From Putin’s office to your timeline: hack exposes new Russian troll army

“Ukrainian refugees tried to burn a Russian flag but accidentally burnt a house of Germans who gave them shelter.” This provocative headline, accompanied by a video bearing the watermark of German publication Bild, is actually Russian propaganda. The incident never occurred, and Bild never reported it.

This fabrication was created by the Social Design Agency (SDA), a Kremlin-linked propaganda organization overseen by Sergei Kiriyenko, First Deputy Chief of Staff of Russia’s Presidential Administration. Unlike typical bot farms, SDA has direct ties to the highest levels of the Russian government and is sanctioned by the EU and the US.

SDA produces vast amounts of content targeting Western audiences, especially in Germany, Italy, and France. Their goal is to sow fear, divide populations, discredit Ukraine, and end the war on Russia’s terms. SDA also operates within Ukraine, attempting to undermine Ukrainians’ faith in their institutions.

The organization’s reach extends to high-profile figures, with one SDA-created meme even being shared by Elon Musk. SDA also claims to have influenced 2024 European Parliament elections by boosting far-right parties’ popularity.

The extent of SDA’s operations was revealed when hackers obtained 2.4 gigabytes of internal data between 2022 and 2024. This information was analyzed by major German media Süddeutsche Zeitung, NDR, Taz, Estonian online media Delfi, and the Ukrainian project Schemy of RFE/RL. The data includes employee and order lists, social media accounts, meetings, emails, prepared online postings, and shared pictures.

Euromaidan Press has summarized these findings, providing insight into the scale and sophistication of Russia’s propaganda machine.

Who is behind SDA?

Over a four-month period in 2024, the SDA reportedly produced nearly 40,000 units of content, including posts (31,059), videos and video memes (4,641), articles (1,455), memes (2,516), and 34 million comments across various platforms.

A table from one leaked file shows numerous titles of the propagandist videos the agency produced or plans to produce, their status, target country, and a link. 

Here are some of them:

• “A video: Ukrainian teenagers rape 12-year-old Marta Mengel in Rostock [a city in Germany]”
• “A video: a Ukrainian refugee in Naples, Italy, decided to rob a store on his first day of work”
• “A video: Ukrainian refugees force a bar visitor to dance the hopak [a traditional Ukrainian dance]”
• “A video: Ukrainian refugees beat up gays”
• “A video: a drunk Ukrainian refugee ignited a fight in Romania”

This fabricated content can reach thousands of people in different countries and sometimes even reach influential individuals like Elon Musk, the American billionaire. In his X account, Musk shared a meme that mocks Ukrainian President Volodymyr Zelenskyy, and as leaked files prove, was created by SDA, specifically by Sofia (probably Zakharova), whose name appears in the files multiple times. 

According to US intelligence, Zakharova is an employee in Putin’s administration’s technology and communication department and allegedly plans disinformation campaigns for SDA. 

US intelligence also believes that she was involved in a Doppelgänger disinformation campaign, also orchestrated by SDA. They created around 60 replica websites of respected news outlets like French Le Monde and German Der Spiegel to publish articles discrediting Ukraine and promoting Russian propaganda. 

The connection to SDA became clear not only from reviewing leaked files but also from a short video presentation by the agency head, Ilya Gambashidze. With dramatic music in the background, he removes his sunglasses, standing in his military jacket with a patch that reads “Russian ideological armed forces. The strength is in the truth,” and says that the Doppelgänger campaign was exposed by French intelligence.

Gambashidze goes on to explain how the SDA system works, probably aiming this video at their clients – the Russian Interior Ministry, the Russian Ministry of Emergency Situations, or the State Duma.

Social Design Agency (SDA) operates through a three-pronged approach:

1. Monitoring. A team of 24 staff members monitors and analyzes content from over 1000 opinion leaders in six languages daily 
2. Analytics. This department studies target audiences and develops strategic messaging, so-called “talking points”
3. Creative. This team produces tailored content, including articles mimicking local journalistic styles, caricatures, memes, comments, videos, and graffiti campaigns.

SDA creates at least 180 memes monthly for audiences in Germany and France, 60 caricatures, 400 discussion-initiating comments, and an additional 120,000 automated comments monthly.

The agency mocks the German Green Party and the current coalition government with satirical cartoons depicting environmental policies negatively and images promoting the far-right AfD party. Some content also references a German politician Sahra Wagenknecht, suggesting her as an alternative to current leadership because she opposes military help to Ukraine and aligns with Russian narratives a lot.

In one Russian cartoon, a skull lies in front of two toppling wind turbines, underneath, it says “Green Future”. In another, the arrow of the AfD logo punctures a green balloon. Or an arm waves a German flag, and on the sleeve, it says “Sahra” – obviously an allusion to Sahra Wagenknecht.

SDA claims credit for far-right gains in 2024 EU elections

During the June 2024 EU parliamentary elections, SDA targeted what it called “liberal globalists” and supported right-wing parties like Alternative for Germany (AfD) and France’s National Front. 

In the leaked files, Russian propaganda describes EU Commission President Ursula von der Leyen as the “epitome of corrupt and pro-American politics.” In contrast, right-wing parties are portrayed as “voices of reason” capable of bringing “peace and prosperity” and able to “clean up these stables.”

This campaign, which focused on Germany, France, Spain, Italy, and Poland, aimed to discredit incumbent politicians through four main tactics:

1. Accusing the politicians of fear-mongering about a potential Russian attack on the EU
2. Criticizing support for gender equality and LGBT+ rights
3. Undermining economic policies by highlighting inflation and unemployment
4. Portraying EU leaders as totalitarian and militaristic, “as in Ukraine.”

In Germany, the SDA reportedly sought to convince over half the population not to “sacrifice their well-being for the sake of victory over Russia.” They also spread claims about German weapons being used for “war crimes” in Ukraine or ending up on the black market. Another goal is to increase the “fear of the future” indicator above 50 percent in surveys.

The SDA’s efforts extend to creating 17 specific narratives tailored for Germany alone, targeting different population segments, such as industrial workers, conservative voters, and those facing economic hardship.

However, the files also acknowledge that right-wing leaders don’t always align with Russian interests. Examples cited include French politician Marine Le Pen applauding Ukrainian President Volodymyr Zelenskyy in the French National Assembly and Italian Prime Minister Giorgia Meloni’s strong support for Ukraine.

In the 2024 EU elections, while pro-Ukrainian centrist parties maintained a majority led by the European People’s Party (EPP), far-right parties, particularly in France and Germany, still made significant gains. The leaked documents show that SDA claimed the credit for this shift, describing it as a success for Russian foreign policy and propaganda.

SDA targets Ukraine with fake documents 

Russian propaganda also tries to spread its messages in Ukraine. For this, SDA analysts reportedly study Ukraine’s information landscape to identify sensitive topics that can be exploited to polarize society. 

These include mobilization, battlefield losses, restrictions on freedom of speech, and corruption allegations. 

To discredit the country’s leadership, the leaked documents expose that Russians planned to establish an online platform focused on denouncing corruption in Ukraine, with President Zelenskyy as the primary target. This platform would later be taken offline to create the impression of government “suppression of critics.”

Another SDA tactic involves creating fake government documents. A notable example is a fabricated order from the Ukrainian Ministry of Defense instructing officials not to confirm the presence of Ukrainian prisoners of war (POWs) on the Russian Il-76 aircraft that crashed in Belgorod Oblast in January 2024. This false narrative was designed to accuse Ukrainian military leadership of “censorship” and “concealing information” about the incident. 

Russian authorities asserted that the plane carried 65 Ukrainian POWs and alleged that Ukrainian forces had shot it down, while the Ukrainian General Staff stated that the aircraft was transporting S-300 missiles used to attack Ukraine.

Later, the journalists from Radio Liberty confirmed the identities of the six Russian crew members killed in the Il-76 crash, however, it remains uncertain if Ukrainian POWs were actually on the board. 

SDA also produced a counterfeit order allegedly from Ukrainian Commander-in-Chief Oleksandr Syrskyi, equating surrender by Ukrainian servicemen to treason, with the purpose to discredit Ukraine’s military-political leadership and demoralize its armed forces.

The leaked files also include detailed records of the SDA’s social media activities, with reports of bot-generated comments posted under content from Ukrainian state institutions, law enforcement agencies, politicians, and media outlets.

SDA backs Putin ally Medvedchuk as face of pro-Russian movement in Ukraine

One of SDA’s projects also involves supporting the “Another Ukraine” movement led by pro-Kremlin former Ukrainian politician Viktor Medvedchuk, who was exchanged for Ukrainian POWs and sent to Russia in 2023 because he is a personal friend of Russian President Vladimir Putin.

The leaked documents outline plans to position Medvedchuk as a “consistent fighter for a peaceful future of Ukraine” who advocates for dialogue with Russia and opposes Ukraine being used as a “testing ground for Western weapons.”

However, internal analyses note that Medvedchuk’s messaging has received predominantly negative responses on Russian social media, accusing Medvedchuk of corruption and fleeing Ukraine. Despite setbacks, the documents indicate that the SDA continued promoting Another Ukraine through various online channels.

Related:

• Ukrainian MPs urge Canada to block screening of Russian propaganda film at Toronto festival
• Trump echoes Russian propaganda, blaming Biden for Russia’s invasion of Ukraine
• EU imposes sanctions on Russian propaganda arm Voice of Europe, and figures behind it – Medvedchuk and Marchevskyi
• “Biolabs” and “persecution of Christians”: GOP Congresswoman spreads Russian propaganda to oppose Ukraine aid bill
• Report: Western media underestimate Russian propaganda’s effectiveness
• EU accuses Musk-owned Twitter of amplifying Russian propaganda