During February-March 2026, amid escalating tensions in the Middle East, the Center for Countering Disinformation (hereinafter – the Center) identified an information campaign aimed at discrediting Ukraine and its top political leadership. This information campaign is being carried out by entities linked to the kremlin and the Iranian regime, and aims to achieve three interrelated strategic objectives.

The first objective is to undermine Ukraine’s international reputation by spreading false claims that Western weapons supplied to Ukraine have allegedly ended up on the black market, as well as claims regarding the «ineffectiveness» of Ukrainian defence technologies. The second is to delegitimise the state’s top political leadership by portraying the government as «incompetent» and «corrupt», allegedly sacrificing the country’s security for personal gain and provoking economic destabilisation. The third is the discrediting of Ukraine’s international defence cooperation through the dissemination of disinformation about alleged losses suffered by Ukrainian troops in the Middle East.

Among the destructive narratives identified by the Center based on its monitoring findings, the following stand out in particular:

Narrative 1: «Western weapons supplied to Ukraine end up on the black market and subsequently in Iran»

A disinformation narrative is circulating in the informational space suggesting that weapons supplied to Ukraine by international partners as part of military aid are allegedly ending up on the black market and subsequently being used by countries in the Middle East, notably Iran. For example, some Telegram channels that mimic Ukrainian ones have disseminated a fake video, styled to resemble a report by the American media USA Today. The video claimed that among the debris of weapons used by Iran to attack Israel and American bases in the Middle East, weapons components allegedly previously supplied to Ukraine had been found. To bolster the video’s «credibility», it features a «comment from an analyst at the Institute for the Study of War (ISW)», who «confirms the fact that Ukraine sold high-precision weapons».

The Center has verified that the material in question is fabricated¹. There is no such publication on USA Today’s official platforms, and the video itself lacks the attributional captions typical of this media outlet, which would specify the source and location of the footage. The comment attributed to the ISW representative is also untrue, as no such statements have been recorded either on his public accounts or in the institute’s analytical materials.

^[1] Link to the Center’s rebuttal: https://t.me/CenterCounteringDisinformation/17331

Narrative 2: «Ukraine’s political leadership acts in the interests of personal enrichment rather than state security»

In the information space, a narrative is being disseminated about the «incompetence» of the Ukrainian leadership, whilst the decisions taken are being discredited as allegedly dictated by personal corrupt interests. This narrative has been fuelled by the information that Ukrainian military experts in the fields of air defence and drone technology have been deployed to support partners in the Middle East. Building on this, Telegram channels that mimic Ukrainian ones have begun spreading manipulative messages claiming that the Ukrainian authorities are sending their best specialists to protect «Arab sheikhs» «instead of defending their own cities».

In addition, reports circulated claiming that the deployment of Ukrainian military experts was allegedly linked to the protection of overseas property of Ukrainian politicians, officials, law enforcement representatives and military commanders. At the same time, other unsubstantiated allegations were circulated, in particular regarding «kickbacks» from fuel deals or the «personal enrichment of Ukrainian officials» in the context of defence cooperation with partners.

Narrative 3: «Economic destabilisation and rising fuel prices in Ukraine are the result of actions taken by the country’s top political leadership»

In the information space, a narrative is being disseminated about an «economic collapse» in Ukraine and a «fuel crisis», responsibility for which has been shifted to the country’s political leadership. The information pretext for promoting such messages was the rise in global oil prices, amid escalating tensions in the Middle East and restrictions on shipping in the Strait of Hormuz. At the same time, some resources have exploited these circumstances to manipulatively push the message that the rise in fuel prices in Ukraine is not the result of external economic factors, but rather of alleged corruption schemes and the inaction of the Ukrainian authorities.

In particular, a message is being disseminated about the alleged existence of a corrupt scheme whereby certain officials are exploiting rising fuel prices as a means of personal enrichment. However, these allegations are not backed up by any evidence, and the messages themselves are based on conspiracy theories and speculation, and contain emotionally charged rhetoric.

Narrative 4: «Ukraine is suffering losses in the Middle East»

In the information space, disinformation messages are being disseminated about the alleged deaths of Ukrainian military personnel, particularly specialists in air and anti-drone defence, as a result of Iranian strikes on targets in the Middle East.

It is worth noting that, in order to lend a semblance of «credibility» to their disinformation messages, propaganda resources use photographs of real Ukrainian servicemen, alter their personal details and fabricate the circumstances of their deaths. In particular, in one such case, a genuine photograph of Mykola Syshchyk, a soldier who died in 2024, was used to «confirm» the alleged death of a Ukrainian serviceman in the UAE. At the same time, using artificial intelligence, the propagandists «rejuvenated» him and invented a name².

^[2] Link to the Center’s rebuttal: https://t.me/CenterCounteringDisinformation/17601

It has also been established that a real photograph of Ukrainian soldiers was used, likely members of the band «Будьмо» from the Ivano-Frankivsk region, who were mobilised in 2024. The image has been altered: it has been superimposed onto a background featuring palm trees and skyscrapers to create the impression of a location in the Middle East, and the faces have been deliberately blurred to make identification more difficult. At the same time, distinctive details remain in the photo, including external features and accessories, which makes it possible to establish that the image has been substituted.

This narrative has therefore been constructed through a combination of unsubstantiated claims, the manipulative use of photographic material and the falsification of personal data.

Narrative 5: «Ukraine supplies its partners with ineffective defence technologies»

In the information space, a disinformation narrative is also circulating, aimed at discrediting the Ukrainian defence industry, particularly developments in the field of countering unmanned aerial vehicles. Such reports claim that Ukrainian anti-drone solutions are «ineffective» and incapable of protecting the strategic facilities of partner countries.

The key tool for spreading this narrative is the use of fabricated video footage styled to resemble content from reputable international media outlets, notably Al Jazeera³.

This manipulation involves combining fabricated facts with Ukraine’s actual international cooperation in the field of defence technology. This creates a false impression that Ukrainian developments are ineffective and that Ukraine is «unable» to fulfil its obligations as a security partner.

^[3]  Link to the Center’s rebuttal: https://t.me/CenterCounteringDisinformation/17615

Actors involved

A range of actors at various levels are involved in spreading such disinformation narratives – from officials to extensive networks of information influence:

• Official representatives of russian federation and Iran: public statements by official representatives of russian federation and Iran are used as a primary source for the further dissemination of destructive messages.
• Network of propaganda resources «Portal Kombat»: this network constitutes a vast ecosystem of information influence operated by the aggressor state, which can broadly be divided into two main segments – «Pravda» and «ZOV»:
  • The «Pravda» propaganda network was established in 2022 and is one of the aggressor state’s key tools for international information influence. According to open-source data, as of April 2024, it consisted of 224 «information portals» and covered almost all countries of the European Union, as well as some states in Asia, Africa, North America and Oceania.
  • The «ZOV» propaganda network is primarily aimed at a Ukrainian audience. As of early 2026, it consisted of at least 68 websites, 40 Telegram channels and 40 pages on the social network VKontakte. A distinctive feature of the network is the adaptation of destructive content to specific regions of Ukraine and major cities, which creates the illusion that such messages originate locally⁴.
• Sources linked to main directorate of the general staff of the armed forces of the russian federation: in particular, «Легитимный» (Legitimnii), «Резидент» (Rezident), «Сплетница» (Spletnitsa) and others. According to information from the Security Service of Ukraine, they are linked to the 85th main center of the special services of the general staff of the armed forces of the russian federation⁵.
• The «UkrLeaks» network of propaganda sources: this network is directly linked to sanctioned Vasyl Prozorov, who carries out systematic activities aimed at discrediting Ukraine and its international partners. As of December 2024, it comprised 47 pro-russian media sources producing audiovisual and written content in 13 languages⁶.
• The «InfoDefense» network of propaganda sources: this network operates as a multilingual information ecosystem aimed at an international audience. As of 2025, it comprises at least 61 information resources, 46 of which are Telegram channels that serve as the primary channels for content distribution⁷.
• Information resources linked to the collaborator Viktor Medvedchuk: in particular, these include sources from the «Другая Украина» (Drugaya Ukraina) project, which systematically promote anti-Ukrainian narratives.
• Iranian state media: in some cases, these media outlets synchronise with pro-russian sources and disseminate narratives that serve the kremlin’s interests.
• X accounts that may be used by the aggressor state: such accounts often pose as independent analysts, journalists or public commentators, yet systematically spread narratives similar to russian propaganda⁸.

^[4] Link to the Centerʼs analytical report: https://cpd.gov.ua/reports/analitychnyj-zvit-merezha-rosijskyh-propagandystskyh-resursiv-zov/

^[5] Link to the publication by the Security Service of Ukraine: https://ssu.gov.ua/novyny/sbu-vykryla-ahenturnu-merezhu-spetssluzhb-rf-yaka-destabilizuvala-sytuatsiiu-v-ukraini-cherez-telegramkanaly

^[6] Link to the Center’s analytical report: https://cpd.gov.ua/reports/analitychnyj-zvit-merezha-rosijskyh-propagandystskyh-resursiv-ukrleaks/

^[7] Link to the Center’s analytical report: https://cpd.gov.ua/reports/analitychnyj-zvit-merezha-rosijskyh-propagandystskyh-resursiv-infodefense/

^[8] Link to the Center’s analytical report: https://cpd.gov.ua/reports/analitychnyj-zvit-anglomovni-akaunty-v-x-yaki-mozhe-vykorystovuvaty-rosijska-federacziya/

Techniques, Tactics and Procedures  (TTP’s)

The following techniques, tactics and procedures were used to disseminate destructive messages:

1. Brand Spoofing: this tactic involves creating fake media content that is styled to resemble reputable international media outlets, such as USA Today. The aim of this technique is to lower the audience’s critical assessment of the information; whilst they are drawn to brand recognition, they do not scrutinise the design details. Fake videos or articles produced in this way often lack standard attribution elements (image captions, source references, author details), which creates the impression of genuine content.
2. Fake attribution to real people: this technique involves attributing fabricated comments to real experts or analysts, as in the case of the ISW analyst. A quote attributed to a real person creates an impression of authenticity, even though it is in fact fabricated, making it difficult to verify or refute.
3. Coordinated distribution: this tactic involves the simultaneous or near-simultaneous dissemination of identical or nearly identical publications, for example via Telegram channels, particularly those mimicking local Ukrainian information resources such as «Республика Одесса» (Respublika Odessa), «Одесса Zа Победу!» (Odessa Za Pobedu!) and others.
4. Mixing facts with manipulation (Factual Laundering): this tactic involves using real events (such as rising oil prices or Ukraine’s supply of defence technologies to its partners) as a «foundation» upon which baseless accusations of corruption, criminal intent or personal enrichment on the part of certain individuals are «built». Thanks to such manipulations, destructive narratives appear to be a logical extension of the facts, which makes them significantly harder to debunk.
5. Recycling «dormant» narratives: this technique involves reusing previously tested disinformation narratives in new geopolitical contexts. In particular, as far back as 2023, in the analytical report «Black Market Weapons», the Center documented a russian disinformation campaign aimed at cementing the narrative that Ukraine was allegedly trading in the weapons supplied to it and was «the main factor of destabilisation in all the world’s hotspots». It was precisely this template that was subsequently adapted to events in the Middle East⁹.
6. The use of AI technologies: this tactic involves using artificial intelligence to create or edit fake video and photographic material in order to lend credibility to the manipulation. Such materials may feature both fictional characters and real people, whose appearance has been partially recreated or modified based on images already available in the public domain, including military personnel or well-known figures.

^[9]  Link to the Center’s analytical report: https://cpd.gov.ua/announcement/analitychnyj-zvit-na-temu-chornyj-rynok-zbroyi/

The aim of spreading destructive narratives

The systematic dissemination of these narratives is aimed at comprehensively destabilising the situation in Ukraine and deliberately discrediting the state on the international stage.

At the level of Ukrainian society the dissemination of such narratives is aimed at undermining public trust in the top military and political leadership and state institutions by manipulating economic challenges, security risks, issues of international support, and so on. Messages about the alleged prioritisation of the authorities’ personal interests over citizens’ security and the state’s «administrative incompetence» are intended to demoralise society and heighten uncertainty about the future.

At international level the dissemination of such narratives is aimed at undermining Ukraine’s image as a responsible and reliable partner. By casting doubt on the transparency of military aid, the effectiveness of defence decisions and the capabilities of the domestic defence industry, the groundwork is being laid for the reduction or withdrawal of further support for Ukraine. The aim is to isolate Ukraine, undermine its defence capabilities and delegitimise the actions of the country’s top political leadership.