20220802-Ihor Kurayan
Lviv, Ukraine CNN  — 

Before the war broke out, Igor Kurayan, a 55-year-old from the southern Ukrainian port city of Kherson, shared frequent gardening updates on social media. His feeds were full of palms, pomegranate trees, marigolds, bamboo and avocados, grown at his home and small business near the Black Sea. He called it his “fairytale garden.”

On February 25, a day after Russia invaded Ukraine, Kurayan posted a selfie on Instagram with a rifle, announcing he had volunteered to fight in the Territorial Defense Forces, reserve units of Ukraine’s military. Soon after, Kherson fell to Russian troops and in early April, after weeks living under and protesting against their occupation, Kurayan was abducted. He was watering plants in his shoe store when he said Russian soldiers dragged him outside and threw him into a van.

Soon after Kurayan’s kidnapping, his Facebook and Instagram pages, and a new TikTok account registered under his name, began posting messages entirely out of character for the man known to family and friends as a proud Ukrainian, a passionate activist and avid gardener.

“They started to use my father’s social media … they wanted to make a puppet out of him.”

Karyna Kurayan, Igor’s daughter

At first, Kurayan’s captors painted him as a patriot, posting old photos from his time running supplies to Ukrainian soldiers on the front line in Donbas, where Russia-backed separatists have been battling Ukraine’s government since 2014.

Then strange videos started to surface. In one, Kurayan looked gaunt and ashen, flanked by two armed, masked men holding the blue and yellow Ukrainian flag and a red and black flag associated with the Ukrainian nationalist movement. He said that Kherson was occupied and rallies were pointless, adding that the Territorial Defense there had disbanded. In another, he denounced Ukrainian President Volodymyr Zelensky’s government and called on his countrymen to surrender.

“I think that further resistance is useless,” said Kurayan in the clip, which was shared across his social media accounts and aired on Russian state TV. Standing in front of a cache of weapons, his hands bound, he said he had been part of a plot to attack Russian soldiers and free activists, but that he’d given up, adding: “I suggest that all fighters of the Territorial Defense surrender their weapons.”

“They started to use my father’s social media. They saw he was active on Facebook … They registered him on TikTok — my dad does not even know what TikTok is,” Kurayan’s daughter, Karyna, a 23-year-old journalist who left Ukraine after the war began, told CNN. “They wanted to make a puppet out of him.”

Karyna provided the videos and screenshots of posts made on her father’s original social media accounts to CNN. The posts, which she shared with Ukrainian authorities, were removed by Kurayan after his release.

A propaganda video of Igor Kurayan, which he said was posted on a TikTok account that his Russian captors created.

Kurayan, who was freed in a prisoner exchange in late April after nearly a month of detention, is one of several Ukrainians to be abducted from occupied areas of the country’s southeast in recent months and then sucked into the Kremlin’s propaganda machine. Some of their social media pages have been used to promote pro-Kremlin talking points, while others have appeared in staged TV interviews in support of Russian President Vladimir Putin’s war.

Speaking with CNN on an encrypted video call, Kurayan said that Russian soldiers alternated between torturing him for information — twisting his fingers with pliers and beating him bloody with a truncheon — and using his iPhone to access his social media accounts, sharing images portraying him as a hero-turned-traitor. “They started using these photos to play their game,” Kurayan said, adding that his captors showed him how they were hijacking his accounts, taunting him. “They used my Facebook, my Instagram, and TikTok, which I didn’t have, they made a page there.”

“The Russians offered me to betray Ukraine, to cooperate with them. They first wanted to show, ‘look here is a patriot, and then he betrayed his country,’” Kurayan added, describing how his captors had articulated the arc of their strategy in using his social media. “They said, ‘you are a very famous person in Kherson … we want to make you mayor.’”

CNN has reached out to TikTok for comment about the account created using his name, which is still active. Nothing has been posted since April 24, four days before his release.

“They started using these photos to play their game … They used my Facebook, my Instagram, and TikTok, which I didn’t have, they made a page there.”

Igor Kurayan, who was kidnapped by Russian soldiers

As the war in Ukraine stretches on, the battle for hearts and minds is entering a new phase. Moscow is shifting its strategy from a national to a local level, attempting to bring Ukrainians living in occupied territories onto Russia’s side. But after struggling to find willing collaborators, it has resorted to new tactics.

“In the beginning, in the blitzkrieg phase, Russia’s propaganda machine was working on the national level — now these efforts are localized, they’re trying to convince local people, particularly in occupied areas, that Ukraine has abandoned you,” Mykola Balaban, deputy head of the Centre for Strategic Communications and Information Security (Stratcom Centre UA) under Ukraine’s Ministry of Culture and Information Policy, told CNN.

“In the case of Igor and many others, they use this content inside of Russia too, to show, ‘look this Ukrainian he was an activist, pro-Ukrainian, but now he understands, we show him what is the real situation and now he is pro-Russian, and he understands what we are fighting for.’”

The Kremlin meanwhile has repeatedly accused the West of disseminating falsehoods, with Russia’s UN Ambassador Vassily Nebenzia claiming in May that countries that call themselves a “community of democracies” were building a “cyber-totalitarianism” and, along with technology giants like Meta, marking any alternative viewpoint as “propaganda.”

Putin’s information war shifts

More than any other country, Ukraine has borne the brunt of Russia’s so-called “hybrid warfare” — an insidious blend of disinformation campaigns, cyber attacks and ground combat. Ever since the Euromaidan revolution in 2014, which transformed Ukraine’s political landscape and society, ushering in closer ties with the West, it has been Moscow’s chief target.

The Internet Research Agency (IRA), the notorious Kremlin-linked troll factory that whipped up discord in the 2016 US presidential election, used Ukraine as a testbed for its tactics for years. But, following revelations of Russian interference in the election, tech giants like Facebook and Twitter have stepped up efforts to crack down on coordinated inauthentic activity.

As a result, Russia has come to rely increasingly on what experts call “information laundering,” legitimizing false or duplicitous narratives through a network of pro-Kremlin actors, journalists, activists and other proxies — a practice known as “dzhynsa” in Ukrainian (a reference to money being kept in a jeans pocket for illicit dealings).

Since Russia’s invasion, hackers have broken into social media accounts and telecoms networks of trusted sources in Ukraine — government officials, media outlets, Ukrainian soldiers and civilians — to spread false messages that Ukrainian troops were surrendering and, more broadly, to sow confusion. Meta, Facebook’s parent company, said in April that it had traced one campaign targeting Ukrainian military officials to state-sponsored group of hackers in Belarus known as Ghostwriter. It also said its systems detected and thwarted attepts by a network linked to the IRA to return to Facebook.

“They can capture real people and do whatever they want with their social media, this social mirror of this real person.”

Mykola Balaban, deputy head of Stratcom Centre UA

Governments are hitting back too. In May, UK-funded research claimed that a new Russian troll farm allegedly operating out of an arms factory in St. Petersburg — with suspected links to Yevgeny Prigozhin, a key Putin ally and the man believed to be behind the IRA — was hijacking discussions on social platforms, including Facebook, Twitter and TikTok, targeting world leaders’ accounts and promoting pro-war messages. The British government said it had alerted platforms to the activity, and that the evidence would help root out Russian influence operations.