Ukraine’s biggest Telegram channels ran coordinated attacks on anti-corruption agencies, researchers find

A volunteer group known as People with Cardboard Signs says major Ukrainian Telegram news channels carried a long, organized effort aimed at discrediting the country’s anti-corruption bodies, the National Anti-Corruption Bureau of Ukraine (NABU) and the Specialized Anti-Corruption Prosecutor's Office (SAPO). 

Telegram is one of Ukraine’s main information channels, offering fast updates from officials, reporters, and local communities. But its open format also lets anonymous actors push misleading claims at scale, turning the platform into a crucial - and highly contested - battleground for wartime narratives.

“People with Cardboard Signs” emerged from the core activists who took part in the July 2025 protests across Ukraine defending the independence of NABU and SAPO. After the protests, the group kept working on issues linked to anti-corruption oversight. It now focuses on supporting the integrity of key watchdog bodies and pushing for justice-sector reforms.

Findings emerged as Energoatom corruption bust triggered fresh attacks

The group’s new report reviews more than nine months of posts and traces repeated waves of similar narratives targeting NABU and SAPO.

Their findings came in mid-November, as Ukraine’s anti-corruption institutions carried out operation “Midas,” which uncovered an alleged corruption scheme in Energoatom. 

Researchers say the breakthrough drew a surge of fresh attacks online, echoing patterns tracked throughout the year.

Suspicious clusters of posts prompted full-scale review

The group reviewed the 15 biggest Ukrainian Telegram news channels and logged every mention of NABU from February to November, 2025. They sorted tone, topic, deletion dates and how posts spread across channels.

Researchers say the project began after early incidents suggested coordinated activity. These included sudden clusters of posts accusing NABU of supposed “links to Russia,” claims about “upcoming tapes,” and messages alleging that NABU’s new PR manager had paid for negative coverage. Screenshots and examples from those waves led activists to launch a full review of the network.

Their dataset includes 1,865 posts, 56% of which were negative. After filtering out basic pushback from suspects, researchers focused on 886 posts that fit narrative-driven criticism.

Same narratives, same timing: researchers identify coordinated pattern

The report identifies 78 “waves” of posts appearing within hours across multiple channels, often with similar wording.

The most common storyline linked NABU to supposed Russian influence, generating more than 79 million views across 268 posts.

Other themes accused NABU and SAPO of corruption, bias, or weak performance. Some posts also targeted activists and journalists who support anti-corruption reforms, using personal insults and claims of hidden agendas.

Narratives revived whenever there was real news, from searches and detentions to staffing disputes. Another recurring theme pushed for weakening or closing NABU and limiting foreign involvement in oversight roles.

Political figures and paid "experts"

Researchers say some political figures appeared to benefit from these campaigns. They point to more than 30 posts echoing talking points tied to former Ukrainian Prime Minister Yulia Tymoshenko, mostly focused on criticism of international partners in the anti-corruption sector.

The report also highlights repeated appearances by a small group of “experts,” many listed in Texty.org.ua databases as individuals involved in paid political messaging. They include bloggers, consultants and self-described analysts who have a track record of promoting targeted narratives.

Texty.org.ua is an independent Ukrainian newsroom known for data-driven investigations and mapping influence networks.

Who amplified the messages?

Eight of the ten largest channels (excluding personal blogs) took part in spreading these messages. INSIDER UA posted the highest number of mentions, while Times of Ukraine and Vsevidyashchee OKO had the highest share of negative posts.

The group also flagged Trukha Ukraine, which deleted 21 negative posts about NABU during the research period. Fifteen were removed on the same day in August, which the authors describe as a sign of internal changes or efforts to hide earlier activity.

These kinds of channels are popular because they offer constant updates, short posts, and quick summaries of breaking events. Many present themselves as neutral news feeds even though their admins are anonymous. Their audiences follow them for speed rather than transparency, which makes coordinated messaging harder to spot for the average reader.

Researchers say the patterns reveal a long-running effort rather than random reactions. They argue the waves intensified around major political moments and key actions by NABU and SAPO, showing a consistent attempt to erode public trust.

Telegram’s role in Ukraine and disinformation patterns

Telegram is one of Ukraine’s most widely used platforms for news, emergency alerts and wartime updates. Its simple setup allows channels to grow quickly, while anonymity makes it hard to trace ownership, funding or editorial control.

These features have made the app an important source of fast information, but also a common venue for influence operations. Researchers and digital rights groups have documented repeated campaigns using coordinated posts, identical phrasing and staged “expert opinions.”

Common patterns include waves of messages across unrelated channels, recycling of older narratives, and the use of anonymous admins who rarely disclose their methods or backers. 

During the full-scale invasion, these tactics have been used to push political pressure, shape public reactions, or shift attention away from corruption cases and military setbacks.

Monitoring groups say Telegram’s structure encourages the rapid spread of unverified claims. This makes it valuable for public communication in emergencies but also a prime space for organized disinformation efforts that are difficult to track or counter.