Indicators of compromise (IOCs) that identify accounts as likely being part of the network include:
- a single follow (the
bsky.brid.gy @ bsky.brid.gyaccount), or first follow is the bridge - followers and following hidden from public
- registration after September 8, 2025
- linking to pro-Russia Telegram channels, or Russian news sources
- posts that cut off mid-sentence
- masquerading as legitimate news organisations
- disposable email domains used for the account registration
The accounts are created and left alone for a short period, and will have no posts for up to week, sometimes more. Messages will often be posted in the predominant language of the local service.
Once in use, the account will likely follow a dozen or so accounts on servers that are listed on the AUD Denylist and/or a handful of the highest recommended accounts. Sometimes the local accounts are followed first, then the bridge.
Update January 16, 2026: now over 1,400 accounts on the servers being monitored, likely more we don’t know about. We are no longer reporting individual accounts due to the time needed to track, record and manually report each account. Service providers can request access to a database to monitor known accounts. DM IFTAS from an account with owner privileges to request access.
Update November 21: with over 750 accounts and growing, we will no longer be updating the daily accounts tracker and instead will be focussing on identifying the domains known to be wholly unmanaged or unmaintained, please see the IFTAS Abandoned and Unmanaged Domain (AUD) Denylist page for more details.
Update October 25: Accounts are still being created (571 observed so far), and a number of servers are either unwilling or unresponsive in removing these accounts. A list of servers recommended for limiting or defederating is now available at https://about.iftas.org/library/known-spam-fediverse-services/#Unmanaged_Unmaintained_Abandoned_Servers
Update October 14: Accounts are still being created, and unused accounts registered earlier are being activated.
Since 15 September, IFTAS has been tracking a coordinated network of over 300 accounts operating across Mastodon. These accounts are engaged in a high-volume propaganda campaign, promoting pro-Russian narratives and linking to Telegram channels associated with known state-aligned disinformation operations.
We became aware of a related investigation by the Antibot4Navalny research team that observed these accounts bridging to Bluesky, and we have since collaborated to enhance our investigations and share our findings. Their public post provides further context.
Antibot4Navalny’s observations identified additional impacted services we were unaware of, and highlighted that accounts were still being created. Furthermore, thanks to their specific expertise in this area, this helped clarify and confirm that what we were seeing was indeed the work of a coordinated campaign with an increased likelihood of it being a state-sponsored or state-approved campaign.
We have been contacting affected Mastodon administrators, and are now moving to a public advisory to inform the broader network.
The network includes accounts impersonating reputable news outlets such as BBC News, Euronews, and Meduza, designed to give credibility to Telegram propaganda links. We believe it may be connected to the “Pravda/Portal Kombat” pro-Russia propaganda network.
Accounts are hosted across numerous Mastodon instances and bridged into Bluesky, creating the appearance of independent sources. Activity on Bluesky helped reveal aggregate patterns, identical usernames, posting schedules, and content themes more clearly than across decentralised Mastodon services.
This campaign appears to mimic tactics observed in earlier influence operations, blending low-cost automation with impersonation and volume-based amplification.
We are sharing data with participants of the Social Web ISAC, and we issued a public advisory along with a list of observed usernames.
We are aware of accounts hosted on abandoned or unmanaged services, we may issue a Limit recommendation for those domains at a later date.
If you provide or can link to tools that may benefit administrators in identifying and/or managing these accounts, please let us know.
Further Reading:
3 responses to “Coordinated Pro-Russian Propaganda Network Targeting ActivityPub and ATProto Services”
[…] Coordinated Pro-Russian Propaganda Network Targeting ActivityPub and ATProto Services […]
@about.iftas.org It is worth noting that authoritarian states are not focused on these social networks.
I never see any response to how a decentralised system will react to informational (and deliberate) attacks by autocracies.
Large social networks such as YouTube can block or restrict a channel, and greedy corporations choose to spread negativity for profit. What will Fedi do?
@Distante @about.iftas.org
The article describes a concerted, deliberate attack by a nation state. They are very much interested in these networks, and are using it now, today.
Roughly 40% of all known accounts remain online, follow each other to ensure good federation, and are spamming 1,000's of posts.
Roughly 5% of servers have blocked the known sources that are unmanaged and now completely dominated by these accounts.
>how a decentralised system will react
Not very well