Indicators of compromise (IOCs) that identify accounts as likely being part of the network include:a single follow (the bsky.brid.gy @ bsky.brid.gyaccount), or first follow is the bridgefollowers and following hidden from public registration after September 8, 2025 linking to pro-Russia Telegram channels, or Russian news sources posts that cut off mid-sentence masquerading as legitimate news organisations disposable email domains used for the account registration
The accounts are created and left alone for a short period, and will have no posts for up to week, sometimes more.
Once in use, the account will likely follow a dozen or so accounts on servers that are listed on the [AUD Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ).
*Update November 21: with over 750 accounts and growing, we will no longer be updating the daily accounts tracker and instead will be focussing on identifying the domains known to be wholly unmanaged or unmaintained, please see the [IFTAS Abandoned and Unmanaged Domain (AUD) Denylist](https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/ ) page for more details.*
*Update October 25: Accounts are still being created (571 observed so far), and a number of servers are either unwilling or unresponsive in removing these accounts. A list of servers recommended for limiting or defederating is now available at https://about.iftas.org/library/known-spam-fediverse-services/#Unmanaged_Unmaintained_Abandoned_Servers*
*Update October 14: Accounts are still being created, and unused accounts registered earlier are being activated.*
Since 15 September, IFTAS has been tracking a coordinated network of over 300 accounts operating across Mastodon. These accounts are engaged in a high-volume propaganda campaign, promoting pro-Russian narratives and linking to Telegram channels associated with known state-aligned disinformation operations.
We became aware of a related investigation by the [Antibot4Navalny](https://bsky.app/profile/antibot4navalny.bsky.social ) research team that observed these accounts bridging to Bluesky, and we have since collaborated to enhance our investigations and share our findings. Their [public post](https://bsky.app/profile/antibot4navalny.bsky.social/post/3m22256476k25 ) provides further context.
Antibot4Navalny’s observations identified additional impacted services we were unaware of, and highlighted that accounts were still being created. Furthermore, thanks to their specific expertise in this area, this helped clarify and confirm that what we were seeing was indeed the work of a coordinated campaign with an increased likelihood of it being a state-sponsored or state-approved campaign.
We have been contacting affected Mastodon administrators, and are now moving to a public advisory to inform the broader network.
The network includes accounts impersonating reputable news outlets such as BBC News, Euronews, and Meduza, designed to give credibility to Telegram propaganda links. We believe it may be connected to the “[Pravda/Portal Kombat](https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf )” pro-Russia propaganda network.
Accounts are hosted across numerous Mastodon instances and bridged into Bluesky, creating the appearance of independent sources. Activity on Bluesky helped reveal aggregate patterns, identical usernames, posting schedules, and content themes more clearly than across decentralised Mastodon services.
This campaign appears to mimic tactics observed in earlier influence operations, blending low-cost automation with impersonation and volume-based amplification.
We are sharing data with participants of the [Social Web ISAC](https://connect.iftas.org/library/iftas-documentation/social-web-information-sharing-and-analysis-centre/ ), and we issued a [public advisory](https://mastodon.iftas.org/@iftas/115322867312262878 ) along with a [list of observed usernames](https://about.iftas.org/library/known-spam-fediverse-services/#Coordinated_Network_Spam_Accounts ).
We are aware of accounts hosted on abandoned or unmanaged services, we may issue a Limit recommendation for those domains at a later date.
If you provide or can link to tools that may benefit administrators in identifying and/or managing these accounts, please let us know.
**Further Reading:**https://www.sgdsn.gouv.fr/files/files/20240212_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network https://www.sgdsn.gouv.fr/files/files/Publications/20240214_NP_SGDSN_VIGINUM_PORTAL-KOMBAT-NETWORK_PART2_ENG_VF.pdf">PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network (Part 2) https://checkfirst.network/pravda-network-worldwide-expansion-and-llm-wikipedia-pollution/">“Pravda” Network: Worldwide Expansion and LLM, Wikipedia Pollution https://www.americansunlight.org/updates/new-report-russian-propaganda-may-be-flooding-ai-models">Russian propaganda may be flooding AI models
IFTAS on Nostr: everything we can say publicly is at ...
everything we can say publicly is at https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/