The Telegram information space in Ukraine is characterized by a high degree of anonymity, vast audience reach, and the absence of strict algorithmic moderation, which creates ideal conditions for the application of social engineering technologies. 

During an in-depth analysis of comment threads under the most high-profile publications (the so-called “hot topics” concerning mobilization, corruption, or geopolitical shifts), a clear division of traffic into three main categories was identified. Statistical analysis of activity shows an anomalous concentration of comments from a narrow group of accounts. 

In some discussion areas, for example regarding Donald Trump’s statements about lifting sanctions on Russian oil, up to 72% of top comments are generated by only a few profiles, which is an indisputable sign of coordinated inauthentic activity.10

Traffic category Estimated share in high-profile topics Main markers and behavioral patterns Strategic objective
Russian IPSO 40% – 45% Use of naming in the Name_Numbers format (for example, @Andrey_9748). Systematic dissemination of theses about “external governance,” “the West’s betrayal,” and “Kyiv’s incompetence.” Shifting blame for the war onto the Ukrainian authorities.10 Destabilization of society, disruption of mobilization, undermining trust in state institutions and Western partners.
Organic traffic 30% – 35% High emotionality, focus on everyday aspects of survival (food prices, fuel, family safety). Aggressive reactions to planted narratives and government actions. Lack of systematic posting.8 Expression of genuine fears, search for information for physical and economic survival, social release.
Ukrainian bot farms 20% – 25% Uniform lexicon (marker words such as “powerfully,” “unbreakably”). Aggressive defense of government actions or, conversely, systematic attacks by opposition bots on the president (tags “green mold,” “95th Quarter”).8 Formation of artificial consensus, protection of the reputation of political assets, marginalization of critics of the authorities.

Modern Russian information-psychological operations in Ukraine have evolved. They very rarely create fake content from scratch, understanding that blatant lies are quickly debunked by fact-checkers. A far more effective and destructive strategy is to seize a real news hook, often a negative one, and radically semantically repack it in order to stimulate a deep split within Ukrainian society.11 The impact of this activity is assessed as critically high, since it parasitizes on the population’s objective fatigue from prolonged war.

A classic example of the application of reflexive control tactics is the incident that occurred in March 2026 in Hungary. According to official data, the Hungarian authorities, using special forces and armored vehicles, detained two cash-in-transit vehicles of the state-owned Oschadbank, which were traveling along a regular transit route from Austria to Ukraine. The vehicles contained colossal assets: 40 million US dollars, 35 million euros, and 9 kilograms of bank gold intended to support the liquidity of the Ukrainian cash market.6 Seven Ukrainian cash-in-transit employees were held in handcuffs at gunpoint for 28 hours, without access to lawyers or a consul.14 Ukraine’s Minister of Foreign Affairs, Andrii Sybiha, rightly and firmly characterized the actions of official Budapest as “state terrorism,” “racketeering,” and “hostage-taking,” pointing to violations of international conventions.12

It would have been logical to expect consolidation of Ukrainian society in the face of the openly hostile actions of Viktor Orbán’s government. However, Russian IPSO immediately seized the initiative in anonymous Telegram channels. The focus of discussion was artificially, but skillfully, shifted from Hungary’s aggression to hypothetical internal Ukrainian corruption.12

Bot networks began massively injecting and amplifying the narrative about “the removal of loot by Ukrainian elites” and “money laundering.”6 To закрепить this narrative, specific criminal and marginal lexicon was used: the state bank was renamed by bots as the “Obshchak Bank,” and the unprecedented actions of the Hungarian prime minister were presented not as an attack on Ukraine’s sovereignty, but as “stealing from the common pot” (“stealing from a thief”).6 Hungarian Foreign Minister Péter Szijjártó played into this narrative by stating the possible involvement of the “Ukrainian military mafia” and interference in Hungarian elections.11 

As a result of the coordinated information attack, a real act of interstate hostility was successfully converted into an internal anti-government revolt in the digital space. Citizens in the comments began demanding reprisals not against the Hungarian authorities, but against Ukrainian officials.

A similar mechanism is applied in the coverage of global events. Against the backdrop of the military operation by the United States and Israel against Iran, global Brent crude prices broke through the psychological threshold, reaching 110–119.5 dollars per barrel.1 In his rhetoric, US President Donald Trump described high energy prices as “a small price to pay for peace and security,” which would follow the elimination of Iran’s nuclear threat.8 At the same time, media reports emerged about the Trump administration’s readiness to ease sanctions against Russian oil in order to stabilize the global market.2

Russian IPSO used these facts to spread the narrative of “the West’s total betrayal.” In the Ukrainian segment of Telegram, the idea was actively promoted that the United States was saving the Russian economy, while Ukraine had been “taken for fools,” having been forced to give up nuclear weapons.10 Theses were introduced that the war in the Middle East is a colossal financial gift personally to Vladimir Putin, who will now receive superprofits to continue aggression against Ukraine.8 Thus, objective geopolitical difficulties are transformed into a sense of existential doom and distrust toward key strategic partners.

Countering Russian IPSO in the digital environment is often undertaken by Ukrainian political bot farms affiliated with various political forces. However, an assessment of their usefulness leads to disappointing conclusions: the activity of domestic troll factories causes significant harm to the information health of the nation and to the moral and psychological state of society.8

The main objective of pro-government bot farms is to create the illusion of total support for government decisions, protect officials from criticism, and form the so-called “toxic positivity.” Their methods include the mass use of template patriotic phrases, uncritical praise of any actions by the leadership, and the aggressive labeling of any user expressing justified skepticism as a “Kremlin agent” or “draft dodger.”8 Opposition bot farms, in turn, aim to discredit the current authorities as much as possible, focusing on any failures and actively using black PR.9

The damage caused by this activity is colossal. 

Under conditions of a severe existential crisis, daily losses, and a high level of stress, organic users have an acute, almost physical sensitivity to falsity. The primitive and aggressive narratives of bot farms provoke in real citizens an effect of sharp rejection. Instead of consolidating society, such actions by pro-government and opposition digital structures only confirm citizens’ suspicions that politicians are trying to manipulate them while ignoring real pain and problems.8 

This creates a vicious circle: Russian IPSO attacks vulnerable points, Ukrainian bot farms defend themselves clumsily and aggressively, and organic society develops growing hatred toward both sides, sinking into a state of social anomie and alienation from the state.

Deep content analysis reveals a catastrophic cognitive dissonance between what the state machine broadcasts and what citizens urgently need. This is not merely a difference in subject matter; it is a fundamental difference in the optics of perceiving reality.

The official public agenda, transmitted through the President’s addresses, statements by the Ministry of Foreign Affairs, and the national telethon, is focused on the macro level. The state operates with categories of high geopolitics, global security, and macroeconomics. 

At the same time, citizens’ needs are firmly grounded at the micro level and focused on physical and everyday survival. This contrast generates acute conflicts of perception. When officials report diplomatic battles over 40 million dollars in seized assets in Budapest, citizens in the comments do not feel pride in the state’s position. On the contrary, they demand answers to why such colossal amounts of cash and gold were abroad at all during the war, massively suspecting corrupt “schemes” by the elites.12 

The semantic gap is actively and very successfully exploited by Russian IPSO. The difference in agendas serves as ideal ground for constructing the image of “overfed elites completely detached from the needs of ordinary people.” As studies 4 show, this leads to the construction of the state as a potential enemy of the citizen and to a rapid rise in populist sentiments based on the opposition between “elite” and “people.”4

Clickbait, alarmism, and the moral-psychological state

The Telegram information space operates according to the laws of a harsh “attention economy,” where the speed of content consumption is maximal and competition for the reader’s gaze is unprecedented. To survive and monetize traffic, administrators of anonymous networks and even some official media resort to aggressive clickbait and selective presentation of only “hot” news.9

An analysis of the headline structure of top Telegram channels shows the systematic use of classic alarmist patterns. News is formulated exclusively through the prism of “inevitable catastrophe” or “total betrayal.” For example, the most difficult situation with energy resources in Europe is presented under the unequivocal headline “Britain has gas for only two days.”20 The difficult situation at the front is described through paradoxical constructions that intensify anxiety: the retreat from Huliaipole is presented as “the city is almost occupied, but this is part of the plan,” which instantly triggers cognitive dissonance and undermines faith in the competence of the military command.20

Selective content delivery leads to the fact that any positive, stabilizing, or neutral news is systematically pessimised by the algorithms of human attention (and by the channel editors themselves), уступаючи place to blood, destruction, corruption scandals, and political intrigue. 

Impact on the psyche

The prolonged, months-long exposure to such a toxic information cocktail has a destructive effect on the moral and psychological state of Ukrainian society. Data from content analysis and monitoring of violent rhetoric 4 reveal several critically dangerous trends:

  1. Total political cynicism and distrust. Under constant informational pressure, citizens develop a defensive mechanism in the form of absolute distrust toward any public information. Statements by world leaders, such as Donald Trump’s about the imminent end of the war, are met not with hope but with open mockery and insults (“the red-haired senile man,” “finishing his ninth war”).11 Any news, even the most positive, is viewed exclusively through the prism of searching for hidden benefits for the elites (“Who benefits from this?”).
  2. Normalization and stigmatization of violence. The constant presence in the news feed of uncensored footage of destruction, the mutilated bodies of the enemy, as well as videos of harsh detentions in the streets by TCC personnel, erodes the natural empathic barriers of the human psyche. Researchers note the normalization of acts of violence in public space.4 Aggression accumulated in the digital vacuum inevitably spills into the streets. The aforementioned attacks by groups of civilians on TCC vehicles (in Volyn) or the stabbing incident in Dnipro 15 are often not condemned in the comments of anonymous channels as criminal offenses, but are marginalized or even romanticized as acts of “the common people’s struggle for justice against arbitrariness.”8
  3. Deep social atomization. Instead of uniting in the face of an external threat, clickbait news coverage fragments society into irreconcilable, hostile factions. The information field artificially pits people against one another: “frontline soldiers” oppose “draft dodgers,” “those who left” hate “those who stayed,” and supporters of harsh and uncompromising mobilization clash with defenders of civil rights.8 This fragmentation makes constructive social dialogue impossible, weakening the state’s internal resilience.

Reputational dynamics of leaders

Anonymous Telegram channels serve as the most powerful, unaccountable instrument for shaping and destroying the reputational profiles of key political and military figures. An analysis of mentions of President Volodymyr Zelensky, Kyrylo Budanov, and Mykhailo Fedorov demonstrates how easily the digital space can construct heroes or destroy trust ratings regardless of real institutional achievements.

Volodymyr Zelensky

In the official state chronicle, the President of Ukraine appears as an indefatigable diplomat, leader of resistance, and Supreme Commander-in-Chief: he initiates international coalitions, signs laws on mobilization deferments for young people, personally visits forward positions in Donetsk Oblast, and demands that the West strengthen security with regard to energy security.2

However, the system of anonymous channels and comment sections under the news methodically, step by step, destroys this image. In a space that is not moderated, Volodymyr Zelensky has become the main target for both Russian IPSO specialists and domestic political opposition networks.9 His activity in Telegram is described primarily through the prism of biting sarcasm, accusations of incompetence, and the corruption of his entourage. 

Moreover, IPSO actively promotes a destructive narrative that shifts responsibility for the start of the full-scale war from the aggressor to the Ukrainian leader. Comments constantly recycle the thesis that “Russia supposedly wanted peace, but Zelensky deceived (cheated) Putin.”10 Any failures on the international stage, delays in Western aid, or unpopular but necessary harsh mobilization measures are personally associated with him. Constant derogatory references to his former profession (“95th Quarter”) are used to systematically devalue his current status.10 As a result, the synergy of IPSO and opposition bots significantly erodes the president’s personal trust rating among organic users, effectively converting the population’s natural fatigue from war into direct, acute political antipathy.

Kyrylo Budanov

The information field has introduced the narrative that Budanov, breaking with classical global practices of cautious diplomacy, “turned the return of prisoners into his personal humanitarian mission during the active phase of the war.”7 Successful large-scale exchanges are presented as his personal outstanding achievement.20

Organic users react to these specific news items with gratitude and positivity, sometimes calling him a “superhuman.”25 However, large anonymous channels specializing in insider information (similar to “Legitimate” or “Resident,” whose narratives constantly circulate in the information space) try to neutralize this positivity by harshly weaving Budanov’s figure into the dirty backstage intrigues of power. Bot networks attempt to compare him with other officials (in particular, with the head of the Presidential Office, Andrii Yermak), claiming that after hypothetical promotions he “became worse,” or bluntly suggesting that all his public activity is nothing more than cynical “PR on blood” amid a brutal bureaucratic struggle for control.25 Nevertheless, precisely because of his firm association with such a sacred and emotionally unassailable topic as saving the lives of Ukrainian soldiers from captivity, Budanov’s reputation in Telegram retains a significant reserve of resilience and suffers much less from information attacks than the reputation of the country’s purely political leadership.

Mykhailo Fedorov

 Mykhailo Fedorov is traditionally associated with progress, the digitalization of public services, drone production, and technological breakthroughs. The official agenda regularly and proudly highlights Ukraine’s phenomenal successes in the development of unmanned systems (for example, the scaling up of production of “Wild Hornets” drones or the unique P1-Sun interception systems, footage of which even leading global media outlets such as Fox News mistakenly regard as secret developments of the American defense industry).22

However, the ecosystem of anonymous Telegram channels cynically exploits the historical distrust deeply rooted in Ukrainian society toward any state procurement in order to deliver targeted blows to Fedorov’s reputation. Any new initiatives of the ministry—whether the introduction of advanced CRM systems for managing army logistics or the allocation of state grants for private IT development—are immediately, without evidence, called into question.

In comments and insider leaks, Fedorov’s innovations are often and methodically labeled with toxic words such as “schemes,” “budget embezzlement,” or “empty techno-PR.”7 Bot farms actively and systematically promote the idea that behind the beautiful facade of total digitalization lies large-scale corruption, and that there is supposedly no tangible real effect from these multimillion-dollar projects on the front line. Thus, even objectively successful and internationally recognized Fedorov cases are “toxicized” by anonymous channels. These platforms skillfully exploit the subconscious popular conviction that any senior official in Ukraine is, by default, profiting from the war, thereby nullifying political capital.

The multidimensional impact of Telegram

The impact of the Telegram messenger on Ukrainian society under wartime conditions is uniquely dual and paradoxical. The platform has become both a lifeline and a Trojan horse for national security.

On the one hand, Telegram performs a critically important existential function of promptly informing the population. Under conditions of regular massive missile attacks, kamikaze drone raids, and sudden power outages, it is precisely anonymous and monitoring channels (the so-called “threat radars,” for example the channel “Mykolaiv Vanyok”) that literally save thousands of lives. They provide citizens with highly accurate real-time information about the vectors of movement of enemy drones and ballistic missiles, often significantly ahead of the sluggish official state alert systems.12 In this dimension, Telegram is an indispensable civil defense tool.

On the other hand, the same platform has turned into a completely uncontrolled digital proving ground, a vast arena of information warfare where the basic fabric of Ukrainian social solidarity is being destroyed every day. 

The complete absence of institutional moderation and anonymity allows Russian IPSO to scale any local internal crisis to national proportions. Coercive actions by TCC personnel in the regions, power supply disruptions, corruption investigations, or international diplomatic scandals (as in the outrageous case of the seizure of cash-in-transit employees in Hungary) are immediately converted by hostile networks into global narratives about how “the state continues to profit from elites who enrich themselves on blood.”4

It is obvious that Ukraine’s media landscape in 2026 has been irreversibly transformed. Although quality media outlets are trying to introduce paid subscription models in which reliability is the main value, the lion’s share of the population remains hostage to free anonymous aggregators.3 The activity of Ukrainian political bot farms, which futilely try to drown out these hostile narratives with aggressive patriotic sloganeering or attacks on critics of the authorities, only worsens an already difficult situation. Instead of calming society, they generate total distrust toward any information coming from the digital space.8

The average Ukrainian citizen, who daily consumes toxic clickbait about the “inevitable use of nuclear weapons,” “economic collapse due to oil prices,” “an imminent betrayal by the United States,” and “the lawlessness of military enlistment officers,” inevitably falls into a state of learned helplessness, severe psychological strain.9

As a result, we observe an extremely dangerous sociological phenomenon: while state leaders try to conduct complex multi-vector foreign policy, fight for sanctions, and appeal to European values of solidarity, a significant part of the population, under the continuous pressure of information manipulation in Telegram, is increasingly. 

Society is closing itself within a narrow contour of personal physical survival, distrust of institutions, and mutual social aggression. 

Resolving this growing informational dissonance and restoring trust-based communication between the state and society in the digital environment is a task no less critical to the survival of the nation than holding the physical front line. Without victory in the minds of citizens, victory on the battlefield may prove unattainable.

Ihor Akimov, social engineer, Director of the Institute for Social Dynamics and Security KRONOS

The investigation actively used OSINT tools and artificial intelligence, in particular the Gemini and Grok models. OSINT methods made it possible to collect and analyze open data from various sources, including social networks, public databases, and web resources. Gemini provided in-depth analysis of textual data, pattern detection, and forecasting, while Grok, created by xAI, was used to process complex queries and generate precise conclusions based on large volumes of information. The combination of these technologies significantly accelerated the investigation process, improved the accuracy of the results obtained, and revealed connections that might have remained unnoticed by traditional methods.

Sources
  1. Republicans in trouble? The Trump administration is panicking over rising oil prices, – CNN,  https://www.rbc.ua/rus/news/respublikantsy-prolete-administratsiya-trampa-1773113050.html
  2. The US is considering easing sanctions against Russian oil in order to stabilize global commodity prices, – Reuters,  https://espreso.tv/ekonomika-ssha-rozglyadayut-poslablennya-sanktsiy-proti-nafti-rf-abi-stabilizuvati-svitovi-tsini-na-sirovinu-reuters
  3. How the war changed Ukraine’s media: standards, the telethon, and Telegram in 2026 – Institute of Mass Information,  https://imi.org.ua/monitorings/strategiya-stijkosti-yak-rozvyvalys-ukrayinski-media-v-chasy-povnomasshtabnoyi-vijny
  4. Violent rhetoric in Ukrainian Telegram channels: report,  https://oporaua.org/viyna/nasil-nic-ka-ritorika-v-ukrayins-kih-telegram-kanalah-zvit-25941
  5. The most popular Telegram channels in Ukraine systematically spread violent narratives, — Opora study – MediaSapiens.,  https://ms.detector.media/internet/post/38972/2026-02-18-naypopulyarnishi-telegram-kanaly-v-ukraini-systemno-poshyryuyut-nasylnytski-naratyvy-doslidzhennya-opory/
  6. RAW_DATA_UA52_2_2026-03-08_06-28.docx
  7. RAW_DATA_UA50_1_2026-03-08_06-28.docx
  8. UNVERIFIED_DATA_UA50_1_2026-03-09_04-35.docx
  9. RAW_DATA_UA52_2_2026-03-07_08-26.docx
  10. UNVERIFIED_DATA_UA50_1_2026-03-10_06-02.docx
  11. UNVERIFIED_DATA_UA52_2_2026-03-10_06-02.docx
  12. UNVERIFIED_DATA_UA50_1_2026-03-06_06-43.docx
  13. Hungary plans to hold the cash and gold seized from Oschadbank for two months – the bill may be considered on March 10,  https://mind.ua/news/20302044-ugorshchina-planue-utrimuvati-vilucheni-v-oshchabanku-groshi-ta-zoloto-dva-misyaci-zakonoproekt-mozhut-rozg
  14. Foreign Ministry: Oschadbank cash-in-transit employees detained in Hungary were held in handcuffs for 28 hours. One of them became ill and lost consciousness – Babel,  https://babel.ua/news/125434-mzs-inkasatoriv-oshchadbanku-zatrimanih-v-ugorshchini-28-godin-trimali-v-kaydankah-odnomu-z-nih-stalo-pogano-i-vin-vtrativ-svidomist
  15. In Volyn, seven civilian vehicles pursued a TCC service vehicle and forcibly took away a conscripted man – LB.ua,  https://lb.ua/society/2026/03/09/726393_volini_sim_tsivilnih_avtomobiliv.html
  16. Blocked the road and broke the car window: in Volyn, a TCC and SP notification group was attacked | ArmyInform,  https://armyinform.com.ua/2026/03/09/zablokuvaly-ruh-i-rozbyly-sklo-avtivky-na-volyni-napaly-na-grupu-opovishhennya-tczk-ta-sp/
  17. Civilians in seven cars blocked a TCC vehicle in Volyn and took away a conscripted man,  https://www.slovoidilo.ua/2026/03/08/novyna/bezpeka/cyvilni-semy-avto-zablokuvaly-mashynu-tczk-volyni-ta-zabraly-vijskovozobovyazanoho
  18. In Volyn, civilians attacked a TCC vehicle and forcibly took away a conscripted man,  https://www.pravda.com.ua/news/2026/03/08/8024507/
  19. In Volyn, civilians attacked a TCC vehicle and freed a conscripted man,  https://zahid.espreso.tv/novyny-volyni-na-volini-grupa-tsivilnikh-peresliduvala-avto-ttsk-pobila-viyskovikh-i-zvilnila-viyskovozobovyazanogo
  20. UNVERIFIED_DATA_UA52_2_2026-03-09_04-35.docx
  21. Orbán’s party submitted a bill on the detention in Hungary of the cash and gold seized from Oschadbank – Ukrinform,  https://www.ukrinform.ua/rubric-world/4099739-partia-orbana-podala-zakonoproekt-pro-zatrimanna-vilucenoi-gotivki-ta-zolota-osadbanku.html
  22. UNVERIFIED_DATA_UA52_2_2026-03-06_06-43.docx
  23. Hard interview with KYRYLO BUDANOV! EXCLUSIVE! Head of the OP speaks candidly about negotiations with Russia, the US, and China,  https://www.youtube.com/watch?v=yS9bhPOrt14
  24. Budanov turned the return of prisoners into his personal humanitarian mission, – blogger — Politics – TSN,  https://tsn.ua/politika/budanov-peretvoryv-povernennia-polonenykh-na-svoiu-osobystu-humanitarnu-misiiu-bloher-3035942.html
  25. RAW_DATA_UA50_1_2026-03-07_08-26.docx