Sergei Kiriyenko, first deputy chief of staff of the Russian Presidential Administration, set the goals for the Ukraine strand of the operation, launched in early 2023 under the codename "Uganda." Alexander Kharichev, now head of the Kremlin's Directorate for Monitoring and Analysis of Social Processes, oversaw it, according to hacked correspondence published by The Insider on 21 October.

Doppelgänger disguises Russian narratives as local news through cloned media sites, fake accounts, paid ads, and fabricated videos. The FBI named Kiriyenko among its orchestrators in 2024, and its contractor, the Social Design Agency (SDA), run by Ilya Gambashidze, is still expanding, now targeting AI chatbots. The new files go inside the Ukraine campaign and show the operation reporting even exposed fakes to the Kremlin as achievements.

Telegram channels posing as Ukrainian

An internal briefing on narratives says the project ran its Telegram channels on the principles of agent work and psychological operations, the Russian version of the investigation shows. Early on, the team decided to disguise all its outlets as Ukrainian and to run its campaigns without direct Russian propaganda. Every channel carried Ukrainian news to look unconnected to Russia. Dropping pro-Ukrainian themes, the briefing warned, would eventually expose the client and wreck the whole plan.

Explore further

Russia-linked bot networks kept their weekly rhythm after drone strikes on three Yandex data centers—disinformation monitor LetsData

Four goals and a can of stew

Kiriyenko set four goals: discredit Ukraine's military and political leadership, split its elites, demoralize its army, and disorganize its population. The SDA prepared the project's pitch and carried out the work.

Political strategist Alexander Asafov proposed fakes of his own: in May 2023, that soldiers were bribing commanders to avoid the front, and in January 2024, that Ukraine was pulling air defenses back to Kyiv to protect the authorities.

After an Il-76 military transport crashed in Belgorod Oblast on 24 January 2024, Moscow claimed it had been carrying Ukrainian prisoners of war. Kharichev's subordinate Yevgeny Kazakov, chairing a meeting in his place, proposed sending a fake to the widows of Ukrainian soldiers: "They died for an expensive Il-76—the Russians have few of those." The idea was dropped.

The same meeting produced another fake, and three days later the team launched it: that recruitment centers had sent widows a can of stewed meat with a little flag as compensation. The same producers also oversaw letters falsely attributed to Deputy Defense Minister Nataliia Kalmykova, the Russian version says.

Debunks filed as results

The SDA collected coverage of its work in a folder for the Kremlin. It filed the "Zelensky's yacht" story, which JD Vance, then a US senator and now US Vice President, echoed, together with its debunk. The report also included a TikTok campaign about former Defense Minister Oleksii Reznikov's family that the BBC had already exposed.

The Insider concludes that the team has had more failures than successes. The US sanctioned Gambashidze and the SDA in March 2024, and the UK followed in October.

The claim that strikes on Russian tech giant Yandex thinned out social media bots finds no support in the networks tracked by Ukrainian disinformation-monitoring company LetsData, co-founder Ksenia Iliuk told Euromaidan Press on 13 October. She cautioned that the strikes may still have affected networks outside the company’s view.

At the Warsaw Security Forum, Lithuania’s prime minister suggested allies should ask Ukraine to strike more Russian data centers because that might help protect European elections from foreign interference. Bot networks are one tool of that interference, so whether the strikes mute them carries weight well beyond Ukraine.

No drop in the networks LetsData tracks

Drones hit Yandex data centers in Sasovo and Vladimir between 8 and 11 October. Ukrainian drone maker Fire Point said its FP-1 drones struck Yandex’s Kaluga site in between. On 12 October, Ukrainian President Volodymyr Zelenskyy told the Warsaw Security Forum that once Ukraine’s response reached Yandex, social media had fewer bots.

Explore further

More than 500 drones by Moscow’s count: Kh-101 fuel plant, second Yandex data center, and a far-north refinery hit

LetsData checked X and Facebook, where bot networks usually stand out clearly, Iliuk said. Its analysts looked at networks attributed to Russia’s influence ecosystem. Among them are groups of X accounts spreading domains from what she called a new wave of Doppelgänger, a Russian campaign that clones real news sites.

Those networks look unaffected, Iliuk said. None of them has stopped posting or broken its usual rhythm, she added. Some are slightly less active, but LetsData’s analysts say that is typical for them. The networks run on a weekly cycle, and the check fell in the part of the week when they post less.

A network that jumped from Germany to Ukraine

LetsData worked with two samples. One covers accounts that systematically target Ukraine, Moldova, and Armenia. The other covers bot networks the company has followed for some time that keep changing their target audience, so they have no fixed country.

Explore further

Ukrainian drones hit three of Russian tech giant Yandex’s data centers in four days. Ukraine’s president says the bots thinned out too

About two weeks ago, one network from that second sample wrote about elections in Germany and spread fake Die Welt sites, she said. It now posts about mobilization in Ukraine and shares a fake site of Ukrinform, Ukraine’s state news agency.

What the check can’t see

The company can compare only within networks whose usual behavior it knows, Iliuk said. Checking the whole internet is impossible because the scale is colossal, she said. A Cloudflare chart that circulated as evidence counted automated web requests from Yandex’s network, including its search crawlers, not social media posts, Cybernews reported.

So the networks LetsData follows show no impact, Iliuk said. That does not mean the strikes had no effect at all, she noted. They may have shown up in networks the company isn’t tracking now. LetsData will keep watching and report other signals if they appear.