# Pro-Russian TikTok accounts spread occupation propaganda in Mariupol

Published: 2025-07-21 · Severity: routine · Sectors: government-national, media
Canonical: https://vorant.io/reports/0376c3e6-c763-5519-942e-463d054a6236/pro-russian-tiktok-accounts-spread-occupation-propaganda-in-mariupol

> Russian-backed TikTok influencers promote false narratives of successful reconstruction in occupied Mariupol to normalize occupation.

The DFRLab documents a coordinated information operation on TikTok where pro-Russian accounts, some tied to the Kremlin-linked Donbass Mediacenter, promote narratives of thriving reconstruction and improved living conditions in occupied eastern Ukraine. These accounts employ influencers like Pavel Karbovsky (Donbass Kosmonavt) and operate dedicated channels featuring curated video tours of Mariupol's supposedly rebuilt areas, while omitting or downplaying the city's extensive ongoing destruction. The campaign exploits TikTok's audiovisual and influencer-oriented features to create a false impression of prosperity and successful Russian integration.

The operation is systematic: influencers are trained by a Kremlin-affiliated media school, use consistent editing styles and camera angles, request engagement through direct prompts, and selectively showcase restored sites while the city remains largely ruined from the 2022 offensive. Local citizens report that many changes were made specifically to facilitate propaganda filming rather than genuine reconstruction. The strategy aligns with parallel Telegram bot operations documented by DFRLab that manufacture consent for occupation and undermine trust in the Ukrainian government.

Defenders should monitor for coordinated inauthentic behavior on social platforms: networks of accounts using location-based usernames, consistent video templates and editing, and coordinated engagement tactics. The operation creates an information vacuum by crowding out authentic reporting on the actual state of the occupied territories, exploiting the limits on independent verification and international access to on-the-ground conditions.

## Mentioned in this report

- Threat actors: Russia-nexus activity (unattributed)
- Campaigns: Donbas occupation information operation

2 detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://dfrlab.org/2025/07/21/manufacturing-reality-how-pro-russian-tiktok-accounts-promote-donbass-revival

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0376c3e6-c763-5519-942e-463d054a6236/pro-russian-tiktok-accounts-spread-occupation-propaganda-in-mariupol.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup