Evolution of the Russian information warfare in the wake of the invasion of Ukraine

Not only was the full-scale invasion started by the Russian Federation against Ukraine, launched on 24th February, 2022, a turning point in the geopolitical contest between Russia and the West, but also a catalyst for significant changes in the concepts and practices of Russian information warfare; these changes concern both a recalculation of operational means and an accelerated institutionalization of mechanisms of control and adaptation under conditions of intensified external countermeasures.

Before 2022, the Russian informational concept, framed in official documents such as the Information Security Doctrine, viewed the information domain as an integral component of national security, requiring defensive and offensive measures, narrative, technological and legal, aimed at defending informational sovereignty and influencing the decisions and perceptions of adversaries. That document formalized a broad notion of the information space encompassing communication systems, media and digital resources, which prior to the invasion provided a theoretical justification for conducting coordinated influence campaigns. 

In Russian military and strategic thought, the idea of combining military and non-military means was further popularized by the work of the officer corps, a classic reference is General Valery Gerasimov’s 2013 article, which described the blurring of the lines between war and peace and the necessity of employing various forms of influence in a new generation of warfare, a conceptual contribution that prepared the apparatus to conduct large-scale information operations.

However, practical battlefield experience in Ukraine quickly exposed the limitations of these assumptions and forced adaptations. The Kremlin’s first surprise was the level of resilience in Ukrainian society and the ability of Kyiv’s authorities to carry out efficient, credible real-time communication; an example is the daily presence of Ukrainian leadership on social media, the use of short authentic messages and narratives of resistance that gained international resonance and thereby weakened the ability of Russian state media to rapidly shape the picture of events.

As a result, the rapid victory effect in the information sphere envisaged by Russian leadership was not achieved, and delays and mistakes in military operations further undermined the credibility of parts of the Kremlin’s narratives.

A second area of upheaval was the international reaction and the networks of private technology platforms: restrictions and blocks imposed by Western institutions and actions by social platforms against pro-Russian content (including suspensions and broadcasting restrictions on state media such as Russia Today and Sputnik within the European Union) caused traditional channels of state propaganda to cease being as effective outside Russia, which forced the search for alternative, harder-to-moderate transmission paths.

Consequently, Moscow accelerated a twofold strategy: first, it strengthened the instrumentalization of the domestic information space (legal and technical control mechanisms), and second, it intensified external operations, moving to a multichannel model that combines state media, intermediary networks, messaging platforms and proxy actors in the global South.

Domestically, the most significant and swiftly implemented change was legal regulation criminalizing the dissemination of false information about the actions of the armed forces and the discrediting of the use of the military, which in practice enabled the penalization of journalists and critics and narrowed the space for independent fact-checking; these legislative acts of March 2022 and subsequent tightening of laws (including instruments for confiscating the assets of persons convicted for false facts concerning the armed forces) became part of a mechanism securing the state narrative while simultaneously signaling that information is also to be used as a tool of social consolidation during a protracted conflict.

Parallel to a repressive legislative apparatus, there was technical sealing of the domestic internet: Russia continued to implement rules and framework mechanisms known under the slogan sovereign internet, which legally and technically increase the ability to disconnect the national network from global traffic, thus allowing the state to selectively control information flows and limit the influence of external platforms at critical moments. For Kremlin strategists, this legal-technical combination was a necessary condition for waging an information war at a time when traditional external instruments were being constrained.  

On the external front, adaptation took the form of diversifying influence channels and greater decentralization of narrative operations. As official broadcasters lost reach, pro-Russian campaigns began to use smaller platforms, regionally financed portals, messaging apps (Telegram) and networks of proxy influencers: media personalities and groups of ostensible independence that amplified pro-Russian content in a manner harder to link to Moscow. 

Telegram, due to a lack of effective moderation and the nature of one-way communication channels, became one of the key battlefields of the information war, both inside Russia and in occupied areas; research shows that this platform functions as a distribution channel for disinformation and facilitates micro-targeting of audiences.

An important element of maturation in the Russian operation was also an orientation toward audiences beyond the West. Moscow increased promotional efforts directed at states of the Global South, emphasizing anti-colonial, anti-Western and economic narratives that find greater resonance in those contexts and allow circumvention of barriers imposed by Western platforms. In this sense, Russian information warfare transformed from a unified, centralized message into a dispersed system of influence, capable of multilayered impact on different social and national groups. 

A third dimension of adaptation is a stronger integration of cyber operations with disinformation campaigns. Experiences from the conflict showed that digital operations: disruptions of communications (e.g., the attack on the Viasat satellite network), destructive malware targeting energy infrastructure (use of variants such as Industroyer/Industroyer2), or DDoS campaigns; are most effective when synchronized with targeted narratives that create information chaos and undermine citizens« trust in the state and its defensive capabilities. 

Examples from the war’s early months confirm that cyberattacks were used as preparatory and supporting means for psychological operations, and their political effect was significant, especially where they caused real disruptions to everyday life. Additionally, the conflict served as a testing ground for techniques based on artificial intelligence and generative models, from creating manipulated video materials (so-called deepfakes) intended to discredit Ukrainian leadership or sow confusion, to automating botnets that amplify certain narratives; although many early uses of deepfakes were low-quality and had relatively limited effect, the experience showed that AI can significantly lower the cost of producing false content and increase the scale of impact, which poses new challenges for fact-checking mechanisms and rapid debunking. 

Another lesson from Ukraine was the importance of authenticity — content that appeared authentic, rapid battlefield reports and emotional narratives had an advantage over artificially generated messages; this means that Russia had to not only produce more content but also refine methods of presenting it as moderately authentic, using local actors and adapting messages to the language and sensitivities of particular communities.

From an institutional perspective, the war prompted an accelerated reorganization of the apparatus responsible for information activities: an expansion of structures connecting security services, ministries, state media and private entities providing information services, so as to create a network effect and a model of operations harder to dismantle. At the same time, limits of this strategy appeared: the internationalization of campaigns and the increased field of vision of Western intelligence services and OSINT analysts caused many operations to be revealed and exposed relatively quickly, which undermined their long-term credibility and forced continuous tactical adjustments. 

In summary, the experiences of the full-scale war against Ukraine forced the Russian Federation to substantially revise the concepts and practices of information warfare: from a centralized, propagandistic strategy toward a more complex, hybrid and multichannel model combining repressive instruments of domestic control, technical mechanisms of network sovereignty, diversified external campaigns and tight integration of cyber and psychological actions.

Such adaptation increases the flexibility and resilience of Russian information operations, but simultaneously reveals new limitations related to technological countermeasures by platforms, international coordination of counter-campaigns and the need to maintain internal legitimacy in the face of rising costs of the conflict — which makes the future information landscape more complex and harder to predict, while confirming the central place of information in the Kremlin’s geopolitical strategy.

Author: Agnieszka Rogozińska, PhD