Russia's Propaganda Machine Has a Weak Spot: The First 18 Hours After a Crisis
Russia's Propaganda Machine Has a Weak Spot: The First 18 Hours After a Crisis
A NATO StratCom COE study by Repsense mapped 3.13 million media items and found Russian propaganda follows a fixed crisis sequence – with a weak spot.
When an unexpected crisis hits Russia, its propaganda system spends the first hours out of sync: official channels stall, competing versions of events fight for space on Telegram, and a unified Kremlin narrative forms only later. The first 18 hours are the system's most exposed phase, according to "Crisis, Control, Crusade: Russia's Propaganda Architecture," a new study published by the NATO Strategic Communications Centre of Excellence (NATO StratCom COE) and carried out by Repsense together with political science researchers.
The study is one of the most comprehensive assessments of Russia's disinformation system to date. The authors analyzed about 3.13 million media items over 15 months – from state websites and television broadcasts to Telegram channels. Every crisis examined in the study was processed in the same order, which makes the system's behavior possible to anticipate.
"Most studies of Russia's information space to date examine the content of its propaganda. The scope and methodology of this study allow us to answer a different question as well – how it works," said Mykolas Katkus, chief executive of Repsense and one of the study's authors. "And it works on a schedule: while the Kremlin takes on average 18 hours to agree an official position, the information space is left without an owner. For the West this means something simple: the speed of a response matters more than its completeness, because after a day the audience has already made up its mind."
The Crisis, Control, Crusade model: how Russian propaganda processes a crisis
The researchers call the recurring sequence the 3C model – Crisis, Control, Crusade. In the first hours after an event, state media either stay silent or contradict each other, while different channels test different explanations and watch which one takes hold. Within roughly a day, a single version wins out and is repeated simultaneously by state websites, television and Telegram channels. Finally, the specific event is folded into a larger struggle: Russia, the framing goes, is defending itself and its values against the West.
Source: "Crisis, Control, Crusade: Russia's Propaganda Architecture," NATO StratCom COE, 2025. The Crisis, Control, Crusade model showing three phases of Russian propaganda response: crisis response in the first 18 hours, narrative consolidation, and normalisation after 72 hours
The clearest demonstration came with Ukraine's incursion into Russia's Kursk region on Aug. 6, 2024 – the first major Ukrainian operation on Russian territory since the start of the full-scale war. State media said nothing for seven hours, and a coordinated Kremlin position took 18. Throughout that window, the story was told not by the state but by Telegram channels and military bloggers.
The report singles out Telegram's role in the system. Channels that present themselves as independent often publish near-identical texts with no time lag between them: from the outside it looks like a plurality of opinions, while the output is synchronized. The researchers describe this contradiction – an appearance of spontaneity combined with coordinated content – as a defining feature of the platform.
In the first hours of the Kursk incursion, Western outlets built their initial stories largely on the accounts of the same regional Russian sources, because neither Ukraine nor other reliable sources had published anything yet. The information vacuum of the first hours pulls even Russia's adversaries into Russian sources, although the study notes that Western outlets avoided adopting the emotional tone.
Source: "Crisis, Control, Crusade: Russia's Propaganda Architecture," NATO StratCom COE, 2025. Timeline of Russian media response to the August 2024 Kursk incursion, from regional Telegram reports through 18 hours of official silence to the first Kremlin message
Crocus City Hall: the culprit was named before the evidence existed
What narrative testing looks like up close was shown by the Crocus City Hall attack. On March 22, 2024, gunmen stormed the concert venue near Moscow, opened fire and set the building alight. 145 people died – one of the deadliest attacks in Russia this century. An Afghanistan-based affiliate of the Islamic State group soon claimed responsibility.
Yet within one hour of the attack, 16% of all Russian media content on the subject already mentioned Ukraine – before any evidence and before any official Kremlin position. The attackers fled by car and were detained near the Ukrainian border. For Russian media, the location of the arrest became sufficient grounds to declare the men had been fleeing to Ukraine. The report points out that the same route could equally have led to Belarus, a possibility that went unmentioned in Russia's public space. Ukraine has denied any involvement.
The timing mattered too. The attack came days after the presidential election in which Vladimir Putin secured a fifth term, and shortly after the opposition's "Noon Against Putin" protest. In Kremlin communication, the tragedy worked as a narrative reset: attention moved from election-related anger to mourning, unity and an external enemy.
Source: "Crisis, Control, Crusade: Russia's Propaganda Architecture," NATO StratCom COE, 2025. Timeline of narratives after the Crocus City Hall attack, showing Russian channels blaming Ukraine within hours while Western statements attributed the attack to ISIS
One Nausėda post became seven disinformation narratives
The same mechanism appeared in an episode involving Lithuania. On Jan. 8, 2025, President Gitanas Nausėda posted on X criticizing the renaming of Lithuanian cultural objects in the Kaliningrad region. Russia's information space turned the post into a claim that Lithuania was making territorial demands on Kaliningrad.
From a single post, the researchers counted seven narrative lines – from "Stalin gave Vilnius to the Lithuanians" to "Nausėda is provoking a military conflict" and "Russians are ready to take the Baltics back." The story reached 30 world regions, from Italy to Vietnam. The familiar schedule repeated here as well: Telegram channels were at their most active two to four hours before official State Duma statements appeared. The report concludes that the same playbook operates not only in Russia's domestic crises but in foreign-policy incidents.
Source: "Crisis, Control, Crusade: Russia's Propaganda Architecture," NATO StratCom COE, 2025. Map showing how a single Nausėda post about Kaliningrad spread into multiple disinformation narrative lanes across Russian, Belarusian, Italian, Latvian and other media
"The strategic goal of Kremlin propaganda is not to convince the audience of every individual claim – it seeks to set the boundaries of how events are to be understood and interpreted. This study shows how such a system works during a crisis: at first, competing versions of an event emerge across different channels, and later one direction is locked in as the interpretation of reality that serves the Kremlin. That is why the system's weakest point is the transition from chaos to control – until it happens, informational interventions and fact-based explanations of the event are still possible," said Dr. Nerijus Maliukevičius, a researcher on propaganda and information warfare at Vilnius University's Institute of International Relations and Political Science.
Nuclear intimidation runs on a schedule too
After the Kursk incursion, nuclear themes surged in Russian media. At first, the claim was that Ukrainians were targeting the Kursk nuclear power plant nearby, and Ukrainians were labeled "nuclear terrorists." In the autumn the Kremlin went further, updating its nuclear doctrine and lowering the threshold at which it threatens to use nuclear weapons.
In the researchers' assessment, the first wave sought to delegitimize the Ukrainian operation and undermine Western support for it, while the autumn doctrine change pointed to a different aim – deterring any repeat of a similar incident. Russian-language social media commentators, for their part, treated the new doctrine with scepticism.
Losses are acknowledged but never added up
One chapter compares two Russian regions that sent a disproportionate number of men to the war: Tuva and Buryatia. Both are highly loyal to the government, and both have high casualty counts. The report describes how the information system manages this tension: losses are acknowledged, but only locally and one at a time. Each death is reported through heroism, family pride and community honor. A cumulative figure appears nowhere.
The two regions differ in method. Tuva's channels carry little war content at all – floods, crime and infrastructure dominate. Buryatia is the opposite: a continuous flow of obituaries, benefit announcements and religious ceremonies that fold military service into everyday community life. The outcome is the same in both cases. People know about the losses, but the losses stay personal rather than collective, and anger is directed at the external enemy.
Victory Day works as an instrument, not a commemoration
The study finds that the May 9 commemoration has been fused directly with the justification of the current war. The 2024 Victory Day communication was planned in advance and executed simultaneously across platforms, and real-time events were absorbed into the framework on the spot: Ukrainian strikes on Russian regions that day were presented not as military operations but as attacks on civilians during a sacred holiday.
The report notes that this technique is harder to counter than a plain falsehood. A false claim can be met with facts; here, the justification sits inside a commemoration people hold sincerely, which makes disagreement look indecent.
By 2025, the war had become routine
By March 2025, regional Telegram coverage of the front followed standardized formats: alerts, all-clear messages and air defense summaries. The language of justification shifted as well, from the early emphasis on "denazification" and retaliation toward defense, faith and duty. The report reads this in two ways: routine lowers the strain on the propaganda system, but over longer horizons it risks fatigue and a weaker capacity to mobilize.
The main audience is not the West – it is Russians themselves
Russia's attempts to carry its versions to foreign audiences produced limited results, according to the report. The narratives blaming Ukraine for the Crocus attack mostly appeared in Western headlines alongside rebuttals, and in the Kaliningrad story many outlets quoted Russian officials critically or carried the Lithuanian response. In the researchers' assessment, these campaigns are aimed first of all at Russia's own population, while abroad, citing earlier research, content spreads more effectively not through official channels but through comment sections, bots, trolls and sympathetic local actors.
Measuring the mood of a propaganda system
The researchers also measured the daily tone of Russian media – how positive or negative its texts sounded. Across the 15-month period, Russian media was gloomiest on the day of the Crocus City Hall attack, followed by the day of the Kursk incursion. The most positive day was Donald Trump’s election. Sharp swings in tone therefore offer another way to spot moments when the system is under strain – the same periods in which official messaging is still unsettled and competing explanations have more room to circulate.
Source: "Crisis, Control, Crusade: Russia's Propaganda Architecture," NATO StratCom COE, 2025. Daily average sentiment of Russian media from January 2024 to March 2025, with lows on the Crocus City Hall attack and Kursk incursion and highs on Victory Day and Trump's election
Text was only part of the picture. The team separately analyzed 13,592 images and short videos from the first Kursk period, identifying 4,057 relevant items that text-based monitoring would otherwise have missed. Short-form video, in particular, often carries little or no textual description. Across this visual material, Vladimir Putin appeared 1,033 times and Volodymyr Zelenskyy 923 times.
What comes next
The next phase of the research will expand the analysis to both Russia and Belarus, adding VKontakte and Odnoklassniki alongside Telegram. It will also examine coordinated networks in greater depth, including how narratives move between platforms and which actors drive their amplification.
Taken together, the findings return to the study’s central point: Russia’s propaganda system is not equally coordinated at every moment. Its weakest point comes immediately after an unexpected crisis, before official channels align and a single narrative takes hold. On average, that window lasts about 18 hours.
For those trying to counter Russian disinformation, this changes the question from simply what should we say? to when should we say it? The opportunity is not only to debunk false claims once they have spread, but to enter the information space before the Kremlin’s version of events has fully formed. Once that narrative consolidates, audiences become harder to move. In those first hours, speed may matter more than completeness.
Research team: Repsense analysts Marius Balodis, Vincenta Maniokaitė, Aurelija Katkuvienė, Alfredas Chmieliauskas and Mykolas Katkus; Nerijus Maliukevičius, expert on propaganda and information warfare at Vilnius University's Institute of International Relations and Political Science; and students Augustė Kaunaitė and Austėja Dūdonytė.
Repsense Havel Narrative Intelligence platform maps the narratives shaping public conversation – where they originate, how they travel between traditional and social media, and which actors are pushing them. The platform separates organic discussion from coordinated and inauthentic activity, then quantifies each narrative's reach and impact so teams can see what is gaining ground before it becomes a problem.
