Online Potemkin villages: Discovering a Russian influence operation on social media

State-sponsored influence operations are a significant and ongoing problem on social media platforms, which are constantly playing whack-a-mole with an ever-evolving adversary. When distinguishing an influence operation from real users, the key principle is to look for signs of ‘coordinated inauthentic behaviour’ (CIB), which are anomalous behaviours that set a group of accounts apart from authentic users. When numerous CIB indicators are present in a network or account, and when the messaging fits certain patterns and parameters, we can more confidently assess it to be part of an influence operation. These detection principles were applied to unmask a multilingual Russian influence operation, sponsored by the Russian state-sponsored media outlet RT (formerly Russia Today). The network began on Telegram in April 2022 and then migrated to X (formerly Twitter), promoting multilingual video content to legitimise the invasion of Ukraine and to justify the annexation of four Ukrainian oblasts in September 2022. This paper offers analysis on the network’s strategic geopolitical messaging, the specific CIB indicators we observed, its connections to Russian embassies on various levels, the languages it boosted the most, and an update on the network’s current ongoing activity on X.