A Polish tragedy, repackaged for every audience
Prosecutors in Kraków say they cannot yet name the gunman’s motive. Online, by Sunday evening, he had already been a Ukrainian mercenary, a Polish soldier, a left-wing marcher and a minister’s friend. Poland’s disinformation institute reported 2,000 accounts to the platforms within a day, and its minister says Russian bots amplified claims that started at home.
Also in this issue: an Iranian operation posed as climate journalists for years before turning on France’s high school protests, the bomb threat that emptied RTÉ is traced to a school email account in Lithuania, a pro-Moscow candidate in Moldova reports to police the TikTok accounts that promote him, and graduates of the Kremlin’s blogger school are losing their Telegram audience to the state’s own messenger. Welcome to issue 25 of Narrative Ops.
After the Kraków shooting, false claims about who was behind it passed 200 million views in a day
On Saturday 7 November a gunman opened fire in the Old Town of Kraków, in southern Poland, killing six people and injuring 15. The attacker, a 24-year-old Polish citizen also suspected of killing three members of his family, was shot by police and died in hospital two days later. Prosecutors say they cannot yet establish his motive.
False versions appeared within tens of minutes, the digital affairs minister said. The biggest one, by the ministry’s count, claimed that the Polish government had staged the attack with the EU’s help, and it may have reached up to 200 million views on Saturday. The claim that the attacker was a Polish soldier reached nearly 18 million people before the defence minister denied it, and the claim that the police had been sent to guard protests in Warsaw up to 14 million.
Photos from the arrest showed the attacker in military-style clothing with several patches, and each patch was turned into proof of who he was, Gazeta Wyborcza found. Pro-Russian accounts said a pirate skull on his vest was the emblem of a foreign mercenary unit fighting for Ukraine, but the same patch sells online for a dozen or so złoty. Others said a round badge on his sleeve showed he served in a territorial defence brigade, but it was a tourist badge from the Łysica hill, and the defence minister said he had never been a soldier. A green sign on his T-shirt was read as the logo of a nationalist group, and it turned out to be an emergency exit pictogram. The political versions followed: a photo of a different man at an anti-racism march was shared as proof he was a left-wing activist, including by an adviser to the president, and a district councillor posted an AI-made image of him shaking hands with the interior minister. An AI-animated video in which he appears to announce the attack was viewed more than 2 million times.
The claim that he fought for Ukraine spread furthest. On Saturday evening it appeared on Shot, a Telegram channel owned by a media group close to the Kremlin, which wrote that investigators were checking his links to Ukraine’s foreign legion, and Belarusian state radio repeated it an hour later. From there, OKO.press traced the same claim to news sites in Bulgaria, Greece and Spain that local fact-checkers had earlier identified as spreading Russian propaganda, and then to portals in China and a Vietnamese Facebook page, which reported it as fact. The main proof offered online was a Telegram channel in the attacker’s name, with a Ukrainian flag as its picture, that seemed to show him with a gun days before the shooting. DW’s fact-checkers opened the channel’s edit history: the post had been edited on Sunday morning, after his arrest, and the photo was made with AI. Another popular post showed a car boot full of weapons and said it was the attacker’s car, but the car belonged to the city guard, which had collected his equipment.
Within 24 hours NASK, the state institute that tracks disinformation, reported more than 2,000 accounts to the platforms, and 4,795 posts by Tuesday. The minister said Russian bots and trolls had amplified narratives that began at home and that Polish politicians had raised their reach, while stressing that this does not settle who runs the accounts. At least five people have been detained over posts about the attack that police judged dangerous, and a deputy minister said X had not answered a single report.
Iran ran a French climate news site to attack France over its school protests, VIGINUM finds
Tired Earth presents itself as a French-language news site about the environment, and for years its contributors have posted about the climate and the planet, including the kind of cute animal pictures that draw clicks on social media. In September 2024 its logo appeared for a few days among the official partners listed on the website of the Nice Climate Summit.
A confidential report by VIGINUM, the French agency that tracks foreign digital interference, describes the site as fake and attributes it to an Iranian interference operation, France 2’s investigative programme L’Œil du 20 Heures reported on 10 November. According to the agency, the environmental theme gave the operation credibility, because a climate journalist arouses less suspicion than an open supporter of the Iranian government. Alongside the climate posts, the site’s contributors have published messages attacking France, and since October they have concentrated on the violence around the country’s high school protests.
Some of the site’s articles were copied word for word from other outlets, among them an interview with the sailor François Gabart taken from the weekly Le Nouvel Obs. Three people presented as its collaborators have profile pictures flagged as AI-generated, and France 2 could not reach any of them.
The report was broadcast a day after France blamed Iran for an October cyberattack on the refrigeration systems of about 700 grocery stores, butchers and food plants, which caused at least 15 fires and large losses of spoiled food. The French cyber agency ANSSI attributed it to a unit of the Revolutionary Guard Corps, the foreign minister announced it at a G7 meeting in Paris and summoned Iran’s ambassador, and Paris prosecutors asked for international arrest warrants. Iran’s foreign ministry rejected what it called unfounded accusations. The EU’s diplomatic service said it was ready for a “swift and united” response, including sanctions, and the French government said it is ready to act against any hostile action by Iran.
The bomb threat that emptied RTÉ came from a hacked school account in Lithuania, checks suggest
On Tuesday 3 November at least seven flights in Europe received bomb threats, and on Thursday at least 27 more did, on routes to and from 16 countries. Every plane landed safely and no explosives were found, but each threat set off the full emergency procedure: fighter jets escorted airliners over France, Italy, Bulgaria and Croatia, and an Aer Lingus flight from Dublin to Rome was diverted to a French military air base. The threats sent to airports in Rome and Milan claimed to come from “fighters of the Male State”, a Russian anti-feminist movement whose founder says it no longer exists.
At 8.33 on Friday morning an email headlined “MESSAGE TO THE WEST” reached publicly listed addresses at media organisations in Ireland and Britain. Its sender claimed responsibility for the flight threats and said a device had been planted in the recipients’ buildings. RTÉ, Ireland’s public broadcaster, evacuated its offices and suspended programming, and Bulgaria’s Nova TV received the same message.
The email RTÉ received came from an address at a school in Lithuania, and the technical data in the email shows it was sent through the school’s own mail system, which makes a simple forgery of the sender address unlikely. A former detective in Ireland’s cyber crime bureau found that the account’s password had appeared in at least two earlier data leaks and assessed that someone had most likely used the real account without its owner’s knowledge. RTÉ has asked the school whether it is aware of any unauthorised access.
More hoax emails arrived in Ireland on Monday and Tuesday. The police commissioner said the senders hack into email accounts, usually from outside the country, and that their aim is to “sow discord”. The Irish government called it a likely coordinated campaign of disruption but does not know who is behind it. Irish security services consider it “credible” that Russian intelligence is responsible, the Irish Examiner reported, while acknowledging that they have no evidence yet. Dublin hosts a summit of about 50 European leaders on 12 November.
Russia trained 1,700 bloggers to work on Telegram. Its own push to the MAX messenger has since cut pro-Kremlin channels’ views by 41 per cent.
In May 2021 a free training programme for journalists, bloggers and PR specialists opened in Russia under the name Workshop of New Media. It was set up on the initiative of Sergei Kiriyenko, then deputy head of the presidential administration. Novaya Gazeta Europe, an independent Russian outlet working from exile, has traced what became of its graduates.
The course runs in modules of five or six days, from 8 a.m. to 11 p.m., and lecturers have included the TV host Vladimir Solovyov and RT’s editor-in-chief Margarita Simonyan. The workshop’s founder works as deputy director of Dialog Regiony, an offshoot of Dialog, a state-linked organisation sanctioned by the EU, the US and the UK, and she has described how reach is built: many authors spread across a network who all support the same narrative. After the full-scale invasion of Ukraine, the programme’s stated goal became “information sovereignty”.
Organisers say more than 1,700 people from 16 countries have graduated, 123 of them from occupied parts of Ukraine. Graduates run pro-war Telegram channels, one with about 151,000 subscribers, work at Solovyov Live and RT, and head media and press offices in the occupied regions. A French graduate co-founded the agency International Reporters, which received more than €27,000 from Dialog Regiony in nine months of 2024, according to Reporters Without Borders.
Most of these graduates work on Telegram, and since 2025 the Russian authorities have been restricting it and pushing users to the state messenger MAX. Views of pro-government Telegram channels have fallen by 41 per cent as a result, the outlet calculated. One graduate with a large channel said that pro-Russian content no longer made sense on these platforms and that he would not work at a loss. The workshop’s founder read the outlet’s questions and did not reply.
A TikTok network boosts a pro-Moscow candidate in Gagauzia. He says it could be used against him.
Gagauzia is an autonomous region in the south of Moldova where most people speak Russian. In a 2014 referendum, which the central government declared illegal, fewer than 3 per cent of its voters backed closer ties with the EU. On 15 November its residents elect a governor, known as the bashkan. Eight candidates are running, among them Fiodor Gagauz of the Socialist party, a politician openly close to Moscow whose movement organised that referendum. The governing PAS party has no candidate.
The campaign opened on 16 October, and the next day accounts began appearing on TikTok with clips of Gagauz’s launch event and his promises. By 23 October Radio Free Europe’s Moldovan service had identified at least 30 such accounts posting near-identical content, most of them new. Fifteen were created on 22 October alone and gathered about 20,000 views within a day. The accounts also attack his rivals: one posted an AI-generated image of President Maia Sandu with four “independent” candidates in matching T-shirts, captioned as a Trojan horse sent by PAS. TikTok is the main source of political information in Gagauzia, according to a survey by the election watchdog Promo-LEX.
Gagauz says the accounts are not his: on 28 October he filed a complaint with police, saying neither he nor his team created, paid for or managed them, and that he suspects an attempt to accuse him of illegal campaigning. He asked supporters to share his videos only from their own accounts under their real names. Who runs the network has not been established.
On 10 November the head of Moldova’s Security and Intelligence Service told an EU enlargement conference in Chișinău that Russia is stepping up its preparations to influence Moldova’s elections and that this is already visible in Gagauzia. “We are already seeing some very interesting activities. We will not go into the details,” he said.
AI images of destroyed ballots circulate before Spain’s 29 November election
Spain votes on 29 November. Golden Owl, an intelligence firm linked to the University of Alicante, mapped 10,773 accounts and found three recurring claims: don’t vote by post, the census is manipulated, the election will be stolen. AI-generated images showed a postal worker destroying ballots. The claims began in Spain, the report says, and foreign networks help spread them.
Russia’s embassy calls Tajani’s hacking claims a “tragicomic vaudeville”
Italy’s foreign minister Antonio Tajani said on 7 November that his personal data had circulated on the dark web for days and linked it to Italy’s support for Ukraine, and Prime Minister Giorgia Meloni blamed pro-Russian hackers. Russia’s embassy in Rome replied that the claims were a “tragicomic vaudeville” meant to justify new aid for Kyiv.
A Russian headline drops the condition from an Estonian minister’s remark
Estonia’s foreign minister Margus Tsahkna said NATO could block Russian ships in the Gulf of Finland during a military conflict, and the Russian daily Kommersant turned it into the headline that Estonia threatens to close the Baltic Sea to Russia, leaving out the condition. Propastop, an Estonian volunteer group that tracks propaganda, found the same pattern repeated across Russian coverage of Estonia in October.
A Russian operation pays US influencers by the post, a researcher says
Before the US midterms, X suspended about two dozen accounts linked to Storm-1516, a Russian operation that spread false allegations about three Democratic Senate candidates. Dozens more remain, with over 2.4 million followers combined, and most belong to real people, says David Colon of Sciences Po, which makes them harder to suspend than bots, and the operation recruits influencers for “a few hundred bucks” per post.
In #024 we described how fake news reports about France’s October riots were built.
An internal EU assessment seen by Reuters now attributes some of them to Operation Overload, a Russian operation that impersonates Western media. Its videos, styled as news reports, falsely claimed that migrants had raped protesters or that terror attacks were imminent. The assessment covers 7 to 21 October and found no evidence that Moscow or anyone else started or escalated the protests. A separate French foreign ministry count found that the top posts on X from MAGA-linked and Israeli accounts drew 49 million and 35 million views, against 2.8 million for pro-Russian ones. Reuters could not verify either report.
Get Narrative Ops in your inbox
Powered by Repsense narrative intelligence