A Lesson from Russia’s Information Manipulation Textbook: Setting the Scene for a Large-Scale Missile Attack

One thing that Russia’s unprovoked war against Ukraine has highlighted is how Russia uses information manipulation as an integral part of its war machine. Such manipulation provided a pretext for Russia’s full-scale invasion and later built support for military manoeuvres on the ground. Russia’s attack on the Bryansk region in March 2023 provides a good case study for exposing how the Kremlin marries information manipulation with kinetic tactics to achieve maximum impact.

Source — EUvsDiSiNFO — May 03, 2023 —


On 9 March, Russia carried out a major missile strike in 10 Ukrainian regions, killing at least nine civilians and causing power outages. It was the biggest wave of attacks since mid-February. Russia presented the operation as a response to what it called a ‘terrorist’ cross-border attack by Ukrainian forces against the Russian villages of Lyubechane and Sushany on 2 March. Ukraine dismissed the accusation.

A Lesson from Russia’s Information Manipulation Textbook: Setting the Scene for a Large-Scale Missile Attack — EUvsDiSiNFO

What followed Ukraine’s supposed 2 March attack was an attempt by pro-Kremlin voices to lay the groundwork in the information environment for its own attack on 9 March. First, a pair of opposing characters was created – a small hero for people to hail and a big villain for people to blame. Second, outlets amplified messages around these two characters using coordinated online activity to legitimise Russia’s new wave of attacks against Ukraine.

Constructing the opposing characters

First, following Russian media reports of Ukraine’s purported 2 March attack, the pro-Kremlin disinformation ecosystem quickly raised a little boy allegedly injured in the incident to the status of a hero for supposedly saving the lives of two girls of the same age. Outlets reported that authorities were to award him with a medal of courage, many videos praised him, leaflets paying tribute to him appeared on walls, students in his class sent him messages of support, and so on. Pro-Kremlin media insisted that his two older brothers are currently fighting in Ukraine on Russia’s side.

Second, on 3 March, the Russian Ministry of Foreign Affairs claimed that NATO weapons were used in Ukraine’s alleged 2 March attack. This narrative tried to frame NATO allies as ‘accomplices and sponsors of terrorism’. Additionally, a pro-Kremlin Telegram channel asserted that ‘NATO-style’ mines planted on the roads blew up a car of the National Guard. Four Russian soldiers were supposedly injured.

Chronology of two complementary narratives

2 March
  • 9:29: a message by the governor of Bryansk is posted on Telegram. It says, ‘Today, a DRG [sabotage and reconnaissance group] from Ukraine entered the territory of the Klimovsky district in the village of Lyubechane. Saboteurs fired at a moving car. As a result of the shelling, one resident was killed and a ten-year-old child was injured. Currently, the child has been taken to the hospital, he is receiving all necessary assistance’.
  • 11:30: Russian Volunteer Corps supposedly claim responsibility for the attack.
  • 13:00: Putin declares the attack an act of terrorism.
  • 13:30: the injured boy is hailed as a hero.
  • 17:00: the governor pays a visit to the injured boy at a hospital and claims that the weapon that was used in the attack was of NATO origin and the bullet US-made.
3 March
  • 9:30: according to a Telegram post, a de-mining operation is carried out because the saboteurs supposedly left behind NATO-type explosives.
  • 14:00: first sighting of the trend of paying homage to the injured boy with oranges being promoted online.
7 March:
  • The governor of Bryansk presents the injured boy with a medal of courage.
9 March:
  • The Russian Ministry of Defence states that the wave of missile attacks was a response to the militants’ attack on the Bryansk region on 2 March.

Amplifying the disinformation narrative

The narrative amplification strategy combined official speeches, local media, and proxy social media accounts. Initially, statements by Putin, the Ministry of Defence, and the governor of Bryansk greatly increased the visibility of the topic and served as a primer for the rest of the pro-Kremlin disinformation ecosystem. Accounts on several major platforms (e.g., Twitter, Facebook, VKontakte) further disseminated the two narratives, both of the heroic boy and of the villainous NATO.

Almost immediately after these public statements, many well-known accounts shared these narratives on pro-Russian Telegram channels. The aim was to flood the information environment, an often-used tactic by pro-Kremlin voices. Conversely, most neutral, independent, or anti-Kremlin voices that noted the story’s inconsistencies and propagandistic tone were quickly silenced.

Several days after the event, pro-Kremlin voices were still trying to keep the topic alive on Vkontakte. They even shared screenshots of tweets that questioned the story with the false allegation, ‘This Tweet has been deleted’. In doing so, they tried to discredit contradictory speech.


Screenshot of a 2 March post by a Telegram user going by the name IntelSlava

Inconsistencies in the hero-villain narrative

Before constructing a hero, pro-Kremlin disinformation specialists played the victim card. An initial narrative alleged that a young girl had been admitted to hospital and later died as a result of the attacks. Only later did a narrative around a supposed hero begin to emerge. According to the story, a 10-year-old boy, suffering from a gunshot injury, saved two girls of the same age. The boy recovered suspiciously quickly. The attack in which he was supposedly injured took place on 2 March and he was already fit enough to receive a medal on 7 March. The young girl who was initially declared dead was miraculously resurrected, although she soon disappeared again from public messaging.

The villain narrative was also visibly inconsistent. First, after supposedly killing several children, taking hostages (an accusation later dropped by pro-Kremlin proxies), and destroying property, the Ukrainians supposedly left the scene hastily without firing a shot. Second, the number of participants in the attack ranged from 15 to 70, according to different posts. The number of hostages fluctuated even more, ranging from 6 to 100. It’s important to note that the village where the event took place has no more than 180 inhabitants. No photos or videos of the attackers have been published. In fact, the only evidence that allegedly puts Ukrainians at the site of the attack is a single video featuring two people in military uniform holding a flag of the Russian Volunteer Corps.

The case above is by no means an outlier. For years, EUvsDisinfo and other experts in the field have demonstrated that the Kremlin uses information as a tool and a weapon. As the international community becomes more aware of Russia’s information manipulation efforts, the Kremlin has been forced to innovate. The behaviour-first approach to understanding, monitoring, and identifying information manipulation helps to catch all kinds of manipulative behaviour, rather than just disinformation in the narrow sense of the word.

See all News and Analysis