Facebook silent as pro-Kremlin disinformation campaign rages on

This article was first published in German on June 23 here.

South Park-style Propaganda: That is how one could describe the cartoon series Ukraine Inc. It depicts Ukraine as a meat grinder devouring its own citizens and President Zelenskyy as a drug addict, wearing a golden shackle saying “Made in USA” around his ankle. Other politicians also appear in the 90-second clips, but one person is notably absent: Vladimir Putin.

The show is part of a pro-Russian disinformation campaign that Facebook parent Meta claimed it had shut down a year ago. Last summer German news outlets T-Online and ZDF uncovered a network of thousands of Facebook accounts that were spreading links to dozens of forged news websites: Deceptively genuine cloned websites of media outlets like Germany’s Süddeutsche Zeitung, or the British Guardian. In doing so the campaign tried to shift public opinion against Ukraine and those that were forced to flee the Russian invasion – above all else in Germany.

Following the media reports, Facebook-parent Meta took action. The company “disrupted” the largest and most complex Russian operation since the war in Ukraine began, it claimed in September 2022.

Propaganda network is still active

An investigation by CORRECTIV’s fact-checking newsroom shows: The network has been active again since February 2023 at the latest – and has kicked it up a notch. Over several weeks we reviewed hundreds of paid Facebook ads belonging to the campaign. On a near-daily basis, Facebook pages with random names like “furtive toes” or “steadfast pets” are created and then used to advertise pro-Russian content. This includes propaganda outlets, authentic content by AfD politicians and clones of German government websites. The network reaches thousands of users in Germany alone.

We found no evidence that the organizations and persons being promoted are connected to the actors behind the campaign – it is possible their content is promoted without their knowledge. Moreover, the ads reviewed by us may only represent a fraction of the total. The full extent of the campaign and whether other content from these or other politicians or organizations was advertised is unclear.

How the disinformation campaign attacks Ukraine  

The website seems legitimate: Germany’s Bundesadler, the federal eagle, in the top left, next to it the title: “Federal Ministry of the Interior and Community.” But the text sounds suspicious: The headline reads “it’s time to unite for a common victory.” What follows is a description of a program to “redistribute” Ukrainian refugees to German private households. “This will solve the problem of Ukrainian refugees,” it says.

There is no such program by the interior ministry, however. A close look at the URL reveals that this is not the ministry’s real website: “bmi.bund.pe” instead of “bmi.bund.de.” Everything else looks almost identical to the original: the navigation bar, contact information and recommended content. An easily missed detail, used by the people behind the campaign, to fool users into thinking they are visiting a reputable web page.

A forged government document about changes to immigration laws is also part of the campaign. In a fake draft law it says landlords renting their flats to Ukrainians will be required to notify authorities, in an effort to prevent “the formation of new criminal ethnic groups.”

The interior ministry says it has been aware of the fake website since June 1. More than a month later the forgeries are still online (as of July 12).

The campaign does not only target the German government, however. In mid-June, French authorities said the website of the Ministry of Foreign Affairs had been spoofed to spread a fake document about the alleged introduction of a tax in favor of Ukraine. Der Spiegel, along with French newspaper Le Monde, also reported on this aspect of the campaign. In France, the fake accounts also shared links to fabricated media reports – to discredit Western support for Ukraine, the French government says. Later the website of the Polish foreign ministry was also cloned.

Disinformation campaign bypasses Facebook’s measures 

The pattern of how the campaign operates has mostly stayed the same since last year: The Facebook posts usually contain a short text, an image and an innocuous-looking link which leads to the actual destination: forged media websites or other pro-Russian content. After the reporting by T-Online and ZDF, Facebook blocked a long list of URLs that led to these websites. A link with the URL ‘spiegel.ltd’, for example, can no longer be shared on the social network.

But bypassing this measure is easy for the people behind the disinformation campaign: They use new URLs that then redirect to the old websites – roughly comparable to how a URL-shortening service like Bitly would work.

On these fake media websites you can still find some of the fake news articles from last year. Major media outlets are still being spoofed, including FAZ, SZ, Spiegel, Welt and Neues Deutschland. The fake articles promote familiar pro-Russian narratives: texts stir up fear of economic collapse and portray Ukraine as a Nazi state, trivialize Russian war crimes, and incite hatred against queer people.

Some websites advertised by the campaign are not forged but propaganda outlets. This includes the two pro-Russian outlets RRN and Tribunal Ukraine. Both were promoted by the network last year already and frequently publish false information. The Russian embassies in Jakarta and Singapore have shared links to Tribunal Ukraine on their official Twitter profiles in the past. The French government named RRN as part of the disinformation campaign. RRN has since published a story claiming that France wants to “cancel” it.

Anti-Ukraine cartoon series is distributed in various languages 

What is evident ist that the campaign continues to operate internationally – sometimes spreading bizarre propaganda. The Southpark-lookalike cartoon series Ukraine Inc is distributed in Hebrew, Arabic, Ukrainian, and French.

In the four episodes published so far, the show depicts President Selenskyy as a fascist dictator with Hitler-like voice, and suggests Ukraine and its government are profiting from the Russian war of aggression. Swastikas mark the uniforms of Ukrainian soldiers. Joe Biden and Olaf Scholz slap Olena Zelenska, the president’s wife, on the butt in one episode. Zelensky is portrayed in an antisemitic manner. And as a drug addict: In one episode, the president’s office is filled with alcohol bottles, there is cocaine on his desk. Credits at the end of the episodes include the words “Ukraine Cocaine”. All these elements draw on familiar pro-Russian narratives that have been spread online since the beginning of the war: claims that Zelenskyy is a cocaine addict or that Ukraine is ruled by a Nazi regime.

During our investigation, we also came across several Facebook pages that portray themselves as alternative media and shared the cartoon series. One of them, the page The Afro Monitor, almost exclusively shares pro-Russian content. These pages target even more countries: Nigeria, Syria and Hungary, among others. The propaganda show is also spread on Twitter and Telegram, where RRN and “Putin’s German mouthpiece” Alina Lipp shared it, for instance.

It is unclear who is behind Ukraine Inc. The Facebook ads say the creators of the show are French – a claim that is unsubstantiated so far. The French government on the other hand said the show was part of the same disinformation campaign.

AfD politicians’ content was also promoted via paid Facebook ads

Others are benefiting from the campaign: members of Germany’s far-right AfD party. Among them, for example, is Harald Weyel, who sits in the Bundestag for AfD and is the party’s deputy treasurer. Several posts by the disinformation network promoted an authentic video with him.

In 2022, Weyel co-founded the association “Vereinigung zur Abwehr der Diskriminierung und der Ausgrenzung Russlanddeutscher sowie russischsprachiger Mitbürger in Deutschland” (“Union for the defense against the discrimination and the exclusion of Russian-Germans as well as Russian-speaking fellow citizens in Germany” in English) – Vadar for short. The association diagnoses Germany with an “anti-Russian sentiment” and wants to offer legal assistance to “Russian-Germans and Russian-speaking fellow citizens” who allegedly have been discriminated against or marginalized as a result of the war of aggression. Facebook ads originating from the propaganda network also promoted Vadar content.

The ads also promoted another project, started by AfD party member and former member of the Bundestag Ulrich Oehme: The “Axis of Truth,” a Telegram channel that aims to “bring closer the position of conservative parties” in Europe.

The press office of the AfD says that the party was not previously aware of the campaign. Party members and deputies are not responsible “for links or advertisements from external sources to their respective channels.” The association Vadar and “Axis of Truth” have “nothing to do” with the party, it says.

Weyel says that he had not been aware of the campaign before our inquiry. He says he does not know and cannot influence “who picks up or even ‘advertises’ my publications arising in direct or indirect connection with my Bundestag and Council of Europe mandates.”

Vadar chairman Oehme says: “As a channel operator, I cannot influence who picks up our contributions.”

Our investigation about how exactly the disinformation campaign promotes content by parliamentarians and members of the AfD can be read here.

Thousands of euros spent on Facebook ads fuel propaganda  

How much money and effort is spent to spread these types of propaganda? We reviewed hundreds of Facebook ads that we found via Facebook’s ad library and tips from a user.

The actors behind the pro-Russian campaign create new Facebook pages on a near-daily basis. Then they use these accounts to publish paid ads on the platform. This is a strategy they already used last year. Back then Meta said the campaign spent more than 100,000 US-Dollars for the ads alone.

Facebook did not respond to a question on how much money it has earned from these ads since. In most cases, this information was not available in the company’s ad library. Individual ads had a budget between under 100 and 500 euros, according to our research. Hundreds of ads would indicate thousands of euros spent.

Most of the time, the ads and pages disappear after one or two days. It is unclear whether they are deleted by Facebook or reported by users. Facebook did not comment.

What we do know is that the ads reach thousands of Facebook users. At least some of them seem to recognize the propaganda for what it is: “Fascist Russia has paid money for ads on American Facebook to manipulate public opinion,” one person commented under one of the ads.

Facebook parent Meta declines to answer questions about how these ads manage to evade Facebook’s review mechanisms. In a “threat report” for the fourth quarter of 2022 – that is, after the first major network became known – the company wrote that the disinformation campaign “tried aggressively to rebuild their operations across the internet – much more so than has been usual for covert influence operations from Russia.” It said it had blocked more URLs since the takedown and prevented more fake accounts from being created. The most recent report no longer mentions the campaign. It was published on May 3 – at a time when, according to our research, the campaign had already been active again for weeks.

The network’s trail leads to Russia 

At the moment, it is still unclear who exactly is behind the campaign. But much points to Russia.

Meta wrote in December 2022 that two Russian companies were responsible for the disinformation campaign: Structura National Technologies, an information technology firm, and Social Design Agency (Агентство Социального Проектирования), wich offers marketing and political-consulting services. On their websites the two companies both list the Russian government among their clients. Both continue to have profiles on Facebook and its sister company Instagram. Meta did not respond to a question about why the companies’ profiles are still active.

According to French authorities, Ukraine Inc’s website uses a server based in Russia. Technical details in the configuration of that server are similar to the one used by Tribunal Ukraine, according to the authorities.

Additionally, last year, we found indications that the campaign may be connected to pro-Russian hacking groups.

What we also know is that the campaign is targeting specific countries: If someone clicks the link in one of the Facebook ads, it is first verified, whether that person is located in Germany, for example. If that is not the case, a placeholder text is shown instead of a fake article, for example. This technique was already used in 2022, according to an analysis by Qirium.

Here we find another trail pointing to Russia. When some of the links are accessed with an IP address outside of Germany, a text about bakeries is shown: “Bakery (also obsolete “kalachnaya”) is a small, non-machine business for baking and selling baked goods and confectionery […],” it says in German.

The text is a translated passage from the Russian Wikipedia entry for bakeries.

Editing: Sophie Timmermann, Gabriele Scherndl

Transparency note: CORRECTIV has been in a cooperation with Facebook since 2017 to combat disinformation on the social network. More information about the cooperation is available here.