The Belarusian Silovik Telegram Channel: Amplifying Pro-Kremlin Narratives

Understanding the Belarusian Silovik Channel

The Belarusian Silovik Telegram channel, controlled by Belarus’s GUBOPiK agency, amplifies pro-Kremlin narratives, particularly those related to the war in Ukraine. In addition to the Sprinter network, previously identified as the channel’s primary amplifier on X (formerly Twitter), our new research reveals a broader network of accounts echoing its disinformation in Japan, Poland, India, and the United States.

Initially, Belarusian Silovik posed as a platform for Belarusian opposition voices. However, it was actually operated by GUBOPiK, the Belarusian Main Directorate for Combating Organized Crime and Corruption. This agency is notorious for its surveillance and political repression. After establishing credibility under false pretenses, the channel began promoting pro-Kremlin narratives, particularly concerning the war in Ukraine.

In a previous investigation into the Sprinter network, we identified the network's connection to the Belarusian Silovik as the content was aligned and coordinated. This follow-up expands on those findings, focusing on how the channel’s content is being systematically amplified via different accounts on X. Our research, in cooperation with Trollensics—a software for tracking disinformation and hybrid warfare campaigns on social media—identified five inauthentic accounts responsible for nearly all posts referencing Belarusian Silovik on the platform between May 2024 and July 2025.

These accounts exhibit patterns associated with coordinated information operations, including identity impersonation, AI-generated content, and narrative localization. Some accounts adopt national identities, targeting users in Japan, India, Poland, and the United States, while others mimic OSINT organizations to borrow credibility. The findings suggest a structured effort to extend the reach of Belarusian state-linked disinformation beyond Telegram and across multiple online environments.

The ABCDE Framework

A - Actor

Belarusian Silovik is a Telegram channel that we examined in the previous part of the investigation targeting the Sprinter network. @belarusian_silovik is a pro-Russian, Belarusian state-controlled outlet that started as a fictitious pro-opposition platform.

Investigations by Nashaniva and reform.news link the channel to Artur Gaiko, head of GUBOPiK, an agency known for political repression and infiltration of opposition communities. Initially presenting itself as a resistance tool, the channel’s real aim was surveillance and entrapment. It has been sharing identical content as the Sprinter network, which prompted a deeper look into the Telegram channel’s activities.

In cooperation with Trollensics, we have found the most prolific accounts amplifying Belarusian Silovik’s content on X. Trollensics software scraped all posts on X linked to the Telegram channel over approximately a year (20 May 2024 - 11 July 2025) and found 2,398 posts revealing some prominent distributors of the Belarusian Silovik’s content.

Five accounts have accounted for most of the interactions with the Telegram channel.

One such account was @1Gg7Dlct8tfwNJL or Вольвач Юрий (TL: Volvach Jurij). Created in October 2020, this account is responsible for almost half of all posts sharing Belarusian Silovik’s content—1,104 posts in total.

The account appeared suspicious due to its posting patterns and nonsensical handle. The content from this account mostly amplified other accounts similar to, and including, Sprinter-affiliated accounts.

The only valuable online mention of the account name was an obituary for a man named Jurij Volvach (TL: Вольвач Юрий). Jurij passed away in January 2000. He was murdered in Riga, linked to his high standing in a Russian organized crime group, ОПГ бригады Харитонова (TL: OCG Brigade of Haritonov). This was one of the more prominent crime-related murders in Latvia at the time, as the country experienced increased rates of organized crime connected to Russia.

Searching for the profile picture's origin yielded no results, as the reverse image search revealed that the image had been stolen from the original user multiple times, further suggesting the account’s inauthenticity. However, one of the results led to a Russian independent opposition initiative (the identity of the owners is redacted for safety purposes), which aimed to record all instances of Kremlin-owned X bots. This initiative contains a database of over 6,000 bot accounts utilized by the Kremlin. The list includes Twitter accounts used to promote Russian aggression, including propagandists and “forcers” (those who inflate the number of “readers” on Kremlin bot accounts) while excluding official media outlets and their journalists. According to the creators of the list, the algorithm used to detect and log these accounts is configured only to identify bot farms, with an error margin of 1%. Jurij Volvach was listed in the registry as one of the Kremlin-linked bot accounts.

Most of the other prominent accounts identified in Trollensics’ data raise questions about their authenticity. They operate with the same modus operandi as observable with other Kremlin-owned bots, either farming engagement for existing pro-Russian accounts on X or localizing the same content. These localization efforts were present in all five amplifiers identified by Trollensics, targeting Poland, India, Japan, and the U.S..

The account focusing on the U.S. aside, the other accounts present themselves with a strong pro-Russia slant, such as profile pictures, banners, or bios with heavy pro-Russian messaging while maintaining their “localized” names.

However, inconsistencies in their local image exist, especially with the @shoft47ym account. This account seems to have existed for quite some time, with a creation date in 2013. The vast majority of their posts are written in Japanese. However, the profile picture includes the logo of the Wagner Group, a Russian mercenary organization that has carried out military missions worldwide on behalf of the Russian state, including their heavy presence at the beginning of the war in Ukraine. Although private military companies are technically illegal under the Russian Constitution, Wagner has long been believed to maintain strong connections with Russian military and intelligence agencies. These suspicions were confirmed in June 2023 when President Putin acknowledged that the Russian government had fully funded the group’s operations. The account also features a Ribbon of Saint George, a widely recognized Russian military and patriotic symbol used in Russia and some post-Soviet countries.

This account differs from the others previously mentioned, as it often provides polarizing original commentary on political issues. It frequently reposts and discusses content related to the Russia-Ukraine war, with the pinned post being a pro-Kremlin thread featuring graphic war footage. Some of these posts include videos of Russian kamikaze drone footage and corpses of Ukrainian soldiers, with positive endorsements from the author. While the majority of posts on the account are in Japanese, occasional posts in Russian have been found.

Another interesting case is @WSIntelMonitor. This account was first flagged in 2023 by Trollensics. It appears to impersonate a nonexistent American OSINT organization, going under the name WSIntelMonitor at the time of this report’s creation. The modus operandi of this account is eerily similar to that of the Sprinter network. The account publishes news by scraping articles and AI-generated posts to amplify them. It has changed its name multiple times since its creation in 2023.

Once Trollensics software encounters an account, it tracks changes such as bio, followers, number of posts, handle, profile picture, and banner. The following screenshot from the Trollensics dashboard shows all changes made to the account since first encountering it.

The account has long claimed to be an OSINT organization, with one of the previous bios stating, “OSINT Agency monitoring warfare worldwide." Some posts made using Artificial Intelligence (NLP Bot) include a link to support them—https://t[.]co/DIjBetQZzb. No records of any OSINT organizations with such names exist, suggesting a fabricated persona for purposes of borrowed legitimacy.

The t.co link leads to their ko-fi website, presenting a similar crowdfunding system to the Sprinter network, as both Sprinter accounts have urged followers to donate to their Ko-fi or buymeacoffee platforms.

B - Behavior

The five accounts found during this investigation—@WSIntelMonitor, @1Gg7Dlct8tfwNJL, @shoft47ym, @Rajendr67215893, and @MadzGrodno—have been identified as amplifiers, given their extensive referencing of Belarusian Silovik. All of these accounts share a pattern of behavior in reposting and amplifying pro-Russian content at inauthentic rates and localizing Russian disinformation for separate target audiences.

However, the modus operandi differs among some of the accounts uncovered during the investigation. While some accounts (@1Gg7Dlct8tfwNJL, @MadzGrodno, and @Rajendr67215893) act like regular Kremlin-owned sock puppets, with little to no authentic interactions, a lack of original content creation, or sharing nonsensical names, other accounts seem to share similarities with different actors.

@WSIntelMonitor appears to operate similarly to the Sprinter network accounts, which tend to change names and branding frequently to avoid detection. They AI-generate new content scraped from legitimate websites while curating a specific bias, posing as a news monitor or even imitating a non-existent OSINT organization.

The @shoft47ym account seems to focus heavily on the localization aspect of the operation, translating and liaising with other Japanese-speaking users to promote pro-Russian narratives surrounding the Russia-Ukraine war. This account has been known to repost Russian content with Japanese commentary or translate certain materials, suggesting a more sophisticated type of asset.

C - Content

The content uncovered in this operation closely mirrors established pro-Russian narratives, with a strong emphasis on international politics and the Russia-Ukraine war. Most of the accounts highlighted in this investigation act primarily as amplifiers, reposting and recycling content from other disinformation actors rather than producing original material. Despite this, the overall messaging consistently aligns with efforts to polarize audiences through emotionally charged, manipulated, and heavily skewed pro-Russia content. This flood of disinformation is disseminated at scale, following recognizable patterns similar to those observed in networks like Sprinter, which was previously investigated in depth. Both in tone and thematic focus. Additionally, AI-generated material has been documented, including AI-generated retellings of articles or news listings, as well as derogatory AI-generated multimedia content designed to further polarize viewers.

D - Degree & E - Effect

Between 20 May 2024 and 11 July 2025, 2,398 tweets cited belarusian_silovik. Five accounts shared nearly all of the content, and the total number of followers of those accounts at the end of July 2025 was approximately 11,000.

Out of the total tweets citing belarusian_silovik, the biggest offender was @1Gg7Dlct8tfwNJL with 1,104 posts within the given timeframe. The second-highest number of tweets was registered with @shoft47ym, totaling 525 posts. @Rajendr67215893, @WSIntelMonitor, and @MadzGrodno cited belarusian_silovik in approximately 500 cases in total.

Besides belarusian_silovik, the listed accounts have shared Russian-affiliated content from other sources. Most of the accounts were created between 2020 and 2024, and they have produced 300,235 tweets total.

While it is challenging to evaluate the full impact of the amplification network or trace all ties throughout the endless heaps of Kremlin-owned sock puppets, it is important to measure the direct impact of the accounts linked to belarusian_silovik.

Conclusion

The significant improvements in monitoring and takedown mechanisms to combat disinformation at scale remain one of our goals. Our investigation highlights that threat actors, particularly those linked to state-backed operations such as Russia, continue to exploit platform vulnerabilities with ease. These threat actors utilize vast networks of bots to amplify disinformative, harmful, and polarizing narratives.

These campaigns are persistent, coordinated, and effective. However, the ability of the counter-disinformation community to identify and remove every instance of sock puppets and amplification mechanisms is severely limited by resource constraints. For this reason, it is crucial to call on platforms to take more responsibility and adopt proactive approaches to act swiftly upon takedown notices. Without proactive cooperation from those who operate and moderate the platforms that threat actors abuse, we cannot meaningfully disrupt the reach or influence of these operations.