That modern warfare will unfold on a cyber front, as well as on the physical battlefield, has long been expected. Yet, since Russia’s full-scale invasion of Ukraine in February 2022, awareness of the weaponisation of information has grown sharply. Indeed, as EU High Representative Josep Borrell noted in 2023, the intensity and velocity of information spread today far exceeds that of earlier propaganda eras, making influence operations an increasingly powerful method of war -- particularly in the wake of developments in LLM technology. Consider, for instance, Doublespeed, a new startup providing clients with the tools for “bulk content creation”, or, in the words of its founder Zuhair Lakhani, giving customers access to their own “phone farm”. With such technologies able to “mimic natural user interaction” online, our concern about the role of information warfare should only be heightened -- especially given that in the last decade alone, EUvsDisinfo has identified over 19,000 cases of Russian disinformation.

Most importantly, however, Borell observes that while Russia has invested in disinformation and information manipulation “as an industry”, the West has not done enough to develop their defensive capability in this dimension. For instance, far from relying solely on overt disinformation, Russian operators increasingly employ a ‘multi-pronged’ approach, reporting neutral news items alongside sensationalist narratives to create ‘narrative dilution’. This normalises propaganda, eroding users’ ability to discern manipulation. Consequently, without investment into research and observation, our ability to understand the Kremlin’s information warfare tactics is impeded, thus creating gaps in our ‘epistemic security’. 

One example highlighted by Borrell, which illustrates the speed of disinformation transmission, concerns the EU’s Military Assistance Mission to Ukraine. The Russian Ministry of Foreign Affairs falsely framed the initiative as an act of NATO ‘hybrid warfare’ on its website; within minutes, this narrative had been disseminated across hundreds of Telegram channels, amplifying its reach as effective propaganda. This underscores the need to investigate the role of Telegram channels within Russia’s broader information ecosystem.

Methodology

Social network analysis is a method used to map relationships between entities, such as individuals or online accounts, to reveal how information and influence flow through a network. Using the top 0.1% of nodes (n = 3,074) from a dataset of Telegram channels that referenced one another, I conducted a social network analysis to visualise how news - and news-related discourse - circulates within Russian-language Telegram communities. By mapping channels which reference and cross-post from one another, we identified dense clusters of accounts which frequently engage with the same content. A follow-up qualitative analysis examined select clusters to identify the narratives they shared.

Figure 1: Visualising Telegram channels with shared narratives

Findings revealed that a small number of highly connected channels dominate the information space, acting as central hubs which widely and immediately disseminate information (Figure 1). Around these hubs sit a constellation of smaller clusters, typically dyads and triads of niche channels, which reflects a typical social media ecosystem structure, where audience self-selection reinforces echo chambers of shared ideology and interest. One peripheral cluster, in the lower right hand side, stands out in particular: a compact group of channels unusually uniform in size and content. This suggested the possibility of a group of channels with strong narrative overlap, perhaps due to a shared topic or ideology. 

Subsequently, using community detection algorithms, 68 unique clusters were revealed. The two most central Telegram channels in each were identified and labelled (Figure 2). 

Figure 2: Community Detection, with Central Nodes Labelled

So as to conduct follow-up qualitative research, smaller clusters were filtered out: we left the largest communities (clusters 1 through 5), as well as cluster 32, which appeared to demonstrate an unusual pattern (Figure 3). 

Figure 3: Largest Communities in the Network

Analysis of cluster 1 channels revealed the cluster to primarily consist of Russian state-aligned media outlets, such as TASS and Interfax. Content included legislative updates, coverage of natural events, and official geopolitical statements. Notably, the tone was neutral and non-editorialised, avoiding emotive framing. This contrasted heavily with cluster 2, which consisted of channels focussed on investigative “exposés” about corruption and financial misconduct among Russian government officials. Posts typically employed defamatory, gossipy, and sensationalist language, aiming to disparage Russian elites. Importantly, while this could suggest that Cluster 2 reflects civilians’ views more truthfully, some evidence suggests that the divergence between cluster content may be the result of a calculated, dual-pronged approach taken by the Kremlin. Indeed, as outlined in Fridman’s (2024) research, the Kremlin purposefully exerts different levels of power on Telegram actors, so as to create the illusion of freedom: “within Russia’s ‘communication regime’ [...] media actors know that they have a long leash, but there are grim consequences for extending it too far”. In other words, certain Telegram channels may be heavily regulated; for instance, in April 2025, the Russian media regulator Roskomnadzor launched a Telegram bot (@Trustchannelbot), which would monitor bloggers with over 10,000 followers, and require them to disclose both their identity and their subscribers’ personal data. Such tools enable surveillance, which, in turn, allows the Kremlin greater control over the manufacture of ‘controlled pluralism’, where some channels are heavily regulated, while others appear more salacious and honest. This leads users’ capacity for discernment to be overwhelmed, fostering cynicism and disengagement. 

In the third identified cluster, although Telegram channels do make infrequent posts about internal Russian politics, content predominantly centres on the war in Ukraine. Channels typically projected anti-Ukrainian sentiment alongside other, more neutral posts, such as archaeological finds in Peru. Referencing stories about Ukrainian repression and Ukrainians allegedly fighting military officers, channels attempted to portray Ukraine as chaotic, violent, and corrupt. Simultaneously, channels would highlight Russian cultural and political dominance - for instance, through messaging claiming that Western powers are rethinking support for Kyiv, or finally recognising its ‘illegitimacy’. This evidence of ‘narrative dilution’ aligns with hypotheses of Russia employing more subtle information manipulation strategies, as the blend of neutral and politicised content normalises the latter, minimising the urge for ‘truth-seeking’. Indeed, psychology research on misinformation indicates the sharing and belief in false headlines predominantly emerges from a lack of attention on the part of the user, a vulnerability that is clearly leveraged by this tactic.

Finally, cluster 32 was examined, revealing that each channel published near-identical content. Cross-posting occurred across local channels (e.g., Архангельск, Барнаул, Челябинск), with a focus on national priorities and statements from Russian officials. The uniformity across regions suggests these are automated or centrally managed nodes rather than organically developed communities, perhaps developed to give the illusion of localised grassroots consensus. This also explains why all the nodes in this cluster are broadly the same size, appearing more like “peers”, than a hub-and-spoke model. Posts were often accompanied by an unrelated financial hyperlink, suggesting the possibility that these accounts are scam or spam bots. 

Taken together, these findings suggest that Russia’s disinformation strategy on Telegram relies not  on a single narrative voice; rather, a complex information ecosystem blends ‘neutral’ state-aligned news with sensationalist claims. Such diversification of strategies only makes Russian information warfare more dangerous and harder to detect. Further, given recent reports by OpenAI identifying Russian operations already using these tactics alongside AI-generated content, the need for the West to develop defensive capabilities to combat information warfare proves of utmost urgency - particularly as attempts grow increasingly automated.