Another fraudulent scheme, which is spreading in social networks and plays on people's difficult circumstances and the need for money, is revealed by the Nota Enota project. Fraudsters report that according to the adopted law, Ukrainians can get back VAT for three years, which can reach up to 90 thousand hryvnias of assistance. The condition is that the bank card must be checked. "After users click on the link, they are directed to a site where they enter their details and their payment card details. Accordingly, fraudsters gain access to accounts and steal people's money. In addition, people themselves give all the necessary information, thinking that they are filling out a form to receive funds," the post reads. "The Raccoon's Note" warns: that there is no such law; VAT is not refundable to individuals. In addition, information is distributed by a page called "Help Fund", which does not have a bluebird (check mark), which means it is not verified. The "round" number of 90,000 hryvnias was used to attract attention. In addition, fraudsters contradict themselves: they write either "law" or "decision". You can find out about real help and fill out an application on the E-support website. Information about assistance from international organizations is available on the website of the Ministry of Social Policy. 

The Meduza publication reported that the Kremlin had developed a manual for Russian propagandists by August 1. On this day in 1914, Germany declared war on the Russian Empire.

The authors of the manual say that the West constantly "draws" Russia into military confrontations, and Russia always participates in conflicts to protect "brotherly nations". According to Kremlin, in 1914, Russia "could not leave Serbia to its own devices."

The Kremlin calls the war in Ukraine "the modern Ukrainian crisis." Russian media should also tell their audience that after 2014, the West decided to "sponsor" in Ukraine "the raising of several generations of people who hate Russia and are ready to kill Russians with the help of xenophobic ideology and Russophobia."

A separate section of the manual deals with "Western interference" in Russia's internal affairs. Allegedly, the West sponsored the Bolsheviks and the events of 1917. Now, according to the manual, the West "finances non-systemic opposition, protest movements, and anti-Russian mass media."

It is also alleged that an "anti-American trend" will soon develop, so the United States "will not be able to find not only military Allie but even serious trade partners." The reasons for the spread of the "trend" are not reported.

Fraudsters on behalf of a well-known bank allegedly give 300 hryvnias to each "just like that" as "help in difficult times". To receive money, you need to share information and give your bank card number. On fake Instagram pages, fraudsters include the information "Monobank donates UAH 300" and a link to the Telegram channel in the description. There is only one post on the page (about a supposedly "gift") or none at all. Fraudsters ask to make a story about a fake promotion, post to themselves, and tag a fake page. Next, you need to reset your card number in direct mail and "wait for payment." Fact-checkers of the "Liar" project found 26 fake Instagram pages and 7 Telegram channels. The support service of Monobank confirmed to the fact-checkers that the bank does not give out 300 hryvnias to anyone, and urged them not to provide any data to fraudsters. 

Human rights defenders of the non-governmental organization "Crimean Tatar Resource Center" researched and presented trends of Russian disinformation about NATO's goals, values​​, and work in the temporarily occupied Crimea.

There are the following trends:

In April-May 2022, propagandists actively justified the invasion by saying that Ukraine will try to return Crimea by military means if it joins NATO.

In June, the message changed: it is alleged that NATO is unleashing the third world war and "beats Ukraine" to attack Crimea.

In July, propagandists began to say that Russia is already "at war with NATO" not with Ukraine.

The Center for Strategic Communications published an analysis of discretization and disruption mobilization measures in Ukraine by Russian propaganda. Propagandists have been doing this since 2014, the Center emphasized.

In particular, the key anti-mobilization messages of propagandists are named:

• military commissars announced a "hunt": summonses are handed out to men of conscription age on the streets, in transport, in shops, and at work;

• after serving the summons, the mobilized are sent to the front without training and medical examination, the mobilized are "cannon fodder";

• only Russian-speakers/Ukrainian-speakers are fighting; only people from the East of Ukraine (while the "Westerners" are "cooling down") / only people from the West (while the "Easterners" are fleeing to the West or abroad) are fighting;

• the wealthy are bought off summonses with bribes; only the poor are mobilized (option: city dwellers avoid mobilization, peasants are “taken away by whole villages”);

• the enemy is stronger, resistance makes no sense;

• women’s military registration is preparation for total mobilization;

• men of conscription age must be released abroad: the ban destroys families and harms the economy;

• you can avoid mobilization thanks to various "schemes" of going abroad.

The propagandists’ goal is to sow doubts about the general mobilization legality, to assure Ukrainians of the selective and unjust mobilization, to normalize various practices of avoiding mobilization, and to undermine the level of trust in the Armed Forces of Ukraine.

The Institute of Mass Information investigated how one of the largest telegram channels of the occupied Donetsk region spreads Russian disinformation in the occupied territories and how it changed the main message topics five months after the start of the full-scale invasion.

According to the research, propagandists most often refer to the Armed Forces of Ukraine as "VFU" (Armed Forces of Ukraine; 632 mentions), "Nazis" (601), "militants" (495), "Ukras" (160), "terrorists" (134), "neo-Nazis" (131), "Ukrainian Nazis" (117). Propagandists most often associate the Ukrainian army with Nazism in their word-making experiments, IMI writes.

IMI researchers identified five groups of messages:

More details in the study.

As the press service of the Main Intelligence Directorate of the Ministry of Defense of Ukraine reports, in the temporarily occupied cities of the southern part of the Zaporizhzhia region, representatives of the self-proclaimed authorities are searching for collaborators to create a "mass" for the so-called "spontaneous actions" in referendum support. The occupiers believe that such television stories will reduce the degree of dissatisfaction with the war among Russians. Despite the "material incentives", the local residents are not active enough, so the "mass" is brought from the occupied Crimea.

 “The Meduza” reports that it has received from its sources two manuals developed in the Kremlin for Russian propagandists and public figures. According to them, the basis of "Russian civilization" was the Orthodox faith, which teaches compassion, love of neighbor and, patience with others. "Special operation" should be compared with the Christening of Russ, and Putin with Alexander Nevsky. The manual’ authors write that the Christening of Russ, as well as the war in Ukraine, lay the "national foundations" as well as "the foundations of the Russia development for the next century." Allegedly, this is due to the "unification of society around the army and the strategic course of the president", and Russia's mission is "to protect the oppressed". One of the goals of the special operation is the "war against the godless," who "use women and children as human shields." They are characterized as "rapists, robbers and, murderers." The Kremlin proposes to use such theses to describe the Ukrainian military. He said, "there is no morality" for them, because most of them are "open Satanists and followers of philanthropic cults." The war was started by "the collective West, which is confident in its rationalism". Propagandists are recommended to use the alleged words of Alexander Nevsky that there is strength in the truth. However, Russian soldiers are convinced of their rightness, because they are continuing the work of their grandfathers - destroying Nazism. As a matter of fact, the theses about love for neighbor and tolerance proposed by the manuals are nullified by the atrocities of Russian soldiers in the occupied territories. Russia accuses Ukrainians and the whole world of Nazism, ignoring the fact that the Russians are the closest to Nazism today. More details. 

 Facebook users told about the mailing. The reports say that allegedly Ukrainian politicians short-sightedly hand over national interests to Poland, and Poles "do not consider us as people, they are Polonizing and will soon "take away" the western regions". They are also trying to convince Ukrainians that "Ukrainian children will be stolen and turned into Poles"; the "absorption of Ukrainians by the Polish nation" is taking place; "our children will not remain Ukrainian in Polish schools"; it is already allegedly about a "Ukrainian-Polish federation or confederation, and in Poland, Ukrainians are increasingly not welcome." It is also alleged that ordinary Poles harass volunteers who collect money for Ukrainian refugees and want to return the western regions of Ukraine under their control, telling at their official events that Lviv is a Polish city." Bandera and the Volyn tragedy are also mentioned in the reports.

In the posts, topics and messages that affect the reader's emotional state are deliberately used. Messages are sent from Russian numbers. Subscribers with the numbers +7 (950) 869-0734 and +7 (908) 186-7552 are served by the operator T2 Mobile in the Rostov region of Russia. In this way, the Russians are once again trying to destroy friendly relations between Ukrainians and Poles and discredit Poland's assistance to Ukraine during the war. 

Pro-Kremlin media and social networks spread information, citing the representative of the Russian Ministry of Defense, Igor Konashenkov, that the military and space forces destroyed "more than a hundred rockets to the HIMARS multiple-launch rocket system" in Lyubimovka, Dnipropetrovsk region. Allegedly, as a result of the attack, the Armed Forces of Ukraine lost about 120 soldiers, and that the Russians killed "foreign mercenaries and technical specialists". "However, the strike was carried out on the agricultural enterprise hangars, in which at that time, more than 800 tons of straw were stored (according to Konashenkov, it would be possible to make from it about 100 missiles for HIMARS). In addition, one child (obviously a foreign mercenary) was injured," a fake exposed journalist Roman Tsymbalyuk.

The Russians have created a "Handbook for Ukrainian citizens on organizing resistance to the Kyiv puppet leadership," in which they advise to sabotage work in socially significant areas - in administrative positions, office workers, employees of government bodies, in the medical and educational fields, law enforcement activities, etc. It is reported by the HUR of the Ministry of Defense of Ukraine.

The manual has 14 pages, which repeatedly use terminology that reinforces the propaganda of hatred towards everything Ukrainian: "Kyiv hunta," "puppet leadership," etc.

The Main Directorate of Intelligence the Ministry of Defence of Ukraine claims that the "tips" encourage people to promote the Russian language (pretending not to understand Ukrainian), slow down the pace of work of state organizations, send various incorrect requests to state structures, make mistakes in the documentation and use more materials, including the number of medical, than required.

The Government Computer Emergency Response Team of Ukraine CERT-UA, which operates under the State Service of Special Communications and Information Protection of Ukraine, reported a new cyber attack: mass sending of emails with the subject "Final Payment" and an attachment of the same name in the form of TGZ- archive. The archive contains an EXE file, the opening of which will lead to the download of malicious programs on the computer and, as a result, data theft. The attack is linked to the group of Russian hackers UAC-0041.

The fake document, allegedly Volodymyr Zelenskyy's decree on depriving the citizenship of former President Petro Poroshenko, ex-SSU chief Ivan Bakanov, Dnipro mayor Boris Filatov, ex-ombudsman Lyudmyla Denisova, people's deputy Viktor Medvedchuk and his wife Oksana Marchenko, suspected of treason, etc., was spread on social networks.

In fact, the document is fake. The number of the "decree" was indicated as "502/2022"; it was dated "July 23, 2022". Such a number was on a document that the mass media distributed earlier related to the deprivation of citizenship of other persons. However, the date on that document is "July 18, 2022." Also, in the supposedly "official document," mistakes were made in the name of the capital, namely "Kyyievi." In addition, the Telegram channel, launched by the Dnipro authorities to refute disinformation, "Stof fake Dnipro" writes that the information about the deprivation of Filatov's citizenship is unreliable.

Ukraine's government computer emergency response team CERT-UA, which operates under the State Service of Special Communications and Information Protection of Ukraine, reported a new cyber attack: massive sending of emails with the topics "Information Bulletin" and "Combat Order."

They are supposedly sent to private email addresses from the National Academy of the Security Service of Ukraine. Opening the attachments in the emails will lead to the launch of the malicious program GammaLoad.PS1_v2 on the computer and, as a result, data theft. The attack is associated with the Russian FSB hacker group Armageddon (UAC-0010).

The Russians distributed the fake information as a copy of a printed document entitled "Urgent notice regarding probable missile strikes soon on the territory of Ukraine." It is a fake. As the company reports, "it is a fake, a throw-in and just a clumsy discredit aimed at taking revenge on Molfar for their work for Ukraine." The information in the fake document is presented "in the style of a cabinet order of the power structure, where decision-making depends on seals and signatures." This style of formulating texts is not characteristic of Molfar researchers. Fact-checkers point out that they do not have insider information about missile attacks, and it is impossible to predict missile flight routes based on OSINT analytics. The logo of the Molfar brewery was also used in the fake document. The company urges us to verify the information and not to believe fakes. More details.

In the messages received on social networks supposedly on behalf of the SSU, it is said that "new rules of communication are appearing in Ukraine - all calls will be recorded, and all messengers will be monitored."

It is not true, and the SSU does not send such letters to users. According to the Center for Combating Disinformation, the disinformation campaign of the occupiers aims to discredit the country's leadership, as well as psychological pressure on the people.

The fake that in wartime all calls of Ukrainians will be listened to is not new. Such information has been circulating since the first weeks of the full-scale invasion, but there is no official confirmation of this data. In official departments, the report was denied every time.

As reported by TAVR Media, the largest radio holding in Ukraine. Ukrainian radio stations broadcast an urgent announcement that the President of Ukraine, Volodymyr Zelensky, was in intensive care and was in serious condition.

This information is fake, and Russian hackers hacked the radio stations' broadcasts. "Today, there was a cyber attack on the servers and networks of TAVR Media radio stations. Now the relevant services are working on solving this problem," said the report.

The Government Computer Emergency Response Team of Ukraine, CERT-UA, has warned of a new cyber attack in which criminals are sending the file "Report_050722_4.ppt", which contains a thumbnail image that mentions the operational command "South." If you open the document, it will open the AgentTesla malware on your computer and steal your information. CERT-UA noted that the attack could be directed against state organizations in Ukraine.    

The Center for Combating Disinformation reports that recently, the enemy has been sending out messages that "from July 19 to 21, mass rocket attacks are planned" in some cities of Ukraine, and "from the side of Belarus, sabotage groups will advance up to 15-20 kilometers through the territory of Ukraine to distract our troops in other directions".

In this way, the enemy uses a manipulative appeal to an "anonymous authority" because they send supposedly "insider" information from a "reliable source somewhere in the department" to influence Ukrainians. As noted in the Center, since the beginning of the full-scale war, there has been a high probability of missile attacks throughout the territory of Ukraine.

Therefore, you should not ignore air warning signals and must immediately go to the nearest shelter.

The Center for Combating Disinformation has updated the list of Telegram channels that spread Russian disinformation under the guise of Ukrainian ones. In July, six channels were added to the list, including "Ukrainian Format" and "Ukraine Novosti."

On Facebook, messages about a fake raffle from the "ATB" supermarket chain were spread, supposedly for the 29th anniversary of the chain for residents of Volyn.

The participants of the so-called raffle were promised several HP laptops and iPhone 13. Fact-checkers of the Brekhunets project discovered another fraudulent scheme.

Fraudsters offered everyone to register to participate in the draw through a special form. Moreover, you need to select "free gift card" and download a document with unknown content, probably a virus or other software tweaks that attackers use to gain remote access to personal devices and their information.

The information about the fake raffle was denied on the official Facebook page of the "ATB" trade network. "ATB" representatives call for vigilance and attention, not to participate in fraudulent promotions, and advise to look for trustworthy information about promotional offers on the company's official website and official pages on social networks.

Previously, we wrote about a fraudulent scheme that allegedly guaranteed Volyn residents payments of UAH 9,800 from the European Union, but instead, criminals tried to steal bank card data.

According to the State Intelligence Service, the public authorities of Ukraine received new dangerous letters with the subject "Specialized prosecutor's office in the military and defense sphere. Information about the availability of vacancies and their staffing". According to the department, the letters have an attachment in the form of an XLS document containing a macro, the activation of which will lead to the creation and launch of the "write.exe" file on the computer. It may cause the device to be damaged by Cobalt Strike Beacon. The State Intelligence Service associates the activity with the work of the UAC-0056 group, which was already involved in cyberattacks in Ukraine in April and March.    

The Twitter social network created a fake page of the Commander-in-Chief Armed Forces of Ukraine, Valery Zaluzhny. The General Staff of the Armed Forces reported that Zaluzhny does not have an official Twitter page.    

The fake message about social benefits to all Ukrainians with the support of European Union countries is being distributed on the Facebook social network. Fraudulent advertising was spread specifically to the Volyn region.

According to the Brekhunets, two versions of the fake were distributed this time. In the first option, they promised a refund of VAT for the last three years per Resolution 28-9329k. In the second case, each citizen was pledged to the payment of 9,800 hryvnias using a manipulative clip of a video with Volodymyr Zelensky. Next, using the link, you need to enter the bank card's last name, first name, and last six digits. Remember that the card number, CVV code, or PIN code are personal data that cannot be disclosed to anyone, not even bank employees. Resolution 28-9329k, which the authors of the messages refer to, does not exist at all. Using a reference to a non-existent document gives the impression that the offer has legal force. People write that they have been paid different amounts on the fraudulent page in the comments. Still, the state constantly clearly regulates the amounts of funds that are paid out as financial assistance to different categories of citizens. All these signs point to fraud. The goal of fraudsters is to steal card data to gain access to the personal funds of their owners. Previously, we wrote about how fraudsters offered payments from the EU using the fake page of Lesya Nikityuk or provided compensation for VAT refunds in the amount of 7-9 thousand hryvnias, etc.    

On July 2, the Russian media spread another fake about the fact that the Chief of the General Staff of Russia, Valery Gerasimov, visited the Russian occupiers' positions in Ukraine to check Russian troops' formation. Some Ukrainian online publications concerning the Russian agency "Ria Novosti" also published this "news."

There is no confirmation of it. The Ministry of Defense of Russia showed a clip edited from a photo about the general's visit, but in reality, they showed photos from two months ago.

The images used for the video about Gerasimov are dated May 5, and the "Nightingale Pomet" channel reports concerning the video metadata of the "Zirka" channel.