The Pravda Network's "Trojan Horse": Unmasking the Shadow Operation in Eastern Europe and the Baltics

The Anatomy of the 'Pravda Network'
At the heart of this digital expansion lies the "Pravda" network, a sprawling operation linked to the "Portal Kombat" campaign first exposed by VIGINUM in 2024. This infrastructure functions as a digital "Trojan Horse." On the surface, it appears to be a benign technical shell. In reality, it is a massive rebroadcasting engine for a broad spectrum of information manipulation, ranging from
Kremlin giants like RT and Sputnik to hyper-local pro-Russian Telegram channels. Investigations by the DFRLab have linked the operation to TigerWeb, a Crimea-based IT firm whose owner reportedly maintains deep ties to the Russian-backed occupation government.

Experts point to two main explanations for the network's strategic goal. First, by pumping millions of articles across hundreds of sites, the network may be functioning as an "Information
Laundromat" for "LLM Grooming." Research by NewsGuard suggests this mass replication aims to deceive Large Language Models (LLMs) like ChatGPT, Gemini, and Copilot, flooding the internet with consistent falsehoods so that AI models come to accept propaganda as authentic fact and surface these narratives as credible information. Others argue the network instead preys on "data voids" — obscure or highly niche topics where authoritative media is silent — so that when a user asks an AI about a specific subject, the algorithm, finding no reliable sources, may inadvertently surface results from these dubious sites. Whether the goal is to "brainwash" the algorithms or simply occupy the digital gaps where quality information is lacking, the risk to digital sovereignty is unprecedented.

Telegram: The Network's Primary Engine

An analysis of the Pravda network's infrastructure reveals a striking dependency: as of late 2025 and early 2026, the operation is almost entirely tethered to a single platform. In Ukraine, Georgia, Moldova, and Estonia, Telegram has emerged as the undisputed engine of content distribution. In Ukraine and Estonia, the reliance is absolute, with 100% of primary sources originating on Telegram; this dominance remains nearly as total elsewhere, with the platform accounting for 97% of sources in Georgia and 98% in Moldova.

Standalone websites, once the backbone of digital influence, have become statistically irrelevant in this new shadow architecture: in Ukraine and Estonia web-based sources have vanished entirely, while in Georgia and Moldova they represent a negligible fraction — just 3% and 2%, respectively. This evolution marks a fundamental shift in the Kremlin's playbook: the Pravda network is no longer building a web of sites; it is building a web of Telegram mirrors.

Under the Kremlin's Watch: Roskomnadzor and Legal Compliance Since November 1, 2024, a new "legal iron curtain" has fallen over Russian social media. Under Federal Law No. 303-FZ, any account with more than 10,000 followers must register with Roskomnadzor (RKN), Russia's federal media watchdog; non-compliance brings swift and costly consequences, including advertising bans, monetization freezes, and restrictions that significantly limit an account's ability to distribute and amplify content. For the Pravda network, these regulations are not obstacles but blueprints. The analysis reveals a startling level of compliance, suggesting the network does not merely exist within the Russian legal framework but operates with apparent state approval. The degree of alignment varies by country but remains significant throughout: Georgia shows the deepest integration, with 68% of its sources registered with Roskomnadzor; Estonia follows with 59%; in Ukraine, nearly half (47%) of primary sources have formalized ties with the Kremlin's regulator; and even in Moldova, nearly a quarter (24%) of the network operates with Roskomnadzor's official stamp of approval. This "official" status confirms that these platforms are not independent voices but synchronized components of a state monitored machine.

Lost in Translation: The Kremlin's Linguistic Fingerprints

The Pravda network markets itself as a collection of local news outlets, but its language tells a different story. Analysis reveals a staggering reliance on Russian: 100% of the network's Ukrainian
content, 99% of its Estonian reach, 96% of its Georgian output, and 85% of its Moldovan distribution originates in Russian.

In the Ukrainian segment, translations frequently trip over basic homonyms. The Russian word "мир" can mean both "peace" and "world"; while these are two distinct words in Ukrainian —
"мир" (peace) and "світ" (world) — the network's translation algorithms fail to distinguish between them, at one point rendering "Is peace close?" as the nonsensical "Is the world close?" (Світ
близько?). In another instance, the system tried to translate the name of the Russian missile Oreshnik and, instead of preserving the proper noun, substituted the literal Ukrainian word for a hazelnut tree ("ліщина"). The network also consistently uses the Russian military acronym "ВСУ" instead of the official Ukrainian "ЗСУ," a clear sign that content is being "laundered" directly from Russian templates. In Georgia, the network struggles with both phonetics and syntax. It frequently misspells the name of EU Ambassador Paweł Herczyński, substituting a hard Russian "G" for the Georgian aspirated "H." Some headlines collapse into total "word salad," such as "What should do the car's useless?" — a clunky, literal translation of Russian grammar that produces pure gibberish in Georgian. The Moldovan segment suffers from "false cognates" — words that look similar but carry vastly different meanings. A glaring error occurs with the Russian verb "ругается" (to argue): in reports on political disputes, the system often renders this as "a înjura" (to swear or curse) instead of "a secerta" (to argue), turning a professional political disagreement into an instance of verbal aggression.

The Architecture of Influence: From Media Outlets to "Voenkors"

The Pravda network is not a monolithic entity; it is a sophisticated ecosystem of diverse actors, which the analysis sorts into seven distinct tiers spanning official state media and diplomacy
through to shadowy, anonymous influencers. The network is directly plugged into the Kremlin's official apparatus, including the Russian Ministry of Defense, the Ministry of Foreign Affairs (MID), the Investigative Committee (Sledkom), and various embassies. Established state-owned and pro-Kremlin outlets provide the "reputable" veneer for the operation — names like RT, Sputnik, and TASS act as the primary content factories, alongside specialized agencies such as Ruptly and News Front. A further category consists of institutions, organizations, and NGOs that project Russian "soft power" under the guise of cultural or strategic cooperation, amplifying platforms like Rossotrudnichestvo ("Russkiy Dom"/Russian House), the International "People's Unity Club," and the Institute of Russian Strategies. A large share of the content is driven by "personalities" — political pundits and "Voenkors" (Russian military bloggers) who lend the propaganda a "boots-on-the-ground" feel.

Key figures include high-profile propagandists like Vladimir Solovyov and military bloggers such as Colonelcassad and Kotsnews; in Moldova, figures like Bogdan Țîrdea provide a local face to Kremlin narratives, while in Ukraine the network amplifies "experts" like Yuriy Podolyaka. The most clandestine layer consists of coordinated networks like Rybar, a sophisticated military-analytical project linked to Russian intelligence, and InfoDefense, supplemented by "unclear" or anonymous Telegram channels that lack transparent ownership and serve as a covert frontline for psychological operations. (The full report separately ranks the twenty leading primary sources feeding each of the four country segments — Ukraine, Georgia, Moldova, and Estonia — over the November 2025–January 2026 research period.)

The Sanction Bypass: Breaking National Security Barriers

The "Pravda" network does more than distribute content; it functions as a sophisticated digital bypass for entities explicitly banned under national security law. By acting as a "mirror" for silenced
voices, it breathes new life into sanctioned outlets that have been legally barred from operating in Ukraine and Moldova. In Ukraine, the network's source list includes NewsFront, a disinformation outlet currently under state sanctions; despite being legally "de-platformed" by the Ukrainian government, its narratives are seamlessly injected back into the local information space through the Pravda network's infrastructure. The situation is even more systematic in Moldova, where the network serves as a megaphone for voices authorities have labeled "inciters of war and hatred," including Sputnik.md and GagauzNews, both officially blocked since February 2022, as well as outlets like Primul în Moldova, whose broadcasting licenses were suspended over ties to sanctioned individuals and a documented failure to provide accurate coverage of the war in Ukraine. The defiance extends to the EU level as well: as an EU member state, Estonia is covered by bloc-wide bans on Russian state-controlled media, yet the Pravda network actively serves as an unblocked backdoor for these prohibited channels, with its Estonian infrastructure mirroring and amplifying major Kremlin mouthpieces and state television networks including Sputnik, RT, RIA Novosti, NTV, Tsargrad TV, Izvestia, REN TV, and Pervyi Kanal. By hosting this content, the Pravda network creates a parallel digital reality in which national security laws and judicial bans simply do not apply — not merely a media project, but a direct assault on the legal sovereignty of the targeted nations. The Echo Chamber: Building a Closed Information Ecosystem. One of the most sophisticated tactics of the Pravda network is its attempt to trap users within a self-contained digital universe — a strategic "closed loop" designed to keep readers from exiting back to verified sources. This "fortress effect" surfaced when researchers searched for specific network resources: Google queries for the outlet "ПИКА," for instance, led exclusively back to other Pravda-linked entities such as ZOV Berdyansk, or redirected users to Max, a Russian-designed messenger.

The network's strategy also relies on internal cross-promotion, such as the promotion of "Druhaya Ukraina" (The Other Ukraine), a platform linked to the sanctioned collaborator Viktor Medvedchuk. Although "Druhaya Ukraina" has been thoroughly exposed by reputable Ukrainian media for its pro-Russian objectives, the Pravda network builds a protective bubble around it, placing descriptive advertisements and direct links to its pages across the network's various channels. Notably, thenetwork's walls are not yet impenetrable: when using "AI Search" features to look for these resources, algorithms still surfaced links from reliable Ukrainian and international sources, breaking the cycle of misinformation. Still, the network's underlying goal remains clear — to create a parallel reality where the only available "truth" is the one it provides itself. While AI can still pierce these barriers, the internal structure of this "Trojan Horse" is meticulously built to keep its audience barricaded within its own walls.

Conclusion

The "Pravda" network represents a new frontier in Russian information warfare. Moving beyond traditional media, it operates as a sophisticated, near-automated infrastructure tailored for the
digital age. While its methods of dissemination have been modernized, its core remains rooted in a centralized, Kremlin-aligned ecosystem — a true digital "Trojan Horse" designed to undermine
sovereignty from within. The investigation highlights six critical pillars of this operation: Telegram has emerged as the undisputed backbone of the operation; the network's administrators function strictly within the Russian legal framework by registering accounts with Roskomnadzor; the network's heavy reliance on Russian-origin content and low-quality translation exposes its foreign roots; the operation spans a vast ecosystem of actors, from official diplomats and state media outlets to "Voenkors" and anonymous "shadow" Telegram channels; "Pravda" provides a digital backdoor for sanctioned actors to bypass national security regulations; and through internal cross-promotion, the network attempts to trap users in a self-contained reality, isolated from verified, independent reporting. Ultimately, the "Pravda" network is a coordinated shadow operation masquerading as local media. Whether through "LLM grooming" to poison AI models or the exploitation of "data voids," its true purpose is clear: to bypass regional safeguards and systematically reshape local information environments from within.

This publication is part of the series "Authoritarian Playbook in Eastern Europe and South Caucasus". Read further contributions to the series, including Personal Data for Surveillance: Remote Facial Recognition and Emerging Surveillance Practices in Georgia and How the Pro-Kremlin Disinformation Ecosystem Exploits Conspiracy Narratives to Target Polish and Ukrainian Audiences.

Disclaimer: Eastern Partnership Think Tanks Network offers researchers from the South Caucasus an opportunity to publish their research. It therefore represents the views of the authors exclusively and does not necessarily reflect those of the DGAP or the European Union.