “not to provide any information at the request of the individuals running this account, and also to file a complaint against it”.

Social networks began to spread messages in Ukrainian with the information that “our army liberated 270-300 km², losing 71 thousand soldiers killed”. The publications also say: in order to de-occupy all territories, it will be necessary to “kill” almost 29 million Ukrainians.

Specialists from the Center for Strategic Communications and Information Security analyzed such messages. They found out that such publications are Russian IPSO. As for the deoccupied territories, this is the case – as of September 10, 2023, the Armed Forces of Ukraine actually liberated about 270 km². However, the data on the number of Ukrainian military deaths during hostilities is invented, since this information is a state secret and will be made public by Ukraine only after the end of the war. It turns out that the “calculation” of future losses was made on the basis of imaginary data, so it cannot be considered reliable.

Propagandists manipulate information and create facts because they see this as effective and potentially influential on Ukrainian society. Such disinformation is spread with the aim of demoralizing Ukrainians and making them think about giving up. When reading similar cases that can evoke strong emotions, we encourage you to think critically. We also worked on the Russian information campaign, when on behalf of the Ministry of Agrarian Policy, recipes for dishes from pigeons and dogs were sent to Ukrainians in connection with the alleged crisis in the agricultural sector in Ukraine.