Ukrainians hack Russian Defence Ministry's propaganda department and show how it works

Ukrainian hackers have infiltrated the Department of Information and Mass Communications (DIMC) of the Russian Ministry of Defence, headed by Igor Konashenkov, and gained access to the Russian media monitoring and analytics system Katyusha.

Source: InformNapalm (IN) intelligence community with reference to Cyber Resistance hackers

Quote from IN: "Employees of the department and the press services of the military districts and fleets under its control are constantly analysing the Russian information field. Everything that is directly or indirectly related to news about the activities of the Russian Armed Forces is reflected in various reports. The publications of foreign media are analysed separately." 

Details: InformNapalm published examples of "daily media reviews" prepared by the department. The community reports that a weekly report on the number of materials produced and the pace of plan implementation is sent to its head, Konashenkov, for approval.

Later, this document is sent out along with the Russian Armed Forces’ planned information events for the next week and a weekly report on the print media outlets to all heads of press services of districts, branches of the armed forces, fleets, etc.

The Katyusha online monitoring information and analytical system is used to collect information on media activities. InformNapalm reports that hackers gained access to this system and were able to analyse its properties.

Quote from IN: "For those who know about media monitoring systems, Katyusha is a system that is a kind of Russian analogue of SemanticForce (a platform for media monitoring and analytics - ed.).

The developer is a M13 private company. They claim to specialise in information technology in the field of media monitoring. They have three systems: Arsenal, Arena and Katyusha. 

Their software is used by the Russian presidential administration, the government, federal ministries and agencies, regional state executive bodies, commercial companies and non-governmental organisations. In 2021, the Russian Ministry of Defence purchased a licence to use Katyusha, allocating RUB 320 million (US$ 3.6 million) for this purpose until 2023 inclusive."

More details: According to the developer data, Katyusha's database includes 40,000 sources: Russian federal and regional media outlets, foreign Russian-language media outlets and "key" foreign media outlets. 

The developer claims that the system allows classification of information by time, topics, headings, named objects and types of media; assessment of the quality of information by tone and audience coverage; the possibility of monitoring key Russian print media; monitoring of both traditional media outlets and new media (social networks); display of the main news events of the day, week or selected period; and detection of coordinated information attacks.

Weekly and monthly reports on foreign media are also being added to the system.

At the same time, Katyusha displays posts published on Vkontakte, Telegram, LiveJournal, Odnoklassniki, etc. in real time. It also adds Facebook and Instagram, but in a small amount. Videos from YouTube, including Ukrainian YouTube channels, are also recorded.

Quote from IN: "However, when analysing this system, we came to the conclusion that Katyusha is a kind of Potemkin's village (is a construction whose purpose is to provide an external façade to a situation, to make people believe that the situation is better than it is - ed.). Obviously, the Russian Defence Ministry's DIMC uses it for reporting purposes. 

The system clearly incorrectly reflects the tone of the messages. Negative messages about the Russian Armed Forces and the military and political leadership of the Russian Federation are either not taken into account or marked as neutral. It's a kind of euphemism": ‘everything is fine, beautiful marquise’ [it is usually said when someone wants to hide the true state of affairs - ed.], no negative about the charming Putin or the army, no failures. It's a kind of digital Konashenkov – there are no losses."

More details: In addition, as InformNapalm notes, the system analyses mainly the Russian information space. Western and Ukrainian media outlets are present in the database, but they need to be searched manually. The "overall picture" is not affected by Ukrainian and Western sources, and any analysis is mainly based on Russian censored and self-censored sources.

Thus, according to InformNapalm, the value of such a system is only in reflecting the Russian information reality: an extensive network of controlled media, coordinated information waves and total censorship are clearly visible.

There was also negative news in the system. However, the extensive Russian propaganda system throws dozens of positive news pieces at one negative news piece.

Cyber Resistance hackers also found a letter from Konashenkov to Shestakov, Deputy Director General of All-Russia State Television and Radio Broadcasting Company (Rossiya-1 and Rossiya-24). It mentions "unreliable" Russian Telegram channels. The hackers did not get the app itself with a list of these channels. However, as can be seen from the internal system of the Russian Ministry of Defence's DIMC, Russian military propagandists segregate reliable and unreliable Telegram channels. 

InformNapalm notes that Konashenkov's letter regarding "unreliable" channels is dated 14 November, a day after Russian media reported a "goodwill gesture" by the Dnipro group of troops in Kherson Oblast.

Then the Russian media published and soon "cancelled" the news of the retreat of Russian troops. Ukraine claimed that this was a Russian information operation and there is no sign of any Russian preparation for retreat.

Thus, according to InformNapalm, it was an attempt to "catch" unreliable Telegram channels.

Support UP or become our patron!