Lifting the Veil on Video Content: Two Out of Three Narratives Originated on Russian Telegram Reach German TikTok

How Russia’s propaganda machinery operates in Germany - and why it should concern more than just disinformation researchers

The Unseen Battlespace — presenting the research at the Munich Cyber Security Conference

Within 24 hours, satellit_de - a Russian-administered Telegram channel posting in German - spread a conspiracy theory about the “mysterious deaths” of AfD candidates. The next day, it was already circulating in German TikTok feeds. A young German voter (one of the 38% of TikTok users in Europe’s wealthiest country), watching political videos, will never know that the originator of the topic is not a German commentator, but the Kremlin’s propaganda machine.

This is just one of 36 documented dissemination cases uncovered by Repsense in its large-scale study, The Unseen Battlespace. After analysing more than 3 million messages across 740 Telegram channels, alongside Germany’s mainstream media and popular political TikTok accounts, we identified a functioning propaganda pipeline: content originates in Kremlin-affiliated Telegram channels, moves through intermediaries in Germany, and ultimately reaches German TikTok feed. The study was presented at the Munich Cyber Security Conference, where it received significant attention - it was cited by Germany’s largest online news portal Bild, the major cybersecurity outlet Cybernews, as well as numerous conference participants.

From Brigade in Lithuania to a Tik Tok in Germany

The origins of this study lie in Repsense’s year-long monitoring of information warfare targeting the German brigade stationed in Lithuania. Over the past year, we recorded active efforts to discredit the deployment process - ranging from political attacks and historical distortions to the amplification of logistical problems. The Suwalki Gap “drama”- in which plans to build a new military training area, fueled by the coordinated inauthentic and bot-driven Facebook groups, sparked local concerns over land use and environmental impact - is the most recent, but certainly not the only, example.

However, when we examined Germany’s mainstream media landscape, we found that the spread of these narratives was highly limited and largely remained within the boundaries of what could be considered healthy political debate. Naturally, this raised the question: could hostile disinformation be travelling through invisible channels? Our experience analyzing election communication in Moldova, Lithuania, Romania, and other countries has shown that manipulation on TikTok is not only a preferred tool of Russian propaganda - it is also one of the fastest ways to shape public opinion.

Until now, analyzing video content has been difficult. Keyword-based social media monitoring reveals only surface-level video descriptions (which are rare on TikTok and Reels). Leveraging new capabilities of our Havel software, we tested the hypothesis that Russian disinformation networks are increasingly shifting toward video platforms that evade traditional monitoring frameworks - most notably Telegram, but also TikTok, which reaches broad mainstream audiences.

Three-phase Propaganda Machinery

The data revealed a clear recurring model. Russian state media - channels such as SolovievLive, TASS, and OstashkoNews - create a narrative in Russian on Telegram. Within days or weeks, a small group of Russian-language or German-language Telegram channels targeting Russian-speaking audiences in Germany pick it up and transform it into moderately framed commentary, which resembles domestic German political opinion. From there, German TikTok accounts present it to mass audiences whose viewers have no way of knowing where the narrative originated. 

This is not a theory, but a documented mechanism that we can clearly demonstrate in 36 cases - ranging from NATO and Ukraine to the AfD, EU policy, and the Middle East. And that is not all. Several hundred similar cases display slightly weaker narrative attribution signatures or dissemination patterns, yet can still be linked to the same mechanism. Overall, two-thirds of narratives originating on Russian channels migrate, in one form or another, into the German digital space.

Key Narratives Across Telegram Ecosystems: From Russian Channels to Popular German Channels

The Numbers that Speak for Themselves

Fifty-two Kremlin-linked channels (just 7% of all monitored channels) produce one-third of all Telegram content in our dataset. Two out of three identified narratives appear on both platforms - Telegram and TikTok. In 36 cases, we found clear evidence that the content first appeared on Russian Telegram and then on German TikTok.

Finally, in the largest documented cluster - related to Russia, Putin, and Ukraine - we identified over 5,000 posts, 51% of which were copied across hundreds of accounts. Such patterns do not resemble organic discussion.

Share of Russian Narratives in TikTok Content in Germany

The Speed is Increasing

For geopolitical topics (NATO, Ukraine, Putin, etc.), the average delay from Russian Telegram to German TikTok is approximately two months. For domestic political discussions (the AfD, elections, scandals), the delay shrinks to roughly one week. In one case, a conspiracy theory spread by satellit_de reached TikTok within 24 hours. In another case, Russian channels planted the narrative frame eight months before the event it described.

Targeted at Russian-speaking audiences but written exclusively in German, Telegram channel satellit_de appeared in every documented cross-platform dissemination case. The channel takes extreme positions from Russian state media and reshapes them into moderately framed German political commentary. In some cases, it produced more content on a given topic than all Russian channels combined. It is rare to trace a critical link so clearly - namely, the moment when Russian propaganda becomes indistinguishable from a domestic source. 

The global disinformation ecosystem known as the ‘Pravda Network’ is responsible for disseminating pro-Russian content across the web. Within this ecosystem, according to the Atlantic Council’s DFRLab satellit_de stands out as the second-largest Pravda retransmitter worldwide and is one of its most active channels, which operates in the video space as well. We were able not only to link satellit_de to the broader Telegram ecosystem, but also to demonstrate how its content bleeds into Germany’s mainstream video environment.

Cross-Platform Narrative Transfer: 71% Reach Both Telegram and TikTok Within Three Days

Evidence of Coordination

Our system detected clear signs of coordinated activity. A total of 24,633 articles were syndicated across 314,632 Telegram messages - 90.7% of them within 24 hours (median time: just 1.9 hours). This strongly indicates coordinated distribution rather than organic sharing.

Russian-language channels in Germany act as bridges, pulling content from Russian Telegram and repackaging it for German audiences. Channels such as Germanylivetv and Swodki maintain the highest number of cross-category links, directly connecting the Russian information space with the German ecosystem.

Coordinated Narrative Injections in Practice

In Munich, Repsense CTO Alfred visually demonstrated our Havel system’s ”fingerprint” on stage - a clear visualization of how a narrative travels across platforms. Below are two illustrations showing the coordinated injections of narratives into the German public sphere - first through Telegram channels and later through TikTok.

The “Trump and Ukraine” narrative. The upper section (blue) shows Telegram channel activity over time - the red frames mark coordinated narrative injections, moments when multiple channels begin disseminating the same narrative simultaneously. The lower section (red) shows TikTok account activity, revealing the systematic construction and amplification of the narrative across German TikTok accounts.

Coordinated Narrative Injections: The Journey of the ‘Trump and Ukraine’ Narrative from Telegram → TikTok.

The “Gaza” narrative. The same pattern emerges, with even more pronounced coordinated Telegram → TikTok amplification (highlighted in the red frame below). A strong coordinated narrative injection also is evident - a moment when Telegram activity is visibly synchronized.

Coordinated Narrative Injections: The “Trump and Ukraine” Narrative’s Journey from Telegram → TikTok

Narrative Intelligence: Predictability as a Weapon

This research once again confirms what we have observed for some time: the era of keyword-based monitoring and sentiment scoring in information warfare and FIMI analysis is coming to an end. Narrative intelligence — an increasingly popular term for what we do - is becoming a central tool in OSINT, strategic communication, reputation management and crisis management.

Our Havel platform generates a behavioral “DNA” signature for each narrative. Within the first six hours of detection, we can assign a narrative to one of the previously analysed signatures. In more than nine out of ten cases, this allows us to predict its subsequent behaviour. Narrative forecasting models achieve up to 90% accuracy within just six hours of a narrative’s emergence.

Such predictability enables the early detection of high-risk narratives and allows us to assess both the effectiveness of countermeasures and the presence of artificial amplification.

This fundamentally reshapes crisis communication. I will explore the application of narrative predictability in crisis management and reputation protection - relevant not only to defense, but also to the private sector - in a separate post.

***

Munich: The First Lithuanian Company on Stage

The research and our platform’s capabilities were presented at the Munich Cyber Security Conference, held alongside the Munich Security Conference (MSC) - one of the world’s most important annual security events. We shared the stage with distinguished guests, including European Defence Commissioner Andrius Kubilius and conference organiser Oliver Roloff.

This year’s conference was nearly twice as large as last year’s and, from my perspective, there was significantly less drama and more substance. Some journalists were even disappointed, commenting that “there wasn’t much to write about.” Even the highly anticipated speech by U.S. Secretary of State Marco Rubio was more diplomatic than JD Vance’s controversial appearance the previous year.

However, defense industry representatives, investors and government officials were notably more positive. Discussions were productive, substantive and the contacts established were valuable, indicating that Western countries are taking security seriously. We received strong interest from defense communities, strategic communication professionals, and representatives from the finance and other sectors. Narrative intelligence appears to be becoming relevant not only for disinformation researchers, but for anyone working in OSINT or strategic communication.

During the discussion following the presentation, Commissioner Andrius Kubilius posed a fundamental question:

“We understand how democracy functions in peacetime. How it functions in wartime - that experience we do not have.”

This succinctly captures the context in which both our research and the broader field of narrative intelligence operate. Debates on countering organized, militarized hostile disinformation and election interference often drift into adjacent discussions - freedom of expression, platform responsibility, and the societal impact of social media. Yet, the Commissioner classified the protection of the political process as a core European defense priority and became the first senior policymaker I have heard articulate the need to “operationalize” resistance to weaponized propaganda. Should this approach take hold, it would mark a significant and welcome shift.

***

What Is Missing — and What’s Next?

It is important to note the limitations of the study. Major platforms in Germany such as YouTube, X, and Facebook, were not included, which would have allowed for an even more precise identification of the adversary’s disinformation infrastructure. Our monitoring of Telegram and TikTok networks was not fully exhaustive: to track not only the adversary’s activities that has the largest audiences but also with the smaller one requires time, funding, and sustained effort. Publicly available disinformation monitoring sources in Germany are more random than in the Baltic states or Central Europe.

Nevertheless, even in the context of the relative shortage of data, the core findings would not change - we would simply have more direct evidence. In fact, I believe it was precisely these gaps that made our systemic approach particularly compelling in Munich.

In Lithuania, Facebook groups play a role similar to that of Telegram channels in Germany. A recent example is the “Suwalki Gap groups” created by questionable actors - though they are far from the only case. More on this in an upcoming study.

***

The Study in The Media

Bild (Germany’s largest daily newspaper): Exklusive Studie belegt: Kreml-Propaganda flutet TikTok

Cybernews (leading cybersecurity news outlet): TikTok Germany manipulation: 3M posts influencing minds, exposed

The full research report will not be made publicly available. However, it will be accessible to those who, we believe, will use it responsibly and for its intended purpose.

For further details about the study or a demonstration of the Havel platform’s capabilities, please contact us at: info@repsense.com