Pro-Russian TikTok accounts spread occupation propaganda in Mariupol
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian-backed TikTok influencers promote false narratives of successful reconstruction in occupied Mariupol to normalize occupation.
The DFRLab documents a coordinated information operation on TikTok where pro-Russian accounts, some tied to the Kremlin-linked Donbass Mediacenter, promote narratives of thriving reconstruction and improved living conditions in occupied eastern Ukraine. These accounts employ influencers like Pavel Karbovsky (Donbass Kosmonavt) and operate dedicated channels featuring curated video tours of Mariupol's supposedly rebuilt areas, while omitting or downplaying the city's extensive ongoing destruction. The campaign exploits TikTok's audiovisual and influencer-oriented features to create a false impression of prosperity and successful Russian integration.
The operation is systematic: influencers are trained by a Kremlin-affiliated media school, use consistent editing styles and camera angles, request engagement through direct prompts, and selectively showcase restored sites while the city remains largely ruined from the 2022 offensive. Local citizens report that many changes were made specifically to facilitate propaganda filming rather than genuine reconstruction. The strategy aligns with parallel Telegram bot operations documented by DFRLab that manufacture consent for occupation and undermine trust in the Ukrainian government.
Defenders should monitor for coordinated inauthentic behavior on social platforms: networks of accounts using location-based usernames, consistent video templates and editing, and coordinated engagement tactics. The operation creates an information vacuum by crowding out authentic reporting on the actual state of the occupied territories, exploiting the limits on independent verification and international access to on-the-ground conditions.
Mentioned in this report
Detection guidance
2 detections for this report are in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://dfrlab.org/2025/07/21/manufacturing-reality-how-pro-russian-tiktok-accounts-promote-donbass-revival
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs