Russian troll farms behind campaign to topple Ukraine’s government

Image:, edited by Euromaidan Press 



Over 2,000 social media profiles, directed from Moscow, were orchestrating a “third Maidan” campaign in Ukrainian social media. The internet portal investigated the origins of the social media frenzy urging to topple the government over 8 months and uncovered a network of trolls coordinated by a former “Donetsk People’s Republic” (“DNR”) militant now leading special operations in Moscow.

“Stepan Mazura” and his “Third Maidan”

It was in February 2016 when Sergei Zhuk, a “DNR” militant posing under the nickname “Stepan Mazura,” was brought to light in an investigation by UKRINFORM. Under the guise of a Ukrainian patriot, this native of Donbas better known by his nom de guerre Moskva in the circles of the militants of the Russian-backed “DNR,” was managing several facebook and Vkontakte groups in order to heat up Ukrainian society with an evil fire. The ultimate goal was to stage a “Third Maidan” that would bring people out into the streets, in order to bring to power a new “proper government” which would never again allow another Maidan to take place.

Sergei Zhuk with DNR “Deputy Defense Minister” E А Basurin

Sergei Zhuk with DNR “Deputy Defense Minister” E. А. Basurin

Authentic critical articles from Ukrainian sources were interspersed with fake reports. There were manipulative surveys on the theme of “removing [Ukrainian President] Poroshenko” with predictions by fake experts on the forthcoming total failure or even collapse of Ukraine. All the materials fit into either of two topics: “bad Ukrainian government” and “all to Maidan,” and were concocted to appeal to patriots disappointed with Ukrainian politicians, urging them towards an armed rebellion.

But the sheer quantity of material was impossible for one person to write. Moreover, the so-called Ukrainian patriot’s IP was based in Moscow. Finally, Zhuk’s friends filled in the gaps: “Stepan Mazura” had moved up the career ladder to Moscow in 2015, leading a special operation against Ukraine.

After Mazura and his virtual “Third Maidan” were uncovered, his social media accounts were deleted. However, a certain “Mykola Haiduk” suddenly took over the admin functions of the groups that “Stepan Mazura” once directed, continuing the fight for toppling the Ukrainian government with the help of an army of trolls. What follows is an abridged and adapted translation of Texty‘s investigation.

The “Third Maidan” – an idea born right out of the second one

The concept of the “Third Maidan” isn’t new. Voting falsifications which brought a fraudulent presidential victory to Viktor Yanukovych in 2004 brought people out to the first Maidan, known as the Orange revolution. The second Maidan – Euromaidan protests – removed the same Yanukovych from power in 2014. Right after it, political analysts started warning that, apart from a military invasion of Ukraine’s eastern regions, Russian president Vladimir Putin will be aiming to incite a revolt against the new government elected in Ukraine after the Euromaidan revolution.

What better way to carry this out than creating a false-flag organization which your enemies would enter. In 1921-1926, the State Political Directorate of the Soviet Union ran “Operation Trust,” a counterintelligence operation during which a fake anti-Bolshevist resistance organization “Monarchist Union of Central Russia” kept all the enemies of the regime under close surveillance and ultimately neutralized them.

These activities are being employed also today. According to the data of the Ukrainian special services, around 300 specialists in Moscow are tasked with recruiting and managing agents in Ukraine. But working on the internet is much easier – one can hide behind the anonymity of an internet profile.

“An element in the Soviet (and now Russian) toolkit is “active measures”—direct intervention by clandestine means in the politics of another country. Active measures may entail the following:

  1. Influencing the policies of another government;
  2. Undermining confidence in its leaders and institutions;
  3. Disrupting its relations with other nations;
  4. Discrediting and weakening governmental and nongovernmental opponents,”

Edward Lucas and Peter Pomerantsev explain in the report “Winning the Information war.”

In the “Third Maidan” social media groups, Russian political technologists regularly promoted the idea of an armed uprising against the current government to Ukrainians who cared the most about the situation in the country.

How does this work?

Texty journalists analyzed 29 social media groups, whose administrators or active users are connected to “Stepan Mazura” or the communities he managed. Professional trolls stand behind a part of these accounts, and a part is regular people who became facebook friends with trolls from the group. The result is a network of 2,000 social network users.

The troll network. Snapshot from

The troll network. Snapshot from

“There can be many networks like this,” Texty editor-in-chief Roman Kulchytskyi told RFERL. “Anybody with enough resources can hire the relevant specialists, can create a network of bots. We uncovered one of the Russian networks, but there can be many of them.”

#Betrayal (#Zrada). Image:

A troll, or account of a live person or a robot that is used for political propaganda, creates automatic friend requests. With each new “friend,” the troll grows in size. Its social network “weight” increases if it befriends a popular blogger.

A troll program can exchange sweet nothings or likes with a similar program. These acts also increase their “weight.” But when the time comes, when some topic needs to be promoted, the troll accounts start to be managed by a real person.

Also, real people, often acting under pseudonyms, moderate groups with large concentrations of trolls. These were also included in the “troll network.”

When the time comes and the managers of this troll farm want to promote some message, one of the trolls make a post. A huge amount of others start liking, commenting, and sharing it. The facebook algorithm identifies this as real people being interested in the post, and it surfaces in the facebook feeds of NOT-trolls who once accepted the troll’s friend request.

If the post is successful, ordinary people start sharing it, and eventually the journalists catch up. If a person has too many friends spreading troll content, which focuses on emotions and conspiracy theories, then the impression is made that the only way to escape the seemingly hopeless situation is to resort to violence. The troll accounts bluntly suggest ousting Ukraine’s current President Poroshenko, like the previous one.

The style of Russian trolls in Ukraine

There were trolls who specialized on posts (the most active ones made 300-600 posts over two months), changed their names often, but were possible to trace because of the immutable facebook ID assigned to each user.

Another category of trolls left prolific comments under the posts – up to 720 per two months. Often, the comments were copy-pasted to save efforts. Here is an example of one by “Dmytro Zvolinskyi” that was copy-pasted 130 times, featuring names of Ukrainian oligarchs and politicians, among them the current President Poroshenko:

“Dmytro Zvolinsky”‘s avatar

“Dictator Medvedchuk.KuchmaAkhmetovPinchuk”: “DICTATORSHIP HAS BEEN ESTABLISHED.” Each traitor WILL ANSWER for his crimes. Kuchma, Medvedchuk, Pinchuk, Akhmetov, Yushchenko, Yanukovych, POROSHENKO are INTERNATIONAL criminals who DESTROY Ukrainians. Such a pity that there are little free people – most are SLAVES.”

He actively promotes “10 steps on the way to dignity,” the main goal of which is to gather people on Maidan without politicians, impeach the President and demand unspecified “changes.” Hysterical appeals to castrate “the criminal GROUP ‘Presidential Administration'” and “Poroshenko and Putin Bloc” have little to do with reason. But after all, we’re living in a post-factual world where it’s most important to achieve an emotional resonance with your target audience.

Archetypes of the “Galaxy of trolls”

The typical troll falls into one of four main types, which in the opinion of Texty are universal images firmly embedded into national memory, the ones Carl Jung called archetypes.

1. The revolutionary radical, a propagandist of violence, national revolution against the internal occupation and harbinger of death to Yatsenyuk, Groysman, Putin, Poroshenko, Jews, gays, government officials etc. His leitmotif: “We’ll destroy the government, kill all the bad guys, and then finally live the good life. These militant trolls often display sympathies for ultra-right political movements and imitate the cult of Stepan Bandera.

2. The political commentator, who focuses more on the current political events than appeals to a revolution. This trolls specializes on derogatory images of politicians or officials.

The general tone of their messages is nearly identical to the revolutionary radical, but there’s more political dirt.

3. Ukrainians on display. Pensive girls in traditional flower crowns, dresses in the color of the Ukrainian flag. This image carries an element of suffering straight out of Shevchenko’s novels. However, the content doesn’t differ much: the same hyperlinks to questionable sites, discreditation of the authorities, examples of injustice, and solid proof that all is lost.

4. Carnivores. Not cats! This is a rare type of trolls: they have many friends and connections in the network, often are group administrators, but they seldom make posts.

Links leading to questionable sites

Most of the trolls’ posts are hyperlinks, not original materials. They lead to sites of questionable quality which intersperse real news with manipulations and fakes.

Who is a real user? Who is a troll?

Texty provided some indicators pointing to a high likelihood of troll-ness:

  1. No photos or information about the person, the page has little personal posts, mostly – reposts about “enemies,” “traitors,” or “white noise” posts – about methods to lose weight or tie a tie, all without personal comments and impressions. Often, a troll is 80% program which can post such meaningless content. Sometimes the troll is tagged in a photo with a real person.
  2. Either too little or too many friends (either the same trolls as themselves or popular users, including Ukrainian politicians).

Real people ended up in Texty‘s investigation – because they became friends with a troll, were added to a group, or because they believed in the troll’s activities. In this case, the manipulations of the Kremlin brought fruit.

“Sowing mistrust ” – a classic strategy

The propaganda that the Kremlin produces for Russians doesn’t really work in influencing the majority of Ukrainians: they don’t believe in tales about the world planning an attack against Russia, and clearly see Russian aggression against Ukraine.

But we should remember that war propaganda has different audiences. Its goal is to boost the morale of your own team and demoralize your opponent.  In the Ukrainian case, this means discrediting the authorities and state institutions. After all, why should ordinary Ukrainians “go fight for the oligarchs?”

“Sowing mistrust between the elite and masses” is one of the methods of winning over an enemy state known from times of ancient China.

Ukrainian patriots and volunteers, or more specifically, their virtual dummies, are ideal vehicles for spreading sentiments of “betrayal” and calling for a new revolution. For the Kremlin, it makes no difference that the “revolutionaries” vilify Putin and Russia on their facebook profiles – after all, it’s the result that matters, Texty stresses.

Read more: ZRADA: the Ukrainian talent of feeling betrayed whenever, wherever

The content of the facebook groups and profiles that Texty uncovered are filled with hatred and contempt for Ukrainian authorities and politicians. Parallels are made between Putin and Poroshenko-Yatsenyuk-Groysman. The name of the Ukrainian President or Prime Minister doesn’t matter – even when they change, they won’t stop getting battered by the trolls, and the arguments will remain identical.

Pseudopatriotic trolls are much more dangerous than vulgar missionaries of the Russian world, Texty warns. Ukraine has a drastically low level of trust in public institutions and law enforcement structures – volunteers, the Church, and the Army is trusted the most. This is used by the enemy.

The solution?

Texty warns: don’t give into emotions. Don’t share hysterical posts, don’t become friends with trolls. To improve the quality of governance in Ukraine, one should look for the reasons of problems, change each given situation, provide grounded criticism, but not discredit even further. If there is no trust in state authorities, there is no fundamental order, and chaos erupts.



Tags: ,