How do Russian cyber fraudsters and propagandists exploit Ukrainian journalists?

The Russians are changing their tactics in both the military and media spheres. A new trend of the Kremlin’s “cyber battalion” is the creation of fake websites, which are duplicates of well-known Ukrainian news agencies, on which material with pro-Russian narratives is published, according to Ukrainian media, whose journalists have been investigated by the UNESCO-funded investigative journalism project “Protecting the Front 3”.

Chernihiv-based journalist Irina Sinelnik was surprised to learn in August that she had authored a series of dubious publications. Signed with her name, they had provocative titles such as “The bloody show must go on”, “A Kremlin agent has infiltrated the Central Intelligence Service”, “How did Ukraine become the biggest supplier of children on the human trafficking market?”.

The fictional material was published on the fake website of the Unian Agency news agency, for which Irina works.

If normal UNIAN news links end in “html”, then fake ones end in “php”.

Visually, the page looks identical to the original. The fake material was promoted on Facebook through advertorial posts, which resulted in the internet smear receiving around 500 reposts and visibility of 40 thousand people. Sinelnik came to the conclusion that it was the victim of a deliberate provocation.

Meanwhile, other fake pages of the RBC-Ukraine news agency and the Obozrevatel website started appearing online. They similarly promoted anti-Ukrainian narratives.

The text “Corruption = Betrayal” states that Ukrainian soldiers have been robbed and literally left without trousers. The news also quoted false statements by the Commander-in-Chief of the Armed Forces of Ukraine, Valery Zaluzhny.

“All the articles are written quite professionally, in literate Ukrainian. It is difficult to know whether they were created by real authors or artificial intelligence. Of course, my editors have issued a statement about this information sabotage. But first I decided to protect my reputation,” explains Irina Sinelnik.

Irina sent requests to all possible structures that should fight Russian propaganda on the Internet. However, even after a month, she has not received any official reply.

Konstantin Korsun, a cybersecurity expert, says that “cybercrime can be controlled by various methods, most of which involve sending complaints to various institutions, from local providers and domain registrars to the national police”.

At national level, he says, this work should be undertaken methodically and professionally by state agencies.

For example, there is the Centre for Countering Disinformation of the National Security and Defence Council, the Ministry of Culture and Information Policy, and many other government organisations.

“Currently, there are no international legislative acts regulating information and cyber security issues that are mandatory in Ukraine,” Korsun says.

The Council for Television and Radio, which officially started registering websites as media a few months ago, clarified that it does not monitor or delete fake sites.

Valentin Koval, first deputy chairman of the National Council for Television and Radio, says that “the new media law does not talk about combating such fake websites and accounts”.

Meanwhile, he says that such crimes are linked to the infringement of intellectual property rights, as certain trademarks are used. “Of course, we are also talking about countering propaganda, especially since the articles successfully imitate real ones and are written in excellent Ukrainian.”

Koval believes that such sources should be banned, but we understand that this is a fight against chimeras and they can be endlessly created. I believe that the publications and agencies concerned must monitor and report on such sources. And they must be investigated by the police.”

The Cyber Police and the Security Service of Ukraine told Ukrainian media that in 2023 they had received only one official appeal from the owner of a website that “a fake source is completely imitating a real one and putting false information on it.”

The head of the Cyber Police Directorate, Jurij Vjkodec, advised journalists who are victims of cyber propagandists to take videos of false information and transfer them to his department. This can be done especially on the platform created to fight Russian propaganda – https://mriya.social/

The press service of the Cyber Police and Security Service of Ukraine explained that they block epigon sites in cooperation with the Ministry of Digital Transformation and the National Centre for Operational Management of Telecommunication Networks of the State Service for Special Communications.

Materials with the name Irina Sinelnik have already been banned from the Ukrainian segment of Google, but she drew attention to the fact that ghost sites continue to operate abroad.

In fact, the propagandists’ damage has not been completely undone, they are still freely read in other countries and in Ukraine with the help of VPNs.

According to Dmytro Zolotukhin, an expert on information warfare and competitive intelligence, duplicating locations on other URLs is not a new tool, such manipulations were used by pro-Russian technologists ten years ago.

“Unfortunately, the public sector still does not understand how to effectively counter disinformation in the legal sphere. Previously, this issue was dealt with by a line ministry, but then it was scrapped as unnecessary.

Instead, the two centres for countering disinformation at the Ministry of Culture and the National Security and Defence Council do not have the necessary powers to monitor fake websites and stop the spread of propaganda. “Even though they receive significant state and foreign donor funding,” he adds.

Igor Solovei, head of the Centre for Strategic Communication and Information Security at the Ministry of Culture, rejects accusations that his ministry is powerless. He points out that his centre works closely with a similar one at the National Security and Defence Council. Its staff analyses the tactics of Russian propagandists and blocks their activities on Ukrainian territory.

“The enemies are skilled in the mastery of website forgery. The same applies to texts. They are probably produced by Ukrainian citizens in the occupied territories or by those who have left for Russia. Although there are fellow “writers” who are in Ukraine and produce products for such dumps for a small fee. “I can only assume that these are former employees of Medvedchuk Holding, who were left without work after the closure of its network.”

In his opinion, the Ukrainian counter-propaganda is working well.

“Previously, the Russians had much more opportunities to influence the consciousness of Ukrainians with information, thanks to the media structures that worked for them in Ukraine. Now our enemies have to invent more cunning ways.”

Irina Sinelnik was not only surprised to hear that her name was being used by Russian propagandists, but also extremely worried about the reputational risks following this embarrassing story. Unfortunately, journalistic colleagues also took the bait. Apart from Irina, no other media victims of cybercrime have tried to complain publicly to members of the criminal justice services and trade unions.

The Slovenian Journalists Syndicate is aware of the situation with the duplicate sites, but sees no point in creating separate “white lists of propaganda tainted”.