VIGINUM REPORT: WAR IN UKRAINE

This week, we are also reviewing the latest VIGINUM report. While it presents few new insights, it offers a structured overview of key Russian hostile influence activities in the context of the war in Ukraine since February 24, 2022. The influence campaigns identified target various geographical regions, including France, Europe, Ukraine (as well as Russian-occupied territories), and Africa. Both state-affiliated actors and private organizations carry out these operations. (1)

Hostile Influence Targeting France and Europe

Following the French President’s speech on February 26, 2024, in which the deployment of French troops to Ukraine was discussed, the intensity of Russian influence activities significantly increased. (2)

“Reliable Recent News” (RRN)

A key influence operation targeting France (and other European countries) is the campaign known as RRN—also referred to as Doppelgänger or Ruza Flood. It utilizes a network of several hundred disinformation websites that imitate the domains of established media outlets (e.g., Le Monde, The Washington Post, Der Spiegel) and institutions (e.g., NATO, the French Ministry of Foreign Affairs) through typosquatting. The campaign also includes “Pseudo-media”, which focuses on themes such as sports, lifestyle, or EU politics.

Dissemination occurs primarily via X (formerly Twitter), Facebook, and TikTok, with support from inauthentic accounts and sponsored content networks. To increase visibility, one tactic involves posting links in the comment sections of prominent accounts to redirect users to controlled sites. Another involves the “Undercut” network, which distributes short anti-Ukrainian videos using trending hashtags.

Despite being publicly exposed—most notably by the U.S. Department of Justice in September 2024—RRN remains active. The network employs sophisticated redirection techniques to evade detection by social media platforms. (3)

“Stop Erdogan” Actions and Fake Anti-Ukraine Protests

In March 2023, VIGINUM identified a campaign involving staged content, such as graffiti in Paris, Nazi salutes, and a provocative anti-Erdogan banner. The material was disseminated via Facebook groups targeting the Turkish diaspora in Europe. Staged protests were also held in cities such as Paris, The Hague, Brussels, and Madrid and were broadcast on Facebook and YouTube. The aim was to discredit Ukraine, the EU, and Turkey. Despite their high logistical and financial effort, the operations achieved minimal reach, mainly due to poor organization and unreliable execution by the individuals involved. (4)

Screenshot of staged Protest; VIGINUM Report: War in Ukraine Report, page 7; Courtesy of VIGINUM

Targeting Ukraine and Occupied Territories

Since February 24, 2022, Russia has sought to establish propaganda-driven media in Ukrainian territories under its occupation. By June 2022, pro-Russian actors had already launched local television stations in Kherson and Zaporizhzhia, later expanding to websites with regime-aligned content.

Portal Kombat

VIGINUM highlights the website pravda-fr[.]com, launched in September 2023, as part of the IMS known as "Portal Kombat". The network comprises more than 200 websites that do not generate original content but instead disseminate large volumes of pro-Russian material from sources such as Telegram, state-run Russian media, and "military correspondents." The aim is to foster pro-Russian sentiment among Russian-speaking Ukrainians and dominate the regional information space.

Ukrainian cities targeted by the Portal Komat websites; VIGINUM Report: War in Ukraine Report, page 8; Courtesy of VIGINUM

Following public condemnation by the foreign ministers of France, Poland, and Germany in February 2024, the network expanded, targeting EU countries as well as African and Asian states and prominent political figures. It aligns its content with major political events such as the 2024 European elections, the Paris Olympics, or elections in Moldova. (5)

The Mriya Project

Mriya (Ukrainian for “dream”) is a Russian-language aggregator of Telegram channels that launched a website at the end of 2022. It disseminated pro-Russian content aimed at Ukrainian users, particularly in occupied territories. The project was run by Ukrainian influencers sympathetic to Russian narratives. It was amplified by RRN bot networks on X, serving as the media front for the "Representative Office of the Ukrainian People" (ROUP), a separatist organization led by Dmytro Vasilets. Internal documents from the Russian firm SDA reveal that Telegram channels of ROUP members, including Maksym Chikhaliiev, were utilized by “Center S”, an internal SDA unit responsible, according to the U.S. Department of Justice, for information operations targeting Ukraine. (6)

“Project Lakhta” in Africa

In response to its growing international isolation, Russia intensified its efforts in Africa, seeking to undermine Western, mainly French, influence on the continent.

A central actor is Project Lakhta, also known as the Internet Research Agency (IRA), founded in 2013 by Yevgeny Prigozhin. The network has been particularly active in Francophone Africa, conducting disinformation campaigns that support the Wagner Group. One prominent campaign targeted the African diaspora in France. (7)

Screenshots of sponsored publications on Project Lakhta’s pages; VIGINUM Report: War in Ukraine Report, page 10; Courtesy of VIGINUM

Between April 2024 and February 2025, fake accounts on Facebook and X circulated false claims that France was planning to send African migrants to fight in Ukraine. (10) Among the disinformation materials was a forged recruitment ad from the French employment agency France Travail, allegedly seeking "database analysts and explosives engineers" for deployments in Cameroon.

Fake screenshot of a France Travail job advert; VIGINUM Report: War in Ukraine Report, page 11; Courtesy of VIGINUM and France Travail

The campaign combined digital manipulation (sponsored posts and fake accounts) with real-world elements, including staged demonstrations and paid media placements. (8)

Conclusion

Despite substantial technical, financial, and human resources, VIGINUM assesses the impact of Russian influence campaigns as limited—primarily due to technical shortcomings, poor content quality, and restricted reach. Although some disinformation narratives briefly gained traction, the overarching objective of these operations – namely, to deepen social divisions and exploit existing tensions – was ultimately not achieved.

Nevertheless, most campaigns continue unabated despite repeated public attribution, sanctions, closures, and bans. This raises the critical long-term question of countering hostile influence operations effectively, sustainably, and strategically.

[Footnotes]

(1) Secrétariat général de la défense et de la sécurité nationale (SGDSN) –

VIGINUM, 2025. War in Ukraine: Three years of Russian information operations, p. 3. [online]

Available at: https://www.sgdsn.gouv.fr/files/2025-02/20250224_TLP-CLEAR_NP_SGDSN_VIGINUM_War%20in%20Ukraine_Three%20years%20of%20Russian%20information%20operations_1.0_VF.pdf [Accessed 2nd of April 2025]

(2) Secrétariat général de la défense et de la sécurité nationale (SGDSN) –

VIGINUM, 2025. War in Ukraine: Three years of Russian information operations, p. 4. [online]

(3) Secrétariat général de la défense et de la sécurité nationale (SGDSN) –

VIGINUM, 2025. War in Ukraine: Three years of Russian information operations, p. 4. [online]

(4) Secrétariat général de la défense et de la sécurité nationale (SGDSN) –

VIGINUM, 2025. War in Ukraine: Three years of Russian information operations, p. 7. [online]

(5) Secrétariat général de la défense et de la sécurité nationale (SGDSN) –

VIGINUM, 2025. War in Ukraine: Three years of Russian information operations, p. 8. [online]

(6) Secrétariat général de la défense et de la sécurité nationale (SGDSN) –

VIGINUM, 2025. War in Ukraine: Three years of Russian information operations, p. 9. [online]

(7) Norwegian Police Security Service (PST), 2025. National Threat Assessment 2025, p. 10. [online] Available at: https://www.pst.no/globalassets/2025/nasjonal-trusselvurdering-2025/_nasjonal-trusselvurdering-2025_uu-engelsk.pdf [Accessed 31 March 2025]

(8) Norwegian Police Security Service (PST), 2025. National Threat Assessment 2025, p. 11. [online] Available at: https://www.pst.no/globalassets/2025/nasjonal-trusselvurdering-2025/_nasjonal-trusselvurdering-2025_uu-engelsk.pdf [Accessed 31 March 202525]