Who writes, who repeats, who attacks: preliminary findings of the Belarus Disinformation Map

In brief. Belarusian pro-regime propaganda on Telegram, YouTube and TikTok works as a small centre that writes the texts and a wide ring of channels that repeat them within minutes. Belarusians in exile are attacked mostly by anonymous channels and propagandists, not by state media. The system’s biggest audience is on TikTok.

Data status. The figures are preliminary. Attacks and techniques were coded in two independent readings by a language model; a manual check of a sample is still under way, so the attack figures may still change. Period: January–June 2026; for the copying network, January–August.

Five findings

1. A centre and a ring. SB. Belarus Segodnya and BelTA usually reprint texts from Pul Pervogo, the channel of the head of the regime’s press pool, within a minute. ONT and CTV take BelTA’s texts 9–16 minutes later.
2. Attacks come without a state logo. 91% of attacking Telegram posts are written by 44 non-state channels. At state media, attacks make up 0.3% of posts.
3. The target is the exile community as a whole. Most attacks target not named people or newsrooms but the labels “beglye” (“fugitives”) and “zmagary” (“fighters”, a slur for opposition supporters).
4. Campaigns follow state decisions. After the European Humanities University (EHU) was declared an “extremist organisation” on 14 April, the wave ran through Telegram and YouTube in the same week.
5. TikTok has the audience, and some of it is bought. 133 state and pro-regime accounts gathered 1.35 billion views in January–June. The views are concentrated in a few accounts, and some of them came from paid promotion.

What we studied

We built one corpus and one register of actors across three platforms for January–June 2026. The results form five layers of the map: who copies whom, who attacks whom, when, with which techniques, and where the audience is.

Platform	What is included	Volume
Telegram	Posts of 102 actors: state media, ministries, pro-regime channels and the Russian sources that feed them	238,739 posts
YouTube	Videos of 47 actors: national TV channels, regional state TV, pro-regime hosts	11,013 coded videos
TikTok	Videos of 133 state and pro-regime accounts	51,872 videos, 1.35 billion views

The key word is “register”. One actor, say a TV channel, may have a YouTube channel, a Telegram channel and a TikTok account. We link them by hand and follow one actor across three platforms instead of counting three unrelated channels.

Over this period, 196,721 distinct texts appeared on Telegram. Roughly one post in six repeats a text that another channel in the register also published. On TikTok we have so far measured views and paid promotion; what the videos say is the next stage.

Who copies whom: the centre writes, the ring repeats

A few state accounts set the pace, and the rest copy their texts within minutes. We took every Telegram post of the 102 actors from January to August: 39,720 texts were published by two or more channels. The exact minute of every copy is known, so every link has a direction and a delay.

• At the centre is Pul Pervogo (@pul_1), the channel of the head of the regime’s press pool. SB. Belarus Segodnya and BelTA publish its texts with a median delay of one minute, Grigory Azarenok three minutes later.
• BelTA in turn feeds television: ONT takes its texts 9 minutes later, CTV 16 minutes later.
• The Interior Ministry’s press service supplies texts to the OMON channel with a median delay of 11 minutes.
• The @nikitin73 channel is the entry point for Russian content: material from Sputnik and Zvezda enters the network through it.
• The four Zheltye Slivy channels publish 96–99% of their shared texts in the very same minute. We count them as one actor: one operator, four names.

We measure publication timing, not whether accounts are authentic. Distribution within one minute points to editorial coordination, not necessarily to bots. Channels whose class is still being checked appear on the map without names.

How to read the map. A dot is a channel; a line joins two channels that share texts. Blue: a state outlet or body; red: a propagandist who appears under their own name; green: an anonymous or pro-Kremlin channel. Pul Pervogo is shown in black. A circle is a Belarusian outlet or person, a square a ministry or agency, a diamond a Russian or pro-Kremlin source. An amber line is a forward, a violet line the same text published again, a dashed line a slow link.

Who attacks whom: anonymous channels against the exile community

Attacks come mostly from non-state channels, and the target is the exile community as a whole. In January–June we found about 3,700 distinct Telegram texts attacking Belarusian independent actors: media, organisations, politicians, journalists or the exile community at large. That is about 1.9% of all posts by the map’s channels.

• 91% of attacking posts are written by 44 non-state channels: anonymous channels and propagandists writing under their own names. Attacks make up 4.6% of posts at pro-regime non-state channels, 0.3% at national state media and under 0.1% at ministries.
• Zheltye Slivy alone wrote 1,783 attacking posts, almost half of all distinct attacking texts.
• The main targets are not people or organisations but labels: “beglye” (2,722 texts from 62 actors) and “zmagary” (2,468). Sviatlana Tsikhanouskaya is attacked by 46 actors in 841 texts. Named media, NGOs and journalists come far behind.
• The picture on YouTube is similar: 428 attacking videos out of 11,013 coded, and 68.5% of them name no person or organisation, only a label. On Telegram the share of such texts is 62.9%.

The model read each post twice, independently. An attack counts only if the model quotes the text verbatim. The two readings agree in 96.7% of cases on Telegram and 88.1% on YouTube.

Named journalists, experts and activists appear only in aggregate, 215 posts; private persons never reach the map. We make no claim about who runs Zheltye Slivy: the map shows what the network does, and we name operators only from open sources.

How to read the map. Channels on the left, the targets they attack on the right. A ribbon joins a channel to a target; the wider it is, the more attacking posts. Grey shows all other actors together.

When the attacks come: waves follow state decisions

Attack peaks coincide on both platforms and follow state decisions. The most visible waves: “political prisoners” in March, the European Humanities University (EHU) in April, the Coordination Council in May.

The EHU case. On 14 April the Supreme Court of Belarus declared the university an “extremist organisation” (ZOIS). At 14:37 BelTA and ONT published the news in the same minute. Within an hour 8 channels had written about the ruling, 18 by midnight and 24 within the week. State YouTube channels released 9 videos in four days.

• In April, 71 Telegram posts about EHU appeared, against 0–5 a month before.
• Two thirds of these texts discredit the university, and more than half justify the ban.
• This was not one text copied around: only 18 EHU texts appeared on two or more channels, and most channels wrote their own posts.

This is what a campaign looks like when it explains a repressive decision to the audience within hours. Attacks on the same targets on Telegram and YouTube move in sync: the weekly correlation is 0.92 for EHU, 0.81 for Tsikhanouskaya, 0.74 for “political prisoners” and 0.54 for the Coordination Council.

Beneath the waves there is a steady background: every month 1.7–2.1% of all Telegram posts attack independent actors.

How to read the map. A row is a target, a column a month, with Telegram above YouTube. The darker the cell, the more attacks that month.

Which techniques: the same targets, different playbooks

Smear is common to both platforms; the rest differs: hate and harassment on Telegram, conspiracy narratives on state YouTube. We coded every attacking text a second time, independently, against the DISARM framework. EU institutions use this catalogue of information manipulation techniques, so our tags can be compared with other people’s.

DISARM technique	What it means	Telegram, % of attacking posts	YouTube, % of attacking videos
Spread hate	slurs against whole groups	73	39
Smear	undermining trust in a person or organisation	65	86
Harass	pile-ons against named people	46	22
Conspiracy narratives	the opponent as a foreign-paid agent in a Western plot	13	39

Base: about 3,700 Telegram posts and 428 YouTube videos attacking a Belarusian target, January–June 2026. One text can use several techniques, so the shares add up to more than 100%. Every tag is backed by a verbatim quote from the text.

Hate where nobody signs; conspiracy where the state logo is on screen. Conspiracy narratives are three times as frequent on YouTube as on Telegram.

One technique moves with the calendar. “Justify action”, that is, explaining repression, rises on Telegram from 6.6% of attacks in January to 18.6% in April, the month of the EHU ruling.

The gravest techniques, exposure of personal data and calls to violence, are flagged but not counted until a person has confirmed every case. That is why this text gives no figures for them.

TikTok: where the audience is and how it is bought

The pro-regime system’s biggest audience is on TikTok, and the views there are concentrated in a few accounts. Using Exolyt, we collected video statistics for 333 accounts for January–October; 133 of them are state or pro-regime.

• In January–June these 133 accounts published 51,872 videos and gathered 1.35 billion views.
• Views are concentrated: in January–August, 20 accounts took 69% of views, and 33 of 135 accounts took 80%.
• The volume comes from the regions: 56 district and regional state outlets publish 58% of all videos. @ont.life has the most views, 179 million.
• Accounts whose class a person has not yet confirmed gather 25% of views. We show them without names.
• For comparison: 77 independent and opposition accounts in the same sample gathered 1.63 billion views. But their audience is not only in Belarus, so this is presence, not influence.

The Chernye Rusy case

Chernye Rusy (@cernyerusy), the group that claimed responsibility for damaging infrastructure on the Latvian border in October 2026, has published 94 videos on TikTok with 1.57 million views. Only 5 of them were promoted for money, and those five gathered 87% of all the channel’s views. A typical (median) other video got 674 views.

TikTok’s own rules do not allow political content to be promoted through its paid Promote tool (TikTok). One more sign: 37 of the 94 videos were published at exactly zero seconds past the minute. That is how a timer publishes; a person pressing the button by hand almost never hits that second.

We have not yet analysed what the TikTok videos say: that is the next stage. Views are counted once, at the time of collection, so they can only be compared within one period. Accounts are grouped by actor, so a renamed account is counted once.

How to read the map. Accounts are ranked by views; colours are the same as on the other maps. Empty bars labelled “class under review” are accounts whose class has not yet been confirmed. The label “not named” means the class is known but we do not publish the name. Below, independent accounts are shown on the same scale for comparison.

Germany: one of the main targets

Germany is among the EU countries that Belarusian state media write about most. These figures come from our separate monthly series on EU countries in Belarusian state media (March–August 2026), not from the five layers of the map.

• In March, June and July Germany was the second EU country by number of items, after France. In August it was fourth: border and migration topics pushed Poland and Latvia higher.
• In July, 1,212 items about Germany appeared. Of the nine most propagandistic YouTube thumbnails that month, seven were about Germany.
• Russian agencies are quoted, TASS in about 150 items a month, but that is a small share. Mostly Minsk speaks about Germany in its own voice.
• In the map data for January–June, 21 of 47 state actors on YouTube attacked Germany, in 358 videos.

What they write about Germany, July 2026

Topic	Share of items about Germany, %
Military build-up	26
Internal problems	22
Economic decline	19
Weapons for Ukraine	10
Historical revisionism	7

Together this builds the image of a country that is arming itself, growing poorer and falling apart. The series’ source set changed between March and June, so compare the countries’ ranks rather than absolute numbers.

What this means for Europe

The five layers of the map lead to four practical conclusions for those who counter information manipulation in the EU.

1. Watch anonymous channels, not only state media. Nine in ten attacks come from anonymous channels and propagandists, and these channels repeat state accounts within minutes. Whoever watches only BelTA and ONT misses most of it.
2. Treat Belarus as a FIMI actor in its own right. Germany and the neighbouring countries are among the main targets of narratives made in Minsk. Belarus does not merely relay Moscow: Russian content enters through a few doors, and most attacks on the exile community are written locally.
3. Measure what measures against propaganda achieve. After YouTube removed the channels of Belarusian state media on 3 April, their 190 videos a week on YouTube disappeared. Twelve weeks later these actors’ output had not grown on Telegram (from 2,233 to 2,113 posts a week, 0.95 relative to the control group) or on TikTok (from 105 to 108 videos a week). The removal cut output rather than moving it to other platforms.
4. Share data in common formats. Our layers are coded in DISARM and export to STIX 2.1. EU institutions and the FIMI-ISAC community already use these formats, so the data can go straight into their systems.

How we counted and what we do not know yet

All figures in this publication are preliminary: the Telegram and YouTube layers come from the run of 28 October 2026, the TikTok layer from the run of 2 November.

• Coding. Attacks and techniques were coded by a language model in two independent readings, and every tag requires a verbatim quote. A blind manual check of a sample is under way; it will give the final precision.
• Names. We name only actors whose affiliation is public: state media and bodies, propagandists under their own names, channels with open attribution. Channels whose class is still being checked appear without names. We do not publish labels inferred by a machine.
• Protecting people. Journalists, experts and activists who are attacked appear only in aggregate, quotes with their names are masked, and private persons are not named.
• Views, not reach. Platforms count views, not people. These data cannot tell how many people saw the videos.
• What we cannot see. Closed chats; the content of TikTok videos; the effect on audiences. We measure what is published, not who believes it.
• Next. A public interactive version of the map will follow after the manual check. The next stage will add the content of TikTok videos.

Sources

• Belarus designates the European Humanities University as an extremist organisation, ZOIS
• About TikTok Advertising Policies for Promote, TikTok
• Map data: FactCheck.LT corpus, Telegram and YouTube, January–June 2026 (copying network January–August); TikTok data from Exolyt, collected through October 2026