I cannot recall a single day I haven’t been on Telegram since ISIS and al-Qaeda began using it in 2015. Smart phone messenger apps were essential to the terrorist recruitment machines run out of Syria, but only Telegram, a major cloud-based messenger service used across the world, had the quality and features to house the entire global jihad. As the years went on, similar migrations of other extremist movements—Neo-Nazis, QAnon, and so on—have made me all the more bound to monitoring the platform.
However, Russia’s invasion of Ukraine has marked a drastic escalation in how Telegram fuels violent conflict. Exploiting Telegram’s vital informational role across Ukraine amid the conflict, Russia is leveraging the platform as a tool toward its invasion on the ground. Seeing it all in action this last month, it’s clear Telegram is becoming a critical tool for state warfare in the Digital Age. For an international community rushing to preserve democracy, this should be a seen as blinking red light.
In the days leading to Putin’s invasion of Ukraine, Telegram was a madhouse of fundraising and mobilization by Ukrainian and Russian-aligned operatives alike. At SITE, the counterterrorism organization I head, we began tracking the ways both sides were using the platform. We found that one side in particular was leaning hard into a digital war steeped in deception and coercion.
On February 24, the day of Putin’s invasion, we came across a message from a Telegram channel branded under Azov, a Ukrainian far-right paramilitary and political movement adored by many of the Western Neo-Nazis we track. The channel was reaching out to anyone willing to “support the final stand” by Azov and Ukrainian forces against Russia, offering several donations options, including cryptocurrencies like Bitcoin and Monero.
At face value, the post might not have seemed abnormal. Azov channels and chat groups on Telegram had been openly soliciting donations ahead of Russia’s imminent invasion. Still, something seemed off. None of Azov’s main channels were promoting these donation options. Why? And just a couple days before, members of an Azov recruitment chat had already been asking if Azov would begin “accepting crypto donations,” but the group had not yet set up such methods.
After searching the message in SITE’s SourceFeed database, whereon we archive extremist activity online, it became clear this wasn’t an Azov channel, or even an Azov-supporting channel. Rather, it was a scam connected to a Kremlin-aligned group called “Defenders of Donbass,” which has for years fundraised for pro-Russia separatist militias via the exact same information given in the fake Azov post. A Defenders of Donbass’ administrator openly disclosed to others in a chat group that the fake Azov channel was purposed “to maximize donations” to pro-Russia separatists by fooling Neo-Nazis into thinking they were donating to Azov. The admin bragged, “it is my channel, i think you can guess where the donations link to.” These posts were deleted soon after, but not before SITE archived them.
Fake Azov promotional message showing the same crypto and financial services information as a Kremlin-aligned channel
As the admin hoped, this bogus Azov channel and its donation message had already been shared across far-right Telegram chat groups like the National Socialist Movement, Nordic Resistance Movement, and White Lives Matter movement, which ironically came to serve as a de facto mobilization venue for Azov in the weeks that followed. To this day, the fake Azov channel remains active with more than 2,000 followers and its donation solicitations are still circulated on far-right chat groups.
The impacts of this war’s cyber front extend far beyond scamming Neo-Nazis for donations, though. Since the lead-up to Russia’s invasion, we’ve been tracking a coordinated network of Kremlin-aligned entities promoting Telegram bots purposed to help Russia gather intel on Ukrainian military locations, among other items. Telegram bots are essentially programs that carry out various tasks: relaying messages to users, providing information to specific queries, playing media, and so on. These Russia-aligned operatives’ bots function similarly to Telegram users, meaning that Ukrainians can message them directly.
Messages promoting these bots have been spread across platforms like Facebook, Telegram, VK, LiveJournal, and Russian domain forums. These posts appeal to all from misinformation and recruitment to outright manipulation of vulnerable Ukrainians. One such message asks Ukrainians to contact a designated Telegram bot, abbreviated as “RSOTM,” with “any information on the location and/or movement” of Ukrainian and allied forces. In an absurd appeal to humanitarian concerns, the message follows up:
If you are able to indicate the location of civilians and how far they are from the Ukrainian military, please notify at what distance they are from the military in order to ensure the safety of civilians. After transmitting the data to us, please hide yourself and your loved ones.
All information will be directly communicated to the Russian Armed Forces with complete anonymity guaranteed!!!
The message also addresses Ukrainian soldiers, promising those who drop their weapons and cooperate: “…we will transfer you home, to relatives and friends.”
Message promoting Russian Telegram bot
Of course, Russia’s promises of protecting civilians are absurd given its strike targets, which have included a maternity ward and theater with the word “children” written on both sides of it. Furthermore, I can only imagine how infuriating such hollow promises are to the many Ukrainians who no longer have a home to “transfer” to—or remaining family members to “transfer” with.
Nonetheless, these bots—and the absurd promotions of them—are abundant. Another bot, “W,” appears aimed at facilitating demoralized Ukrainian soldiers’ surrender (that is, if one believes that to be true), promising “all the necessary assistance in the process of switching to the side of the Russian Federation, the DPR and the LPR.”
It shouldn’t be surprising that Russia is playing this game. Telegram’s immense popularity among Ukrainians makes the platform a sea of potential informants. Even if Russia were only to get a few bites from the many, it could translate to substantial gains on the ground.
That said, the messages promoting these bots often read like something you’d expect to see on the Dark Web, not something on an app with over 500 million users. “For the exact coordinates of Arsen Avakov's location, our wealthy subscriber is ready to pay 30K bucks,” reads one bot-promoting message, referring to Ukraine’s former Minister of Internal Affairs. Other messages promised “generous pay” for “reliable information about the location of Tochka-U missile systems of Ukraine.” One bot, abbreviated as “Z,” was developed for Ukrainians to “send a photo, video or coordinates of where the Ukrainian war criminals are hiding.”
It is unclear how impactful these bots have been for Russia’s ground war thus far, but as one user in a cyber-focused channel run out of Ukraine alleged: “The Muscovites coordinate with local traitors through bots. This has already led to a missile strike on take-off helicopters in the Vinnytsia region.”
Intel or no intel, Russia’s bots are, on a simpler level, loudspeakers for the Kremlin’s shoddy, evolving narratives amid its war on Ukraine: framing the Ukrainian government as oppressive “Nazis” and the Russian military as their saviors. One post promoting a bot abbreviated as “OOZ” gives a backhanded promise to Ukrainians who cooperate, stating, “Help is nearby. Help for you and your children - right behind the back of a Russian soldier.”
The message further attempts to justify Russia’s bombardment of citizens, squaring the blame on the Ukrainian forces protecting them:
The only ones who do everything to make the horror around you continue indefinitely and become even stronger are the Nazis. By placing their units, their equipment, and artillery among you, they make hostages of you…Unfortunately, in order to destroy the Nazis, the soldiers of the Russian army will have to destroy the buildings where the Nazis are…
Ukrainians have naturally zeroed in on this corner of the cyber front, calling on others to “join the Information war with the occupant” by blocking Russia’s bots or reporting them. However, Russian-aligned operatives have prepared for Ukrainians’ countermeasures against their bots by proliferating them. For example, those running the RSOTM bot have created an array of back-up versions of the bot should the initial version should be removed.
Backup RSOTM bots
Meanwhile, the Ukrainian government has even launched its own Telegram bot called “e-Enemy,” with which Ukrainians can pass along information to the Ukrainian government, from pro-Kremlin propaganda channels to information on Russian soldiers’ locations.
The role apps like Telegram play in militancy is often framed as a reflection of larger conflicts and societal conditions. While this is all true, these applications—or more specifically these days, Telegram—is also its own staging ground, with its own agency in shaping the physical world around us. In my forthcoming book, I show how social media and messenger apps are no longer venues where terrorist groups convene, but where they are formed. Without platforms like Telegram, many smartphone-era terrorist groups wouldn’t exist at all.
Yet what we’re seeing with the Russia-Ukraine war suggests a similar yet potentially more dangerous dynamic emerging in state warfare: the strategies, actors, and entire course of a deadly invasion being steered in part by what happens online.
Russia’s operations on Telegram are also sobering doses of reality to the commonly espoused, but largely false notions that Telegram is fully encrypted (it’s not) or, better yet, that it is somehow a thorn in the side of a tyrant like Putin. For all the anti-authority cred gifted to Telegram and its libertarian founder Pavel Durov, the platform seems to be working out pretty well for the Russian government. The bots I’ve described in this article are just one feature of a massive Kremlin-aligned infrastructure on the platform, ranging from propagandic news operations and fundraising for separatists in Donbass to recruitment on behalf of the Wagner Group, a notorious Russian mercenary group.
The Russian President has had no hesitation blocking major platforms like Facebook in his country. So, if he found no use in Telegram, where the very same news outlets he’s banned can be easily found, it’s safe to presume he would have already done the same.
Russia’s weaponization of Telegram isn’t a story of one war. It is a case study with grave implications for future state conflicts, unless something is done.
As impossible as it might seem for Telegram to moderate a bullying state actor like Russia, it is not impossible. ISIS is proof of this. Following widespread international demand amid constant ISIS attacks in past years, Telegram was forced to get serious about moderation. Now, after collaborative counter-efforts with entities like Europol, the act of even visiting an ISIS account is often grounds for instant removal. After all, Russia deserves no more license to solicit help with assassinations via Telegram bots than ISIS does to distribute bomb manuals to fellow terrorists.
Still, for all the recent reporting on Telegram’s prevalence in Ukraine and Russia, there still seems to be a sense, particularly the United States, that we’re talking about a niche messenger application—that the stakes of what happens on Telegram are lower than on platforms like Facebook. Nothing could be further from the truth, though. Telegram has grown its usership 175 percent since 2018 and was the seventh most downloaded app between Apple and Android devices in 2021. It is a leading global forum with major impacts on the health of democracies and yes, violent conflicts.
The international community must insist that Telegram be moderated with the same veracity that a nation’s sovereignty is protected, because as times goes on, these two matters will increasingly coincide.
