December 23, 2024

Rybar and the Intricacies of Researching Russian Disinformation

The DoJ stated that Russian military Rybar has links to state-backed disinformation campaigns. We did some cross-platform digging.

TLDR

The US Department of Justice (DOJ) has linked the Russian media entity Rybar to disinformation campaigns targeting Americans.
Rybar has shared military reporting under its own name on a variety of popular platforms in the Russian media sphere. Among these platforms are Telegram, VK, and RuTube.
The DOJ links Rybar to a handful of hashtags, including #HOLDTHELINE. Researchers found over 67,000 mentions of #holdtheline across sites popular with the American right – Truth Social, Gettr, and Gab – from 2020 through 2024.

Background

In October 2024, the US Department of Justice (DoJ) released a statement seeking more information on Rybar and its employees. Rybar is described by the DOJ as a Russian media organization behind various disinformation campaigns.¹

Rybar has its origins as a Telegram channel sharing detailed news updates about Russian military operations. According to the DoJ release, Rybar has previously been funded by the late Russian oligarch Yevgeniy Prigozhin, who funded and led the infamous Russian private military company the Wagner Group. Prigozhin was killed in a suspicious plane crash in Russia in August 2023, months after leading the Wagner Group rebellion against the Russian government.

The DoJ report specifically mentions that Rybar “manages the propaganda social media channels #HOLDTHELINE and #STANDWTHTEXAS [sic] to promote Russian government political interests in the United States.” Open Measures researchers interpreted this to mean that Rybar has helped popularize and amplify those hashtags and the sentiments surrounding them.

Rybar as a Military Blog

The Rybar media organization appears to have originated from a Telegram channel sharing detailed news updates about Russian military activity. The creators were originally anonymous, which is unusual among Russian military bloggers. Later, in 2022, their identities were exposed by Russian news organization The Bell.²

According to The Bell’s investigation, the creators are Denis Shchukin and Mikhail Zvinchuk. Zvinchuk is also one of a handful of individuals mentioned in a DoJ tweet on the subject,³ though Open Measures has not independently verified this attribution.

Rybar posts military reporting under its own name on Telegram, VK, and RuTube, three particularly popular platforms among Russian-speakers. Telegram is a peer-to-peer messaging platform that also allows users to share messages at scale by creating large groups. VK is a massive social media platform like Facebook, popular among Eastern Europeans. Finally, RuTube is a YouTube-like Russian video sharing platform. ⁴ ⁵

Rybar first became active on Telegram in early 2018. At the time, the channel posted geopolitical topics including the war in Syria, the Israel-Palestine conflict, and US news stories. It became increasingly active in late 2019, maintaining high levels of activity since Russia’s Feb. 2022 invasion of Ukraine. At the time of publication, Rybar’s Telegram channel boasts over 1.3 million followers. To explore this data, researchers can search our Telegram dataset in the Timeline tool using the Advanced query (channelusername:rybar).

rybar hashtags on telegram — *Posts in the Rybar Telegram channel from Jan. 2018 through Nov. 2024. Each datapoint represents one month’s worth of posts.*

Over the years, Rybar has also expanded to other media platforms. In July 2022, just months after the invasion of Ukraine, Rybar began posting videos about Russian military news to RuTube. According to information on their profile on RuTube, the channel has over 38,000 subscribers as of November 2024. To access this information, researchers can search the RuTube dataset in the Timeline tool using an Advanced query (author.name:”Рыбарь”).⁶

rybar hashtags on rutube — *Videos posted from Rybar’s RuTube channel from Jan. 2022 through Nov. 2024. Each datapoint represents one month’s worth of posts.*

Rybar is active on VK as well and styles its name in Cyrillic (Рыбарь). Rybar’s RuTube profile and URL slug—the last part of a URL identifying a specific page is /rybar_force. To find more information about Rybar’s activity on VK, researchers can use the Advanced query (author:rybar_force) in our Timeline tool. Rybar only became active on VK in 2024; the profile existed in 2023, but only had five total posts.

rybar hashtags on VK — *Posts by Rybar on VK from Jan. 2024 to Nov. 2024. Each datapoint represents one month’s worth of posts.*

This look into Rybar’s footprint operates as a case study into the Russian-language infosphere. Rybar started in 2018 as a small Telegram channel before gaining prominence and picking up over a million followers. In 2022, it expanded its media footprint beyond Telegram by publishing videos on RuTube. Finally, in 2024, it expanded once more on VK.

This progression is a glimpse into how media organizations in the Russian media infosphere can develop reach. Rybar’s case shows that Telegram channels can start small to generate momentum. Later, these channels can expand into video production and posts on other channels.

Rybar as a Propaganda Outfit

The US DoJ asserts that Rybar has carried out disinformation campaigns at the direction of the Russian government. Independent Russian news outlet The Bell reported that Rybar had likely received funding from the infamous Internet Research Agency. This now-defunct organization has also been linked to Prigozhin.⁷

Such linkage spotlights some of the challenges researchers encounter when analyzing Russia-based entities. One stark example is Kaspersky, an anti-virus software company that was banned by the US Bureau of Industry and Security in June 2024. Is Kaspersky an independent company or has it been co-opted by the Kremlin?⁸ Russian cybercriminals also occasionally operate in ways that imply direction from the Russian government—take, for example, that researchers found that the Trojan horse malware GameOver Zeus was “looking specifically for information regarding Foreign Intelligence services in Georgia, Turkey, and Ukraine” – an action that notably does not align with the activities typical of a financially-motivated cybercriminal gang.⁹ Research has established that Russian nationals were behind GameOver Zeus.¹⁰ Finally, these seemingly government-directed activities only ever exist for a limited period of time, making accurate analysis even more difficult.

With this disclaimer aside, the DoJ has clearly stated #HOLDTHELINE and #STANDWITHTEXAS are linked to Rybar. Still, it should be noted that the DoJ does not explain the exact relationship. The DoJ has also stated that Rybar’s goal is to promote “Russian government political interests” and “sow discord, promote social division, stoke partisan and racial discord, and encourage hate and violence in the United States.”¹¹ Finally, Open Measures’ researchers have found both of these hashtags shared widely on alt-tech platforms popular among the American right.

#HOLDTHELINE

For this investigation, we started by using the “Search All Datasets – Time Series” dashboard in Open Measures’ Research Dashboard. Our analysts searched for mentions of “#holdtheline” over a two-year period spanning Dec. 1, 2022, to Nov. 31, 2024. The results showed the hashtag on various platforms, though some of the standouts by volume of mentions were:

Truth Social (8,800+ mentions)
Gettr (5,100+ mentions)
Gab (3,600+ mentions)

Researchers found that the #holdtheline hashtag has been consistently popular over time on these three platforms (with notable peaks and valleys).

Our researchers first looked at mentions of Rybar on Gab, a Twitter-like social media platform popular among the American right. Researchers searched for (content:holdtheline) using the Timeline’s Advanced search query function.

rybar hashtags on gab — *Results for mentions of “holdtheline” on Gab from January 2020 through Nov. 2024.*

Mentions of “holdtheline” were far and away the highest in 2021 and early 2022. However, there were also 394 mentions on Gab in 2023 and 788 for the first 11 months of 2024. These mentions also increased ahead of the 2024 US Presidential Election on Nov. 5, 2024. To demonstrate this, we ran another search from Aug. 2024 through Nov. 2024 and broke the results down by week.

additional rybar hashtags on gab — *Results for mentions of “holdtheline” on Gab from Aug. 2024 through Nov. 2024.*

Researchers also found data on Truth Social and Gettr that reflected a roughly similar trend.

Conclusion

The Russian media entity Rybar has an online presence across various popular Russian platforms including Telegram, RuTube, and VK. Independent Russian media outlets have linked Rybar to the notorious Internet Research Agency, known for its disinformation campaigns.

The DoJ also stated that Rybar carries out disinformation campaigns for the benefit of Russian government interests. The organization listed #HOLDTHELINE as one hashtag of interest in these campaigns. However, the hashtag has also been used on various alt-tech platforms popular with the American right.

This close look at Rybar’s activities offers context for further research. However, it also illustrates the unique difficulties of accurately investigating Russian disinformation.

Identify disinformation and extremism with the Open Measures platform.

Organizations use Open Measures’ tooling every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.