Forensic Research Archive of Manipulation and Exploitation
Illustration: a split dossier collage contrasting a 1950s intelligence briefing room with an analog newsroom monitoring wall.

Watch briefs · September 27, 2026

A Russia-attributed social campaign, as logged by Ukraine's CCD, sold alleged servicemen as Maidan leaders to pull troops into anti-mobilization protests.

Illustration, not an archive object

Filed
September 27, 2026, 16:00 UTC
Actor
Russia-attributed social-media operators as assessed on 26 September 2026 by Ukraine's Center for Countering Disinformation under the National Security and Defense Council, publishing on its Facebook page and Telegram channel
Target
Ukrainian civilians and service members asked to treat a new Maidan, led by supposed troops, as the homegrown next step rather than as an undeclared influence line
Source
Impersonated Source falsified: fake personas, outlets or documents
Confidence
medium Plausible and sourced, but attribution or interpretation still open
Techniques
AstroturfingPlain folksGlittering generalitiesManufactured consensusTransferCard stacking
Where
Ukraine, Russia
Channels
  • Ukrainian-language social media protest calls, 26 September 2026
  • CCD Facebook statement via Ukrinform
  • CCD Telegram post 19254 via LB.ua
  • Maidan square as a borrowed 2013-14 symbol
  • Alleged-serviceman personas as protest leaders

Summary

On 26 September 2026 Ukraine's Center for Countering Disinformation under the National Security and Defense Council said it was recording a large-scale social-media campaign it attributes to Russia. Multiple same-day wires — Ukrinform citing the Center's Facebook post, LB.ua citing Telegram post 19254, Interfax, RBC-Ukraine, and UNN — reprint the same slogan stack: calls to take to the Maidan and demand that the authorities immediately conclude peace, cancel mobilization, and hold immediate elections, with alleged Ukrainian servicemen presented as the leaders of the protests. The Center added that, according to intelligence it had received, the design is to draw actual service members into street actions in order to destabilize the interior and undercut defense. Score the dated CCD statement and the matching wire copies as documented. Score the unseen network map, a named Russian tasking order, and any proof that a Maidan crowd formed from these posts as not shown.

Analysis

Rotation this cycle leaves a Chinese MFA summit readout and an Iranian UNGA mirror speech behind. The load-bearing object is a 26 September warning from Ukraine's Center for Countering Disinformation, not another midterm deepfake farm and not a new Graphika map.

Three objects have to stay separate. Object one is the dated statement. On 26 September 2026 the Center said it was recording a large-scale social-media campaign it attributes to Russia. Ukrinform pointed to the Center's Facebook post. LB.ua pointed to Telegram post 19254. Interfax, RBC-Ukraine, and UNN reprint the same slogan list: take to the Maidan; demand that the authorities immediately conclude peace, cancel mobilization, and hold immediate elections; present alleged Ukrainian servicemen as the leaders of the protests. The Center added that, according to intelligence it had received, the point is to pull real troops into the street so the interior frays and defense weakens. Object two is attribution. That sentence is the Center's. No independent platform takedown, domain list, or botnet diagram for this batch is attached to the wires. Object three is effect. None of the cited items shows a crowd on Independence Square that formed from these posts, a named unit that marched, or a mobilization office that closed. Do not treat object one as a forensic match to every anti-mobilization post in Ukrainian Telegram. Do not treat object three's silence as proof the slogans were never posted.

Mechanism is borrowed grassroots. Astroturf is the load-bearing device: the leader is a supposed Ukrainian soldier, not a named Russian channel. Plain-folks is the same costume. The warrant is the uniform and the square, not a signed roster. Glittering generalities do the rest. Peace, elections, and the end of mobilization are virtue words. Swap each for a ceasefire text, a date, a turnout rule, or a casualty method, and the post needs a fact it does not carry. Manufactured consensus is the crowd that is asserted before it is counted: many posts, one stack, the impression that troops already agree. Transfer sits in the word Maidan. Prestige and stigma from 2013-14 are pasted onto a 2026 war-weariness argument the square does not settle. Card-stacking is the missing denominator. The Center's public text, as carried by the wires, does not attach screenshots, account ages, shared infrastructure, or a count of authentic versus inauthentic posts.

This is propaganda on the method test if origin is an undeclared foreign line, form is a rented Ukrainian soldier, and the design goal is to move identification so a wartime grievance reads as a homegrown uprising. Real Ukrainians arguing that mobilization should change, or that talks should start, is not the violation. Planting a fake troop as the face of that argument is the influence layer. Color is gray-to-black: the Center describes concealed personas. A Ukrainian or Western shop that invented Russian conscripts as leaders of a Moscow street campaign would score the same ids. Score the method, not the flag.

The Center is itself a state counter-influence desk. Treat its 26 September text as a primary record of slogans it says are circulating, not as a verdict that every peace post is Russian and not as a brief on the Center's own rhetoric. Intelligence it has received is a source class, not a document dump.

Literacy counter: keep three objects apart. One: the 26 September CCD statement as copied by Ukrinform, LB.ua with Telegram 19254, Interfax, RBC-Ukraine, and UNN. Two: the claim that Russia has already produced a new Maidan. Three: the claim that any Ukrainian who wants elections or an end to mobilization is therefore a Russian asset. Demand the account list, the persona evidence, and a dated crowd count before treating the warning as a street event.

Tells

Evidence

  1. Ukrinform, 27 Sep 2026: CCD Facebook warning on Maidan protest calls
  2. LB.ua English, 26 Sep 2026: CCD Telegram post 19254 on protest slogans
  3. CCD Telegram post cited by LB.ua as the primary channel copy
  4. CCD Facebook post cited by Ukrinform as the primary page copy
  5. Interfax-Ukraine, 26 Sep 2026: CCD press copy on alleged servicemen leaders
  6. RBC-Ukraine English, 26 Sep 2026: CCD intelligence line on drawing troops into protests
  7. UNN, 26 Sep 2026: Ukrainian-language CCD statement with slogan stack

Related briefs