# Pravda Network launders sanctioned Russian propaganda via 150+ websites

Published: 2026-04-03 · Severity: routine · Sectors: government-national, media
Canonical: https://vorant.io/reports/f474cd8f-d75a-5259-be8c-5feb5ae7f995/pravda-network-launders-sanctioned-russian-propaganda-via-150-websites

> EU-sanctioned Kremlin operation launders Russian state media across 150+ websites in 80+ languages, evading sanctions to flood EU information space with anti-Ukraine disinformation.

The Pravda Network, operated by Tigerweb and founder Yevgeni Shevchenko (both EU-sanctioned in 2025), circumvents media sanctions by republishing content from sanctioned Russian outlets including RT, RIA Novosti, TASS, Lenta, and Komsomolskaya Pravda across more than 150 websites in over 80 languages. The network automates translation and publication, tailoring narratives for individual EU countries to undermine Ukraine's international standing. In February 2026, the network coordinated a disinformation campaign falsely claiming Ukrainian President Zelenskyy told Belgian PM De Wever that Ukraine faced catastrophic frontline losses and manpower shortages—a claim circulated via nine Telegram channels and twenty Pravda sites across multiple languages, likely targeting EU member states during Ukraine's peace negotiations. Despite EU-level sanctions, enforcement remains inconsistent across member states and platforms. Russian media evade restrictions through mirror domains (e.g., swentr[.]site for RT), VPN access, third-party social media reposts on less-moderated platforms like Telegram and TikTok, and lack of source attribution. Ukrainian research shows 63% of foreign-produced content about Ukraine abroad originates from Russian information operations, indicating widespread saturation of the EU information environment with Kremlin propaganda.

## Mentioned in this report

- Threat actors: Tigerweb
- Campaigns: Portal Kombat, Pravda Network

2 detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://dfrlab.org/2026/04/03/sanctioned-kremlin-affiliated-content-persists-via-pravda-network-attempting-to-shape-ukraines-image-abroad

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f474cd8f-d75a-5259-be8c-5feb5ae7f995/pravda-network-launders-sanctioned-russian-propaganda-via-150-websites.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup