RT and Sputnik in Spanish boosted by Russian embassy tweets and suspicious accounts

@DFRLab
DFRLab
Published in
7 min readMar 17, 2022

RT en Español and Sputnik News catapulted by diplomatic Twitter accounts and inauthentic activity after Russia invaded Ukraine

A network graph showing user-to-user interactions in posts sharing links to mundo.sputniknews.com. (Source: @estebanpdl/DFRLab via Gephi)

By Esteban Ponce de León

As Russia continues its invasion of Ukraine, Russian state-backed media outlets are gaining popularity in Spanish language-related content. RT en Español is the third most-shared domain on Twitter for Spanish posts discussing the war, while Sputnik News is among the top 15. The most-engaged with posts containing links to these domains have been published by Russian diplomatic accounts and catapulted by inauthentic Twitter accounts.

As previously reported by the DFRLab, RT en Español is one of RT’s most popular language services on social media, with more than twice the number of Facebook followers than RT’s English version. Amidst Russia’s invasion of Ukraine, pro-Kremlin outlets publish disinformation and propaganda, including false flag narratives and claims to justify the invasion.

Given the popularity of RT en Español in Latin America, it raises the question of whether Russia’s activities may influence the online information environment in the region by exploiting war narratives and conspiracy theories. When Russia recently issued a list of “unfriendly” countries, for example, no Latin American country was included. Additionally, Cuba, Nicaragua, and Venezuela openly supported Vladimir Putin ahead of the invasion.

The DFRLab is tracking Russia’s movements across the military, cyber, and information domains in its ongoing Russian War Report.

Twitter engagement

According to a search query using the social media monitoring tool Meltwater Explore, RT en Español is among the most-shared domains on Twitter in terms of Spanish-language discussions about the war in Ukraine. To measure the engagement from Spanish language pro-Kremlin media, the DFRLab collected Twitter posts published between February 24 and March 11, 2022, containing any of the following keywords in Spanish: Ucrania (“Ukraine”), Ucranianos (“Ukrainians”), and other words derived from them; Rusia (“Russia”); Putin; Zelensky; Kiev (the Spanish spelling for Kyiv); Rusa (“Russian”); and Donbas. These were then filtered to identify tweets containing links to 34 domains primarily comprised of media outlets.

Image shows the domains explored in the research, listed alphabetically. (Source: @estebanpdl/DFRLab)

The DFRLab selected these domains, comprised of Spanish language media outlets and platforms such as Telegram and YouTube, based on their similarity to RT en Español and Sputnik News as determined by SimilarWeb audience interest data. According to SimilarWeb, the most similar sites to these are bbc.com, cnnespanol.cnn.com, elpais.com, and infobae.com. The other set of websites was determined by their popularity in Spanish-language countries, based on prior analysis conducted by Professor Kate Starbird at the University of Washington.

Screengrabs from SimilarWeb indicating “similar webs” — sites with common audience interests — to RT en Español (left) and Sputnik News (right). (Source: DFRLab via SimilarWeb)

Between February 24 (the first day of the invasion) and March 11, more than 520,000 unique Twitter user accounts generated around 2.6 million posts containing Ukraine-related keywords and including at least one of the domains from the previous table. The number of posts includes original tweets, quotes, replies, and retweets.

Images from Meltwater Explore dashboard showing key metrics for Twitter, including volume of mentions and number of users, as well as a breakdown of the type of tweets. (Source: DFRLab via Meltwater Explore)

A disaggregated analysis of these posts shows that RT en Español’s website, actualidad.rt.com, is the sixth most-shared domain in original tweets. The top five domains were youtube.com, elpais.com, infobae.com, elmundo.es, and eldiario.es. When retweets are taken into account, however, RT en Español was among the top three most-shared domains on Twitter.

In the case of the Spanish version of Sputnik News, mundo.sputniknews.com, the search query results indicate that it is among the top 15 most-shared domains.

Image shows the top 15 most-shared domains on Twitter in the Ukraine war conversation in Spanish. The tables show volume distribution of mentions: by total number of posts (left), by original tweets, including quotes and replies (top right), and by retweets (bottom right). (Source: @estebanpdl/DFRLab via Meltwater Explore)

In total, actualidad.rt.com and mundo.sputniknews.com garnered nearly 345,000 mentions. Besides the Twitter accounts associated with these outlets, the most-engaged Twitter user accounts sharing links to these domains are Russian embassies in Latin America, including embassies in Argentina, Cuba, Ecuador, Guatemala, Mexico, Panamá, Perú, and Uruguay, as well as the Russian embassy in Spain. The Russian ambassador to Venezuela and the Spanish-language Twitter account for the Russian Foreign Ministry also posted content from these domains.

A table showing the Russian diplomatic accounts that shared links to actualidad.rt.com and mundo.sputniknews.com on Twitter, sorted by their number of followers. (Source: @estebanpdl/DFRLab)

From this set of accounts, the Russian embassy in Mexico and the Spanish-language Twitter profile for the Russian Foreign Ministry were among the most-engaged with accounts, followed by the Russian embassies in Panamá, Argentina, and Spain. According to social network analysis, these accounts received a high in-degree value, which means that other Twitter accounts either retweeted, mentioned, or quoted these accounts’ tweets.

A network graph showing user-to-user interactions in posts sharing links to actualidad.rt.com. The labels represent those accounts who received an in-degree value -a measure of how many “inlinks” the user account received from other Twitter accounts in the dataset — higher than 250. (Source: @estebanpdl/DFRLab via Gephi)
A network graph showing user-to-user interactions in posts sharing links to mundo.sputniknews.com. The labels represent those accounts who received an in-degree value higher than 250. (Source: @estebanpdl/DFRLab via Gephi)

The narratives accompanying the posts from the Russian diplomatic accounts mostly shared content related to Ukrainian bioweapon conspiracy theories. Some posts alerted users to what they claimed was fake news, disinformation, and media manipulation on social media, while others primarily focused on justifying Russia’s invasion of Ukraine, pushing anti-NATO narratives and promoting Russia’s plan to “de-militarize and de-nazify” Ukraine.

Screengrabs from tweets posted by Russian diplomatic accounts, including the Spanish-language Twitter account for the Russian Foreign Ministry. (Source, left to right, top to bottom: @EmbRusiaMexico/archive; @EmbRusiaMexico/archive; @mae_rusia/archive; @EmbRusPan/archive; @mae_rusia/archive; @mae_rusia/archive)

According to DFRLab’s search query, these Russian diplomatic accounts published only twenty-nine original tweets containing links to either RT en Español or Sputnik News. During the analyzed period, these posts gathered roughly 50,000 interactions, including retweets and likes. At the time of writing, these accounts amassed nearly 220,000 followers.

The most-engaged with posts containing a link to actualidad.rt.com were tweeted by the Russian embassy in Mexico, RT en Español, and the RT affiliate known as RT Última Hora. The content of these posts focused primarily on Putin’s February 24 declaration of war on Ukraine, claims about Ukraine preparing a provocation using radioactive contamination, and content amplifying anti-US sentiment from the Chinese embassy in Russia.

A collage of the most-engaged with tweets containing a link to actualidad.rt.com, sorted by the number of retweets. As of March 11, these posts amassed 36,242 interactions, including retweets and likes. (left to right, top to bottom: @EmbRusiaMexico/archive; @ActualidadRT/archive; @RTultimahora/archive; @ActualidadRT/archive; @ActualidadRT/archive; @ActualidadRT/archive)

Signs of inauthentic behavior

The most active Twitter accounts sharing links to either actualidad.rt.com or mundo.sputniknews.com show signs of inauthentic behavior. These Twitter accounts mostly post retweets in their timelines, including hundreds of them for RT en Español and Sputnik News.

Other indicators of these accounts suggest inauthentic activity as well. The accounts publish a high volume of tweets per day, and some of them use automated tools to post their tweets, although not necessarily to publish content related to RT en Español or Sputnik News. After collecting two datasets containing the 100 most-active accounts posting links for each of these domains, the DFRLab found that 29 of them appeared in both datasets, leaving a total of 171 unique accounts for both RT en Español and Sputnik News. These 171 accounts published nearly 40,000 tweets between February 24 and March 11, 2022, representing eleven percent of all tweets containing links to actualidad.rt.com and mundo.sputniknews.com during that time period.

To explore the Twitter activity of these 171 accounts, the DFRLab analyzed their timelines. Over an eight-day window between March 7 and 14, these accounts published more than 200,000 tweets combined, resulting in an average of 155 tweets per day by each account.

A chart showing the total number of tweets posted by the 171 most-active Twitter accounts sharing content from actualidad.rt.com and mundo.sputniknews.com. On average, this set of accounts published more than 3,300 tweets per day between March 7 and 14, 2022, or 155 tweets each. (Source: @estebanpdl/DFRLab)

While the 171 accounts averaged 155 tweets per days, several of them posted at a far higher rate, sometimes above 500 tweets per day.

Screengrabs showing the posting frequency from Twitter accounts sharing content from both actualidad.rt.com and mundo.sputniknews.com. The account @humbertreincide published more than 1,000 tweets in one day. (Source: DFRLab via Truthnest)

Another attribute of this set of Twitter accounts involves activity supporting the Maduro regime in Venezuela. Based on posts and retweets, these accounts published several retweets to Nicolas Maduro’s account, @Mippcivzla (Maduro’s Ministry of Communications), @VTVCanal8 (state-sponsored TV), and @TelesurTV (state-supported news).

A collage of the most-retweeted Twitter account users by the most active accounts posting content from actualidad.rt.com and mundo.sputniknews.com. These accounts also retweeted accounts linked to Maduro’s regime. (Source: DFRLab via Truthnest)
A retweet network from the most active accounts showing the main retweeted accounts filtered by in-degree value. Along with the accounts associated to RT en Español and Sputnik News, the most-retweeted accounts are linked to Maduro’s regime. (Source: @estebanpdl/DFRLab)

The dataset of tweets from this set of accounts also indicates that accounts relied on automation tools such as dlvr.it and IFTTT, which are applications that allow users to automate and schedule their messages on different social media platforms.

A table showing the most-common software by the most active accounts to posts tweets. The orange highlighted rows indicates tools that allow users to automate and schedule messages for a variety of social media platforms. (Source: @estebanpdl/DFRLab)

This analysis suggests that a portion of the retweets received by RT en Español and Sputnik News come from suspicious accounts with multiple indicators of inauthentic activity. Although the popularity of RT en Español in Latin America has been growing on social media, Twitter users are exposed to Russia-sponsored media via inauthentic means. The fact that RT en Español is the third most-shared outlet on Twitter in the Ukraine war conversation in Spanish is primarily due to the number of retweets, of which a large proportion have been posted by such suspicious accounts.

Russian diplomatic accounts also play an important role in the online conversation, as they have mainly spread false claims and conspiracies by amplifying narratives from Kremlin media outlets. Given that these accounts have garnered thousands of interactions in their posts, it also suggests that RT en Español and Sputnik News audiences and Twitter users in Spanish-language countries are being exposed to Russian disinformation.

Esteban Ponce de León is a Research Associate, Latin America, with the Digital Forensic Research Lab.

Cite this case study:

Esteban Ponce de León, “RT and Sputnik in Spanish boosted by Russian embassy tweets and suspicious accounts,” Digital Forensic Research Lab (DFRLab), March 17, 2022, https://medium.com/dfrlab/rt-and-sputnik-in-spanish-boosted-by-russian-embassy-tweets-and-suspicious-accounts-3a24ded7ef57.

--

--

@DFRLab
DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.