Before the war broke out, Igor Kurayan, a 55-year-old from the southern Ukrainian port city of Kherson, shared frequent gardening updates on social media. His feeds were full of palms, pomegranate trees, marigolds, bamboo and avocados, grown at his home and small business near the Black Sea. He called it his “fairytale garden.”
On February 25, a day after Russia invaded Ukraine, Kurayan posted a selfie on Instagram with a rifle, announcing he had volunteered to fight in the Territorial Defense Forces, reserve units of Ukraine’s military. Soon after, Kherson fell to Russian troops and in early April, after weeks living under and protesting against their occupation, Kurayan was abducted. He was watering plants in his shoe store when he said Russian soldiers dragged him outside and threw him into a van.
Soon after Kurayan’s kidnapping, his Facebook and Instagram pages, and a new TikTok account registered under his name, began posting messages entirely out of character for the man known to family and friends as a proud Ukrainian, a passionate activist and avid gardener.
At first, Kurayan’s captors painted him as a patriot, posting old photos from his time running supplies to Ukrainian soldiers on the front line in Donbas, where Russia-backed separatists have been battling Ukraine’s government since 2014.
Then strange videos started to surface. In one, Kurayan looked gaunt and ashen, flanked by two armed, masked men holding the blue and yellow Ukrainian flag and a red and black flag associated with the Ukrainian nationalist movement. He said that Kherson was occupied and rallies were pointless, adding that the Territorial Defense there had disbanded. In another, he denounced Ukrainian President Volodymyr Zelensky’s government and called on his countrymen to surrender.
“I think that further resistance is useless,” said Kurayan in the clip, which was shared across his social media accounts and aired on Russian state TV. Standing in front of a cache of weapons, his hands bound, he said he had been part of a plot to attack Russian soldiers and free activists, but that he’d given up, adding: “I suggest that all fighters of the Territorial Defense surrender their weapons.”
“They started to use my father’s social media. They saw he was active on Facebook … They registered him on TikTok — my dad does not even know what TikTok is,” Kurayan’s daughter, Karyna, a 23-year-old journalist who left Ukraine after the war began, told CNN. “They wanted to make a puppet out of him.”
Karyna provided the videos and screenshots of posts made on her father’s original social media accounts to CNN. The posts, which she shared with Ukrainian authorities, were removed by Kurayan after his release.
Kurayan, who was freed in a prisoner exchange in late April after nearly a month of detention, is one of several Ukrainians to be abducted from occupied areas of the country’s southeast in recent months and then sucked into the Kremlin’s propaganda machine. Some of their social media pages have been used to promote pro-Kremlin talking points, while others have appeared in staged TV interviews in support of Russian President Vladimir Putin’s war.
Speaking with CNN on an encrypted video call, Kurayan said that Russian soldiers alternated between torturing him for information — twisting his fingers with pliers and beating him bloody with a truncheon — and using his iPhone to access his social media accounts, sharing images portraying him as a hero-turned-traitor. “They started using these photos to play their game,” Kurayan said, adding that his captors showed him how they were hijacking his accounts, taunting him. “They used my Facebook, my Instagram, and TikTok, which I didn’t have, they made a page there.”
“The Russians offered me to betray Ukraine, to cooperate with them. They first wanted to show, ‘look here is a patriot, and then he betrayed his country,’” Kurayan added, describing how his captors had articulated the arc of their strategy in using his social media. “They said, ‘you are a very famous person in Kherson … we want to make you mayor.’”
CNN has reached out to TikTok for comment about the account created using his name, which is still active. Nothing has been posted since April 24, four days before his release.
As the war in Ukraine stretches on, the battle for hearts and minds is entering a new phase. Moscow is shifting its strategy from a national to a local level, attempting to bring Ukrainians living in occupied territories onto Russia’s side. But after struggling to find willing collaborators, it has resorted to new tactics.
“In the beginning, in the blitzkrieg phase, Russia’s propaganda machine was working on the national level — now these efforts are localized, they’re trying to convince local people, particularly in occupied areas, that Ukraine has abandoned you,” Mykola Balaban, deputy head of the Centre for Strategic Communications and Information Security (Stratcom Centre UA) under Ukraine’s Ministry of Culture and Information Policy, told CNN.
“In the case of Igor and many others, they use this content inside of Russia too, to show, ‘look this Ukrainian he was an activist, pro-Ukrainian, but now he understands, we show him what is the real situation and now he is pro-Russian, and he understands what we are fighting for.’”
The Kremlin meanwhile has repeatedly accused the West of disseminating falsehoods, with Russia’s UN Ambassador Vassily Nebenzia claiming in May that countries that call themselves a “community of democracies” were building a “cyber-totalitarianism” and, along with technology giants like Meta, marking any alternative viewpoint as “propaganda.”
Putin’s information war shifts
More than any other country, Ukraine has borne the brunt of Russia’s so-called “hybrid warfare” — an insidious blend of disinformation campaigns, cyber attacks and ground combat. Ever since the Euromaidan revolution in 2014, which transformed Ukraine’s political landscape and society, ushering in closer ties with the West, it has been Moscow’s chief target.
The Internet Research Agency (IRA), the notorious Kremlin-linked troll factory that whipped up discord in the 2016 US presidential election, used Ukraine as a testbed for its tactics for years. But, following revelations of Russian interference in the election, tech giants like Facebook and Twitter have stepped up efforts to crack down on coordinated inauthentic activity.
As a result, Russia has come to rely increasingly on what experts call “information laundering,” legitimizing false or duplicitous narratives through a network of pro-Kremlin actors, journalists, activists and other proxies — a practice known as “dzhynsa” in Ukrainian (a reference to money being kept in a jeans pocket for illicit dealings).
Since Russia’s invasion, hackers have broken into social media accounts and telecoms networks of trusted sources in Ukraine — government officials, media outlets, Ukrainian soldiers and civilians — to spread false messages that Ukrainian troops were surrendering and, more broadly, to sow confusion. Meta, Facebook’s parent company, said in April that it had traced one campaign targeting Ukrainian military officials to state-sponsored group of hackers in Belarus known as Ghostwriter. It also said its systems detected and thwarted attepts by a network linked to the IRA to return to Facebook.
Governments are hitting back too. In May, UK-funded research claimed that a new Russian troll farm allegedly operating out of an arms factory in St. Petersburg — with suspected links to Yevgeny Prigozhin, a key Putin ally and the man believed to be behind the IRA — was hijacking discussions on social platforms, including Facebook, Twitter and TikTok, targeting world leaders’ accounts and promoting pro-war messages. The British government said it had alerted platforms to the activity, and that the evidence would help root out Russian influence operations.
Against this backdrop, Russia is having to find fresh strategies. Now its forces are seeking out real people to promote their narratives — whether they’re willing or not.
“They can capture real people and do whatever they want with their social media, this social mirror of this real person,” said Balaban, who has been tracking Russia’s disinformation strategies for years — first as a historian, then as a soldier and now as a government official. “Of course, when you’re talking about resources, it’s much more expensive and complicated, because you need special people to work with these captives, like Igor Kurayan, it’s not as simple as fake accounts and bot farms.”
Balaban’s Stratcom Centre UA collaborates closely with fact-checking and civil society groups to track the social accounts of Ukrainians at risk of kidnapping, influence operations and hacking. As part of this work, the centre also manages a database of Ukrainian official sources, which it regularly shares with Meta and other social networks for monitoring purposes.
CNN has identified at least five abducted Ukrainians whose Facebook accounts were used to spread messages in support of Russia’s war, or appeared themselves in propaganda videos shared across social networks. All were public figures — prominent local activists, officials and veterans. All except for Kurayan remain missing, according to their friends and families.
The cases, while concerning, do not appear to constitute a trend, according to Meta.
The company announced several safety features for users in Ukraine in response to the war, and has encouraged those likely to be targeted to install two-factor authentication.
‘Russian media is 100% a lie’
As it turned out, Russia’s propaganda saved Kurayan.
After he was transferred from a basement in Kherson to a barracks in Sevastopol, Crimea, Kurayan was filmed in a report on Ukrainian prisoners of war. In it, he appears for a moment, sitting among other detainees gathered together in a room to watch Russian state TV. Many avoid looking at the film crew, some with their heads in their hands.
The footage was aired on several Russian channels, including state-owned NTV, which described the “good conditions” at the barracks and claimed that prisoners “want the war to end, to live in peace.”
Days later, in a surreal, through-the-looking-glass scene, Kurayan said that he was in the same viewing room, when he saw himself appear on the screen. “When I was in Sevastopol, I saw these Russian channels, we were forced to watch them. All the information from the Russian media is 100% a lie,” he said. “But thanks to this report, I was released.”
Some of Kurayan’s relatives in Transnistria, a breakaway region on Moldova’s border with Ukraine, which is allied with Russia, recognized him in the footage, took a screenshot and sent it to his daughter, Karyna.
“We saw dad there, and we understood exactly where he was. Then I collected all the materials, screenshots (from social media), everything that I had, all the information and submitted it to the (prisoner of war) hotline,” Karyna told CNN. After days of silence, her phone rang. It was Ukraine’s Deputy Prime Minister Iryna Vereshchuk, who was in charge of negotiating prisoner swaps at the time, calling to tell Karyna that her father was being released, she said. “I’ve never been so happy,” she added.
CNN has reached out to Vereshchuk’s office, as well as the Main Directorate of Intelligence, which now manages prisoner exchanges, and the Security Service of Ukraine (SBU), which runs the hotline, for comment. The SBU told CNN in a statement that it could not comment on specific cases.
Before the war began, the United States government warned in a letter to the United Nations that it had “credible information” Russian forces had compiled a list of Ukrainian citizens, including activists and journalists, to be kidnapped and tortured, or killed.
For this reason, many people living in occupied territories don’t leave home with their personal phones, using burner devices where possible instead. Kurayan didn’t have his iPhone with him when he was kidnapped, but after days of torture, he said he told his captors where it was hidden.
“Russian military try to get control over devices (of activists, local influencers, public figures), to check their social media accounts, they see the value of that … to see what people are publishing, to see how influential he or she might be, but also to check identity,” Yevhen Fedchenko, co-founder and editor-in-chief of prominent Ukrainian fact-checking organization StopFake, told CNN.
“I know that I’m on their wanted list. If they can grab ahold of me they would use me for the same purposes, to disseminate propaganda … or just be eliminated,” he added.
For Fedchenko and others on the frontline of Russia’s information war, the Kremlin’s strategy is nothing new. The information vacuum and climate of fear created in occupied territories is a tactic Moscow used in 2014, when it annexed Crimea and fomented a war in Ukraine’s east.
But this time around, Ukrainians have become hardened to these tactics — ready to call them out or even counter them online.
When Kurayan regained control of his social media accounts and started sifting through posts, it was discomfiting to read what his captors had written, posing as him. But, he said, as he scanned the comments it became clear how ineffective their strategy was.
“I read how my friends reacted to these videos. And they commented on them immediately, knowing it was the Russians,” he said, laughing. “They realized it wasn’t me.”
Eliza Mackintosh wrote and reported from London. Yuliia Presniakova reported from Lviv.