Behind the Dutch Terror Threat Video: The St. Petersburg "Troll Factory" Connection

At 13:30:09 GMT on 18 January 2016, a new YouTube channel called ПАТРИОТ (“Patriot”) uploaded its first video, titled (in Ukrainian) “Appeal of AZOV fighters to the Netherlands on a referendum about EU – Ukraine.” The video depicts six soldiers holding guns, supposedly from the notorious far-right, ultra-nationalist Azov Battalion, speaking in Ukrainian before burning a Dutch flag. In the video, the supposed Azov fighters threaten to conduct terrorist attacks in the Netherlands if the April 6 referendum is rejected. There are numerous examples of genuine Azov Battalion soldiers saying or doing reprehensible things, such as making severely anti-Semitic comments and having Nazi tattoos. However, most of these verified examples come from individual fighters, while the video with the Dutch flag being burned and terror threats supposedly comes as an official statement of the battalion.

The video has been proven as a fake, and is just one of many fake videos surrounding the Azov Battalion. This post will not judge if the video is fake — as this will be assumed — but will instead examine the way in which the video originated and was spread. After open source analysis, it becomes clear that this video was initially spread and likely created by the same network of accounts and news sites that are operated by the infamous “St. Petersburg Troll Factories” of the Internet Research Agency and its sister organization, the Federal News Agency (FAN).  The same tactics can be seen in a recent report from Andrey Soshnikov of the BBC, in which he revealed that a fake video showing what was supposedly a U.S. soldier shooting a Quran was created and spread by this “troll factory.”

The Video’s Origin

The description to this video claims that the original was taken from the Azov Battalion’s official YouTube channel, “AZOV media,” with a link to a YouTube video with the ID of MuSJMQKcX8A. Predictably, following the link to the “original” video shows that the video has been deleted by the user, giving the impression that the Azov Battalion uploaded the video and then deleted it by the time the copy (on the “Patriot” channel) was created. There are no traces of any video posted with this URL in any search engine cache or archival site (e.g. Archive.today or Archive.org).  It is most likely that a random video was posted to a YouTube channel, quickly deleted before it could be cached or archived, and then was linked to in the video from the “Patriot” YouTube account.

While the circumstances around the video’s original source is important in its own right, the manner in which the video was spread shortly after its upload yields interesting results.

The Initial Propagation

At 14:16 GMT on 18 January 2016 – 46 minutes after the video upload on the “Patriot” channel – a newly registered user named “Artur 32409” posted a link to the video and a message in Ukrainian supporting Azov’s alleged actions on the website politforums.net. [ref]This post has since been deleted. Although it was cached by Google, the cache has since expired. The message read:

“This is the video that should have been filmed six months ago when it became known that the Dutch refused to ratify the association agreement with Ukraine and the EU. The whole of Europe considers us worthy allies, except the Netherlands. A country the size of the Kiev region said that we do not belong in the Union. Our territory is the geographical center of Europe, we are clear candidates for EU membership. The Dutch will not stand in the way of Ukrainian dreams. Thank you guys that they interfered with this arrogance and hinted that Ukraine will behave as is required. Ukraine above all, together we can overcome all difficulties.”[/ref]

Starting four minutes later (14:20 GMT), two newly-registered accounts on the Russian social networking site VKontakte (VK) shared the video 30 times over a period of 24 minutes.[ref]The initial posts were made by accounts with the names “Taras Poleschuk” and “Yevgen Kolesnik,” both obviously Ukrainian-sounding names. Virtually all of the groups used to post links to the video were popular pro-Ukrainian boards, many of these are largely Ukrainian-speaking groups. The same method appears to have also been used for sharing other fake videos. For example, messages were posted to groups like  “Типова Україна”, or “Typical Ukraine,” shortly after each of the videos were uploaded. The first, second and third fake video were all posted twice in the group by just-registered accounts, all of which were only used to post the videos. An even better example is a group where all three of the fake videos were posted by similar accounts, each on the day of the video’s release. Looking at this methodology is useful because it shows someone wanted to create the impression of a Ukrainian origin behind the video, and that all three videos are in fact linked not only in their similarities, but also the way they were propagated.[/ref]

During these 30 shares on VK (at 14:38 GMT), an exact copy-paste of the text written by Artur 32409 from politforums.net is published by a blogger on Korrrespondent.net. The author represents him/herself as a pro-Azov Ukrainian woman named “Solomiya Yaremchuk.” This user did not cite Artur as the source for the content. There is a strong possibility, if not certainty, that “Artur 32409,” the Korrespondent.net blogger Solomiya Yaremchuk, and the various VK users are either the same person, or part of the same group propagating the fake video. Further evidence provided later in this post reveals that “Solomiya Yarumchuk” is a fake account and has strong links to the “St. Petersburg Troll Factory.”

Appearance and Propagation of a Fabricated Screenshot

The Azov Battalion video was not the only piece of fabricated evidence created with this disinformation campaign. Following the video’s spread, a screenshot was created to supposedly verify the existence of the video on the Azov Battalion’s official YouTube channel (“AZOV media”). This screenshot supposedly proves that the flag burning video truly was posted by the Azov Battalion before its deletion and upload on the “Patriot” YouTube channel. As will be described in the following section, this screenshot is a fabrication and does not indicate that the video was truly posted to the channel.

Replying to a post from the VK blogger Dzhelsomino Zhukov, a user named Gleb Klenov posted a screenshot that supposedly showed the video in the playlist of the official Azov YouTube channel. When asked how he got this screenshot, Klenov replied that it was “sent” to him in the comment thread of a group called Pozornovorossia (Shame Novorossiya), and the “source was sent by Gorchakov.” This group has since been deleted from VK.

When reverse searching the screenshot posted by Klenov, the two earliest results are in the VK groups Setecenter (19 January, 10:10am GMT) and Mirovaya Politika (19 January, 10:17am). A man named Yury Gorchakov, previously mentioned as the source of the screenshot, posted in both of these groups, defending the screenshot’s veracity. These two posts are identical, and were posted alongside the same text that blames Azov for playing out a hoax in order to blame the Russian side. Thus, the narrative has turned to provocations: Azov orchestrated this entire hoax in order to make Russia look bad, knowing that the video would quickly be exposed as a fake.

Yury Gorchakov replied twice in a thread on the “Mirovaya Politika” board, at 10:34 and 10:41am (19 January). In both posts, he was favorable towards Russia, responding to a user who said that the video was fake and spread by pro-Kremlin users. Gorchakov made two other posts at 10:34am where he explained to another poster that the flag being burned in the video was that of the Netherlands. He later (11:10 GMT) posted the full-sized screenshot himself.

It is quite likely that Gorchakov is the creator of the screenshot that supposedly shows the video being posted on the official Azov Battalion YouTube channel. He took a particular interest in defending the authenticity of the image on multiple message boards and VK groups, and posted the image in its first public appearances. Furthermore, he is an active member of the ultra-nationalist community in St. Petersburg, including heavy involvement of the “St. Petersburg Novorossiya Museum” project. Lastly, and most indicative of his likely role in the creation of the video and/or screenshot, the self-described “film director” Gorchakov was credited with uploading a fake video that supposedly showed members of Right Sector executing a civilian in spring 2014. The video has since been deleted, but links to the video’s description on the “NOD Simferopol’” YouTube channel remain, in which Gorchakov claims that he is being threatened in text messages by Right Sector for the video.

A Closer Look at the Screenshot

Upon close examination, it becomes clear that the screenshot was digitally manipulated to appear as if the last video posted on the channel “AZOV media” was the flag burning video. The white space was most likely clone-stamped over the actual last posted image, and a thumbnail of the “watched” video (with the text “Просмотрено,” or “Watched,” over the top of the video) was copied from a screenshot on the “PATRIOT” YouTube channel.

The pasting of the image was slightly imperfect: the space between the two last-watched videos is non-uniform in relation to the other squares on the screenshot, being about a pixel too wide. The thumbnail of the flag burning video is also a pixel lower than it should be in relation to the video to its right.

Moreover, the grey box with the “watched” text (Просмотрено) is slightly blurred, and the text does not match the other “Просмотрено” thumbnail in the screen, suggesting that the thumbnail was taken from another screenshot.

Troll Network Exposed

Examination of the first users to disseminate the fake Azov video, including Artur 32409, and the sites used to spread it reveal an organized system of spreading disinformation—in other words, a “troll network” made up of so-called “troll accounts.”[ref]“Troll” account here refers to accounts that are under the guidance of a user paid or supported by an organization to spread and create disinformation, most famously seen in the Internet Research Agency, until recently located at 55 Savushkina in St. Petersburg, Russia. These accounts are fairly easy to spot and can be identified by its sharing activity (around half/half in politicized anti-Ukrainian/pro-Russian content and “normal” content, such as pictures of animals, landscapes, etc), anonymized identities (most often a generic name with a photograph stolen from someone else’s profile), high tweet/low follower count, and heavy interactions with other identifiable “troll” accounts. In short: a fake identity used to spread politicized information. However, it should be noted: not all people who share politicized content and engage in disinformation campaigns are trolls, but all trolls share politicized content and engage in disinformation campaigns.[/ref]

In one of Artur 32409’s three posts on politforums.net, he described a story about someone in Kyiv who was mugged for their groceries while returning home from the supermarket. Ten minutes after its appearance on politforums.net on 31 January 2016, the text from Artur 32409 was taken for a post by “Viktoria Popova” on Korrespondent.net. The exact same thing happened—taking 22 minutes instead of 10—when the post of Artur 32409 on the fake Azov video appeared on politforums.net, and then on Korrespondent.net. Viktoria Popova even replied to the thread started by Artur 32409 with the message, “You need to go for groceries by car… Or order them from home, just as the members of parliament do.” In another post, “Viktoria” added that she struggled to afford food other than bread and claimed that pensioners’ money was being used to fund the Ukrainian military operation in the country’s east.

“Viktoria” and “Artur” are far from the only profiles in the same troll network. The user “Diana Palamarchuk” shared the story of Artur 32409 on kievforum.org.[ref]At this point (soon after the original post from Artur 32409 on politforums.net), the story was posted onto website pohnews.org—a site known to have ties to the notorious Internet Research Agency, formerly known as the “Olgino Troll Factory.” The significance of pohnews.org will be discussed shortly.[/ref] Soon after, the exact same thread was shared on online.crimea.ua, but this time the poster was not Diana Palamarchuk, but “Diana Palamar.”

The troika of Artur, Viktoria, and Diana is clearly interconnected, and not a random group of users. On 4 February 2016, “Diana Palamar” started a thread on online.crimea.ua, and just four minutes later, Viktoria Popova made an identical blog post at Korrespondent.net. Both of these posts linked to pohnews.org, the same site used to host a story from Artur 32409 that “Diana” shared.

There is a systematic approach at spreading disinformation, as we saw with the grocery mugging story written by the same user (Artur 32409) who first posted the Azov Battalion video. There are usually two types of “troll” users who work in tandem to spread disinformation: supposed Ukrainians who are disgruntled, or Ukrainians who share extreme views or content that can be picked up by pro-Russian groups as examples of Ukrainian radicalism.

A clear example of this behavior can be seen in the group “Harsh Banderite” (Суворий Бандерівець), where we find posts from “Diana Palamarchuk” and “Solomiya Yaremchuk” (the user who posted the korrespondent.net post of the Azov Battalion video immediately after it was shared by Artur 32409). The post on this supposedly pro-Ukrainian group show discontent for President Poroshenko and admiration for the far-right/ultra-nationalist group Right Sector. Many posts “playfully” hint at genocide and terrorism, such as blowing up the Kremlin or killing civilians in eastern Ukraine.

Many profiles in these groups, which are likely creation of pro-Russian groups or individuals, appear alongside one another on other sites. For example, “Solomiya Yaremchuk” appears in the comments on an article on Cassad.net, a popular pro-Kremlin blog, alongside numerous accounts with overtly Ukrainian names, such as “Zhenya Bondarenko,” “Kozak Pravdorub,” and “Fedko Khalamidnik.”

The Petersburg Connection

The creation and propagation of the fake Azov Battalion video was almost certainly not the work of a few lone pranksters, but instead a concerted effort with connections to the infamous Internet Research Agency, widely known as the organization based in St. Petersburg that pays young Russians to write pro-Russian/anti-Western messages in internet comment sections and blog posts.

The fake Azov Battalion video is clearly linked to the interconnected group of users of Artur 32409, Solomiya Yaremchuk, Diana Palamar(chuk), and Viktoria Popova. The first two of these four users were the very first people to spread the fake video online, and copied each other in their posts. The video, uploaded to a brand new YouTube channel and without any previous mentions online, would have been near impossible to find without searching for the video title. Thus, it is almost certain that Artur (and by extension, the rest of the troll network) is connected with the creation of this fake video.

The stories written by this troll network are quickly hosted on the site pohnews.org, previously known as today.pl.ua. This site has a handful of contributors who later repost their stories (almost always around 100-250 words) on other sites that allow community bloggers. For example, the user “Vlada Zorich,” who wrote a story on pohnews.org that was originally from Artur 32409, has profiles on numerous other sites and social networks. Her stories are anti-Ukrainian, and written in the same style (and roughly the same word count) as stories on whoswhos.org, a site known to be part of a network created by the Internet Research Agency and a freelance web designer/SEO expert on its payroll, Nikita Podgorny.

The link between whoswhos.org, a site paid for by the Internet Research Agency, and pohnews.org, a site used to promote stories from a group of users who first spread the fake Azov Battalion video, is not just in similarities in style and content. The social media pages for the two sites have administrators named Oleg Krasnov (pohnews.org) and Vlad Malyshev (whoswhos.org). The two people both took photographs from the same person (who is completely unrelated to this topic) to use in their profiles–or, more likely, one person created both accounts and lazily used photographs of the same person.

As these accounts almost certainly do not represent real humans, they both have few friends or followers. “Vlad Malyshev” and the other administrator of the whoswhos.org VK page, Pavel Lagutin, each only have one follower: “sys05dag,” with the name “Sys admin” on VK. This user is strongly linked to cybercrime and runs a public group on VK that is focused on hacking methods and topics related to malware. For example, “Sys admin” once wrote a post requesting twenty dedicated servers to set up a botnet.  Circling back to the fake Azov Battalion video and the falsified screenshot, “Sys admin” shares many common friends with Yury Gorchakov.

Clearly Fake Accounts

When looking at the accounts that cross-post each other’s texts and post stories onto Petersburg-linked “news” sites, it is immediately clear that they are not real people. A survey of three users who appear often in this post shows common tactics used within the same network:

• “Vlada Zorich” posts stories on pohnews.org and various Ukrainian blog sites, and does not go to great lengths to hide that “she” is not a real person. On her VK, Facebook, commenter, and blogger profiles, she uses photos of actresses Megan Fox and Nina Dobrev to represent herself. Her friends list resembles that of a spam bot, with hundreds of friends spread from Bolivia to Hong Kong.
• “Diana Palamar(chuk)” spreads stories from Artur 32409 and other “troll” users, which later appear on sites like pohnews.org. Along with liking the pages of various confirmed Internet Research Agency/FAN-linked news sites, “she” has taken photographs from various users on VK to use for herself, including a woman named Yulia (Diana – Yulia), and a woman named Anastasia (Diana – Anastasia).
• “Solomiya Yaremchuk” was the first user to repost Artur 32409’s message about the fake Azov Battalion video, through a blog post on Korrespondent.net. She shares the supposed hometown of Diana — Lutsk, Ukraine. One of her photographs was taken from a woman named Tanya (Solomiya – Tanya).

An Analytical Look

Analysis of the social connections between some of these users who spread the fake Azov Battalion video, along with other pieces of anti-Ukrainian disinformation and news stories, reveals deep ties. This analysis also reveals close ties between some of the sites linked to these users, ultimately leading back to the Internet Research Agency and Federal News Agency (FAN).

One of the simplest, yet effective, ways of rooting out fake “troll” accounts is by finding who frequently shares links to news sites created under the guidance of the Internet Research Agency. Searches for those who share links to whoswhos.org and pohnews.org reveal many shared users, including some easily-identifiable troll accounts. Some of these accounts, such as @ikolodniy, @dyusmetovapsy, and @politic151012, also share links to FAN, the news site that shared office space with the Internet Research Agency at 55 Savushkina Street in St. Petersburg.

Another way of findings networks between troll accounts is by analyzing their posting and re-posting habits, as seen earlier in the example of Viktoria Popova, Artur 32409, Solomiya Yaremchuk, and Diana Palamar(chuk). Less than an hour after the very first public mention of the fake Azov Battalion video (from Artur 32409), a user named “Faost” shared a post on fkiev.com. His role[ref]A common tactic used by the employees of the Internet Research Agency is to have a duo or troika play off of each other, all while sitting next to one another in the same office. One person will present a claim, a second and third person (all from similar, but not identical IP addresses) will support or doubt this claim, before the “argument” is resolved in favor of the anti-Ukrainian/pro-Russian perspective. For more information on this tactic and leaked documents that attest to it, see this post and this interview from a former employee.[/ref] is to play a Ukrainian who supported the actions of the Azov Battalion, with the post:

“Everyone knows that the Netherlands is against Ukraine joining the EU. And this has somewhat confused Ukrainian soldiers since they really want to join the European Union. Here, fighters from the Azov Battalion have decided to make an announcement to the Dutch government. They explain their displeasure in this video announcement. And they called on them not to adopt this decision. They said they are gathering units which will be sent to the Netherlands to see this decision through. I am very pleased that our soldiers are worried about these events. I support them because they have put their efforts into this. Our soldiers have to defend Ukraine. These are the bravest guys in our country, they will prove to everyone that Ukraine worthy of EU membership”

Four minutes later, a user named “kreelt” started the same thread on doneckforum.com. These two users are either the same person or part of the same group of troll users. Users with these names were both banned from the forums of Pravda Ukraine within a short space of time of one another for registering duplicate accounts. Additionally, these two users (Faost and kreelt), along with the previously mentioned Diana Palamar, have started numerous threads under the “news” tag on a low-traffic forum.

While this is circumstantial evidence, there is much more direct evidence that these are all the same person, or different people working out of the same office. Both Faost and kreelt posted under the IP address of 185.86.77.x (the last digit(s) of the IP address is not publicly visible) in the same thread on Pravda Ukraine. As well as these accounts, the same IP was used by similar troll accounts “Pon4ik” and “Nosik34,” who both posted materials with similar content as the rest of this network of users.

The IP address used in the troll network linked to the spread of disinformation, including the fake Azov Battalion video, is linked to the GMHOST Alexander Mulgin Serginovic, which has launched malware campaigns from the same 185.86.77.x IP address. Completing the loop, users from this 186.86.77.x IP address, including the aforementioned kreelt and a troll account named “Amojnenadoima?”, have linked to stories from pohnews.org on the website dialogforum.net.

Other Fake Azov Videos Connected?

There are additional videos that may be connected to the first one, in which a Dutch flag was burned. The most relevant fake video was posted on February 1, 2016, fewer than two weeks after the flag burning video was posted. This video shows a similar scene to the flag burning video, but instead the Azov Battalion fighters are standing on a Dutch flag. The video was uploaded to a new YouTube channel, called “Volunteer People’s Battalion AZOV,” with only this video in its uploads.

Both of this and the flag burning video use the maximum resolution of 720p, compared to the 1080p resolution of the real videos released by the Azov Battalion at this time. Additionally, both videos show a “ghosting” effect with the introductory sequence. In the composite below, the genuine videos released by Azov Battalion are on the left, and the fake ones are on the right:

All of the uniforms use the same camouflage pattern. Strikingly, the patterns of the speakers’ uniforms are the same in both videos (click file to view at full size):

These connections are not conclusive proof that the same people appeared in and created both videos, but considering these links and the similar messages and formats of the videos, it is a strong possibility.

Additionally, a video and accompanying photographs were posted in January 2016 by the group Cyber Berkut. These images and video, supposedly taken from Azov Battalion members, show members of the battalion wearing gear with the ISIS flag in an abandoned factory. Like with nearly (if not absolutely) all other Cyber Berkut “leaks,” this evidence is most likely a crude fake.

Like with the other fake video with the Dutch flag, there is no hard evidence that links this “revelation” to the flag burning video. However, considering all of these releases targeted the same group and were released within about three months of one another, it would be worthwhile to further investigate the possible links between these videos.

The Dutch Reception

For the most part, the mainstream Dutch media was not fooled by the video and its threats of terror. Hubert Smeets of NRC detailed why the video was likely a fake, as did NOS and Volkskrant. The popular blog Geenstijl, which is focused on being against the association agreement between the EU and Ukraine, took a more neutral position, and did not state if the video was real or fake. At the same time, Jan Roos, who is associated with Geenstijl and one of the chief promoters for voting against the association agreement, suggested that the video constituted a real threat against the Netherlands. The site Deburgers.nu, also against the association agreement, showed the fake screenshot of the Azov YouTube channel as evidence that the video was real.  It seems that neutral and mainstream media outlets correctly portrayed the video was a fake, but individuals and outlets already taking a stance against Ukraine’s association agreement were more welcome to accepting the video as a true threat.

Conclusion

The very first public mention of the fake Azov Battalion video is from Artur 32409, a user part of a network of “troll accounts” spreading exclusively anti-Ukrainian/pro-Russian disinformation. The way in which this fake video spread is the same as the disinformation campaigns operated by users and news sites ran by or closely linked to the Internet Research Agency. Additionally, the video’s spread mirrors that of a fake video of a “U.S. soldier” shooting a Quran, which was orchestrated by St. Petersburg troll groups.

Moreover, the fabricated screenshot supposedly showing the authenticity of the Azov Battalion video was first spread by, and almost certainly created by, a man named Yury Gorchakov. Gorchakov has been previously linked to the creation of a fake video of Right Sector.

The “troll network” of Artur 32409 frequently uses pohnews.org to spread disinformation. This site shares its administrator with whoswhos.org, which has been confirmed to be under the umbrella of the Internet Research Agency and its sister news organization, FAN.  Leaked e-mail correspondences from 2014 courtesy of the hacker collective Anonymous International (aka “Shaltai Boltai”) confirm that these organizations do not act independently and, at the time of the leaks, received instructions from the Kremlin.

In short, there is a clear relationship between the very first appearance of the fake Azov Battalion video in which a Dutch flag is burned and the so-called “St. Petersburg Troll Factory.” The video was created and spread in an organized disinformation campaign, certainly in hopes of influencing the April 6th Ukraine-EU referendum. Most mainstream Dutch news outlets have judged the video to be a crude piece of propaganda; however, some online outlets, such as Geenstijl, have given some weight to the idea that it may not be fake. Therefore, we can say that the organization disinformation campaign has had minimal impact, as the only people swayed by the video seemed already be in the “no” camp against the Ukrainian referendum.