This Week In Disinformation
21 - 27 December 2025
🗣️ Let’s Talk—What Are You Seeing?
📩 Reply to this email or drop a comment.
🔗 Not subscribed yet? It is only a click away.
As 2025 draws to a close, the final edition of This Week in Disinformation arrives amid a revealing rupture in two very different arenas of truth.
Within days, two of Russia’s most influential pro-war bloggers, Rybar and WarGonzo, did what once seemed unthinkable: they publicly conceded defeat and accused their own Ministry of Defence of lying.
At the same time, the U.S. faced a disinformation crisis of a different kind. After the tragic campus shooting at Brown University on December 13, which claimed two lives and injured nine, false narratives surged across X, Reddit, and a network of fringe political blogs.
I know the Brown University Disinformation is late. It didn’t make the earlier release as there was a lot of work I needed to do.
Kupyansk: The Day Russia’s Disinformation Collapsed
◾ 1. BLUF
In Dec 2025, Russia’s information campaign around Kupyansk collapsed under the weight of reality.
After months of Kremlin‑aligned channels proclaiming the city’s recapture, battlefield evidence and President Zelensky’s verified visit on 12 Dec proved the opposite: Ukrainian forces had regained control.
The episode triggered one of the most visible fractures yet within Russia’s pro‑war information ecosystem.
◾ 2. Context
Kupyansk sits astride key logistics routes linking northern Donbas to Russia’s border supply corridors. Control of this city shapes Ukraine’s ability to interdict resupply lines across Kharkiv oblast. By mid‑2025, after months of stalemate elsewhere, Moscow needed a public victory.
Information fatigue among domestic audiences set favourable conditions as Russians had grown sceptical yet still wanted reassurance that sacrifices paid off.
Russian Telegram channels, particularly Rybar (run by Mikhail Zvinchuk, a former defence analyst), WarGonzo (Semyon Pegov), Readovka, and Voenny Osvedomitel, had become parallel newsrooms. Their perceived proximity to frontline sources gave them authority beyond Rosgvardia TV or RIA Novosti. They fed on a structural flaw as the Kremlin’s preference for good news.
Subordinates polished battlefield reports before passing them upward. When reality contradicted these reports, rather than recalibrate, the information network doubled down.
Ukraine exploited this vulnerability masterfully. Its Centre for Countering Disinformation (CCD) tracked Russian fakes at speed, broadcasting debunks through Telegram and TikTok streams.
OSINT analysts on Patreon channels, Telegram, and X synchronised with official statements. The ecosystem rewarded transparency as visual proof trumped narrative control.
◾ 3. What Happened
From mid‑Oct 2025, Rybar and WarGonzo began posting that Russian forces had “entered Kupyansk’s northern outskirts”. Posts cited unnamed assault brigades; images were low‑resolution stills of industrial zones later geolocated 15 km north.
On 20 Nov, General Valery Gerasimov told state media the city was “fully under control”. That claim anchored federal coverage: anchors repeated it hourly, and Semyon Pegov produced a field segment showing two soldiers raising a flag beside an unidentified warehouse. OSINT volunteers later proved the coordinates matched an abandoned junction near Lyman.
On 26 Nov, Putin met military correspondents and praised Kupyansk “liberators”. Telegram surges followed: identical phrasing “mopping up operations in Kupyansk inner districts” appeared across Rybar, Readovka, and Grey Zone within minutes. TgStat logs show each post reaching roughly 1.5–2 million views within 24 hours. Thus began Phase 1: amplification through repetition loops.
Phase 2 followed as stabilisation via fake corroboration. Audio emerged of Ukrainian commanders allegedly ordering troops to fire on deserters. CCD forensics traced spliced segments from a 2023 Donetsk intercept aired previously on Sputnik. On 2 Dec, Putin told his Security Council that Kupyansk had been under Russian occupation “for several weeks”. Federal outlets projected maps shaded red along the Oskil River.
Ukraine’s pushback reflected textbook cognitive manoeuvre. On 10 Dec, Ukrainian drones filmed Russian units withdrawing east under artillery fire and CCD posted annotated clips within hours.
Two days later, cameras captured Zelensky at Kupyansk’s western approach, 49.69° N, 37.58°, all verifiable coordinates. Within minutes, Russian proxies on VK and Telegram claimed the visit was “green‑screened”. StopFake debunked this within three hours using geolocation shadows and timestamped satellite imagery.
By 15 Dec, WarGonzo’s tone shifted with “progress slowed by harsh weather”. Rybar labelled the front “uncertain”.
On 23 Dec, the façade collapsed as blogs admitted losses of Moskovka and Kindrashivka, describing communication lines “cut”. UNN’s mirror archived Rybar’s post concluding the situation “worse than critical”. Engagement halved overnight.
Russia’s narrative had eaten itself.
◾ 4. Classification
The incident constitutes disinformation. Claims of Russian control failed factual verification, contradicted by subsequent imagery, battle maps, and confessions from primary disseminators. Coordination across five major Telegram channels and synchronisation with Kremlin briefings indicate organised information warfare, not spontaneous error (high confidence).
Intent indicators show both external (strategic morale and deterrence) and internal (career preservation within MoD hierarchy) motivations. The operation weaponised optimism and truth value negligible, purpose manipulative. The Ukrainian communications counter‑attack functioned as real‑time counter‑propaganda anchored in verifiable truth, illustrating information warfare inversion: truth deployed as psychological weapon.
◾ 5. Tactics and Methods
Russian Information Operations
Creation: Video templates and stills, often repurposed from 2022 footage, were reformatted into short Telegram clips designed for autoplay engagement (Rybar, WarGonzo archives).
Amplification: Cross‑posted headlines appeared between 19:00–22:00 Moscow time, matching documented traffic peaks. Linguistic alignment across channels indicates a shared posting schedule, likely via MoD or affiliated PR coordinators.
Validation loops: State television and evening news repeated Telegram phrasing, creating a false sense of corroboration (“Generals confirm what bloggers said”).
Containment: Once battlefield realities diverged from narratives, official outlets pivoted to silence or weather excuses rather than corrections.
Ukrainian Counter‑Operation
CCD’s early‑warning system flagged Telegram traffic before each narrative surge.
OSINT collectives such as DeepState and GeoConfirmed triangulated front‑line visuals with Sentinel‑2 satellite imagery, achieving an average six‑hour turnaround from fake emergence to debunk.
Instead of mockery, Kyiv adopted a restrained tone of factual proof, heightening cognitive dissonance within Russian audiences accustomed to certainty. The strategy of proof‑oversaturation collapsed the reach of fabrications before they achieved 24‑hour virality.
◾ 6. Implications
Operationally, Kupyansk underscores a paradox: disinformation can achieve tactical lift but strategic decay. Russia’s campaign bought three weeks of narrative dominance yet polluted its own decision‑loop. Commanders, believing their propaganda, misallocated reinforcements. When the façade broke, frontline morale plunged. Internal trust eroded faster than any Ukrainian strike.
For information‑operation practitioners, Kupyansk demonstrates the limit of centralised propaganda under decentralised distribution. Telegram’s semi‑independent milbloggers, once force multipliers, became vectors of reputational contagion. Their public disillusionment revealed structural fatigue in Moscow’s narrative machinery.
For Ukraine, the case validates a doctrine of evidence‑based counter‑propaganda: authenticity as offensive weapon. By synchronising action (Zelensky’s presence) with information disclosure, Kyiv achieved information‑dominance without algorithmic manipulation. Controlling the proof cycle is often more powerful than controlling the rumor chain.
In cognitive‑warfare terms, Kupyansk was a rout. The field was psychological terrain, the weapons were trust and timing, and by December 2025, Ukraine held both.
◾ Sources
‘Putin is lying’: Zelenskyy visits front to expose false claims of Russian gains at Kupyansk | Atlantic Council | Ukraine Alert Team
“Kupiansk is f***ed”: Russian war correspondents admit the city’s loss despite Kremlin statements | UNN News Agency | Kyiv Desk
Fake: Zelensky visit near Kupyansk was a green‑screen staging | StopFake | Kyiv Analytic Team
Russia’s Information War 2025: Disinformation as an Operational Weapon | Defence24 Analysis Centre | Patryk Toporowski
Fake Kupyansk: Russian troops misrepresent rear village as captured city | Militarnyi Defence News Network | Andrii Kryvtsov
Russian military leadership continues to lie to Putin about the real situation in Kupyansk | Ukrainian Centre for Countering Disinformation (CCD)
Russian forces near collapse in Kupyansk as Moscow allies concede city lost | Al Jazeera World News | Kyiv Bureau
Russian Offensive Campaign Assessment, December 24, 2025 | Institute for the Study of War (ISW) | ISW Russia & Ukraine Team
Disinformation And The Brown University Shooting
◾ 1. BLUF
A campus shooting at Brown University on 13 Dec 2025 left two students dead and nine injured.
Within hours, false claims spread across X, Reddit, and lesser-known political blogs asserting the attack was staged or politically engineered.
The disinformation wave originated primarily from anonymous right‑wing accounts seeking to deflect attention from the verified immigrant identity of the perpetrator.
◾ 2. Context
American campuses had become powder kegs for information battles by late 2025. Immigration debates raged after President Trump's reelection, with right-wing voices framing foreign nationals as inherent threats. Brown, an Ivy League hub with diverse students, embodied these tensions.
Furthermore, its engineering buildings drew international talent via visas like the one held by the eventual shooter. Platforms fed the fire: X prioritised speed over verification post-moderation cuts, whilst Reddit's subreddits allowed unchecked cross-posting from r/masskillers to conspiracy forums.
Platform vulnerabilities amplified this risk: X has relaxed moderation and reduced real‑time fact‑checking teams after cost‑cutting, whilst Reddit’s open posting structure enabled rapid cross‑posting between high‑traffic subreddits and fringe political forums.
◾ 3. What Happened
Cláudio Manuel Neves Valente entered Barus and Holley at 16:03 EST on 13 Dec 2025. Masked, he fired into Room 166, killing Ella Cook and Mukhammad Aziz Umurzokov whilst wounding nine others. University alerts hit phones at 16:22, sparking lockdown. A mistaken 16:50 custody claim sowed doubt and was retracted twenty minutes later.
By 17:15, X posts labelled it a ‘staged psyop’. Reddit’s r/masskillers thread hit 5,000 upvotes in hours, with users sharing unverified vehicle photos and hoax theories. Over 120,000 #BrownShooting posts emerged by midnight, one-third pushing false flags. Accounts synced phrasing like ‘crisis actors confirmed’, hitting 500,000 impressions via retweets. Benjamin Erickson, a detained student from Wisconsin, got doxxed after leaks. He was released on 15 Dec 2025 with no charges.
Anonymous posts began spreading at 17:15 on X, claiming the event was a ‘false flag’. Within six hours, the hashtag #BrownShooting had appeared in over 120,000 posts, a third of which repeated hoax narratives without evidence.
Several accounts appeared linked through identical phrasing and timing, suggesting low‑level coordination rather than random chatter. Parallel threads on Reddit recycled the same talking points, while small blogs framed the event as a government plot to distract from immigration failures.
Yet by then, disinformation had hardened. Some users falsely accused another student, Benjamin Erickson, whose photographs were doxxed online before the Attorney‑General confirmed his release.
◾ 4. Classification
This incident is classified as disinformation.
The key claims, that the shooting was staged or politically orchestrated, are demonstrably false, contradicted by forensic, eyewitness, and law enforcement evidence.
Their persistence despite rapid official correction and the deliberate framing around immigration and state control indicate intent to deceive rather than organic confusion.
Whilst some early misreporting likely arose from genuine panic, the sustained promotion of false narratives over several days shows purposeful manipulation of public uncertainty.
◾5. Tactics and Methods
The chosen platforms reflect pragmatic opportunism.
X offered reach and speed; Reddit provided community echo chambers for reinforcement; and aggregators such as Truth Social re‑amplified claims into politically homogeneous audiences.
The actors capitalised on two technical weaknesses: algorithmic privileging of engagement spikes and the delayed correction cycles of mainstream outlets.
Disinformation spread fastest between 17:00 and 22:00 EST on 13 Dec, during peak user activity, exploiting emotional priming, such as fear, anger, and tribalism, to bypass analytical thinking.
The messaging relied less on sophisticated technology than on psychological precision. Posts used emotive language (‘staged carnage’, ‘crisis actors’) to evoke previous conspiracy archetypes like Sandy Hook or Parkland. These linguistic templates offered instant familiarity for pre‑conditioned audiences. Memes followed within hours, simplifying complex facts into digestible outrage. Despite limited automation indicators, the timing coherence suggests small‑team management as observed with copy‑paste propagation across 50‑80 accounts.
Attempts at narrative correction by Brown University’s official channels met predictable friction. Institutional tone, which is measured, bureaucratic, and slow, lost ground to sensational memes spreading fifteen times faster by engagement count.
◾6. Implications
This event underscores a troubling evolution in domestic disinformation dynamics with the fusion of mass shooting hoaxes with anti‑immigrant framing.
Whilst conspiracy theories around school shootings are not new, the speed with which identity‑based falsehoods emerged demonstrates a shift towards anticipatory control.
The incident shows that actors no longer need verified facts; they pre‑seed emotional anchors the moment news breaks, anticipating whichever storyline suits their ideology once details emerge.
◾Sources