PaperlayerView exact revision on arXiv

Source-linked AI summary

Birds of a Feather Flock Together: Network-Based Detection of Coordinated Disinformation Campaigns on Telegram

Panteleimon Tsagkarakis, Emmanouil Papadogiannakis, Evangelos Markatos

arXiv:2610.00222v1cs.SIcs.CY

TL;DR

Disinformation is difficult to discern, and Telegram’s features have facilitated its spread. The paper uses inter-channel relationships to identify previously unknown spreaders, finding 37 newly discovered channels labeled as propaganda spreaders and evidence of coordinated dissemination.

  • Problem

    Disinformation is difficult to discern, and Telegram’s features have facilitated the spread of false narratives.

    Source: §1 · p. 1

  • Method

    A language-agnostic graph method starts from known disinformation channels and uses their inter-channel references to discover and cluster additional spreaders.

    Source: §1 · p. 2, §3 · p. 3

  • Results

    37 newly discovered Telegram channels were labeled as propaganda spreaders, and identical messages across channels indicate coordinated dissemination.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Telegram disinformation circulates in echo chambers, with repeated narratives and coordinated activity across channels.

    Source: §1 · p. 2, §6 · p. 10

    The study focuses on broadcast-style channels, whose operators make it possible to trace the origin of false narratives.

    Source: §2 · p. 2

Abstract

from arXiv · show

In recent years, disinformation has increasingly proliferated across social networks. The firing of fact-checkers from Meta and the disbanding of Twitter's Trust and Safety Council suggest that this trend will continue to escalate. While disinformation sources (e.g., social network accounts) can sometimes be identified, new accounts emerge daily, making tracking a moving target. In this work, we propose a graph-based methodology to discover previously unknown Telegram accounts that spread disinformation. Starting from a set of verified disinformation groups, we examine their interconnections and identify new accounts that contribute to the dissemination of false narratives. Our approach is language-agnostic, as it relies solely on structural relationships between accounts rather than analyzing their message content. Using this approach, we identify 37 previously unknown disinformation channels (a threefold increase). We demonstrate that Telegram channels display extremely dogmatic behavior with up to 80% of messages being labeled as propaganda. Our findings reveal that misinformation on Telegram spreads within tightly interconnected clusters, in some cases, with over 86K identical messages being shared to multiple channels, suggesting coordinated disinformation campaigns.

1 INTRODUCTION

Disinformation persists across social platforms, while Telegram’s scale and underexplored channel ecosystem make newly emerging spreaders difficult to track. This work introduces a language-agnostic graph method and reports new channels, cross-platform amplification, and coordinated sharing patterns.

1 INTRODUCTION

  • Telegram’s internal propaganda ecosystem and how new channels emerge remain underexplored, while manual moderation cannot keep pace with daily account creation.The passage reports over 1 billion monthly active users in 2025.Source: §1 · p. 2
  • 37 previously unknown Telegram channels were labeled as propaganda spreaders using a language-agnostic graph methodology focused on sharing behavior.The method also identifies patterns of coordinated behavior among accounts spreading false narratives.Source: §1 · p. 2
  • Over 2,000 distinct messages were identical across more than 4 disinformation channels, indicating coordinated dissemination campaigns.Some channels flooded over 3,000 distinct messages that were later reshared word-for-word.Source: §1 · p. 2
  • Over half of content on identified channels using YouTube and Twitter to expand their reach was removed for policy violations, and more than 84% referenced known fake news websites.These figures are reported for the cross-platform channels described in the introduction.Source: §1 · p. 2
  • More than 7K instances of near-simultaneous identical content sharing across channels spanned over 71 clusters and tended to align with major political events.The paper characterizes these bursts as strategic timing and coordinated influence efforts.Source: §1 · p. 2
  • The paper makes its identified disinformation-spreader channels publicly available for further research.The contribution cites Tsagkarakis (2026).Source: §1 · p. 2

2 BACKGROUND

Telegram combines private chats, large groups, and broadcast channels, with forwarding that makes sharing convenient. This paper focuses on broadcast-style channels, where a single operator can be traced as the source of posts.

2 BACKGROUND

  • Telegram combines private chats, groups with up to hundreds of thousands of participants, and channels broadcasting to an unlimited audience.Channel posts appear in reverse chronological order and can be forwarded with one tap while preserving the original author.Source: §2 · p. 2
  • Telegram’s effortless publishing, encouraged sharing, and ideologically homogeneous communities are conditions in which disinformation thrives.The passage also says privacy-centric branding may limit accountability.Source: §2 · p. 2
  • Broadcast-style channels permit only an owner or operator to publish, so posts come from a single voice and narratives can be repeated without challenge.The paper contrasts these channels with group-style channels, where users can post and discussions can develop.Source: §2 · p. 2
  • The study focuses on broadcast-style channels because their specific operators make it possible to trace the origin of false narratives.The paper notes that this one-to-many structure enables dissemination without debate.Source: §2 · p. 2

3 METHODOLOGY

The methodology discovers Telegram disinformation channels from inter-channel references, then clusters detected channels to examine coordinated dissemination. Its validation combines automated classification with model-generated channel assessments and human review.

3 METHODOLOGY

  • The approach starts from known disinformation channels, iteratively finds channels they promote, and clusters detected spreaders to reveal dissemination patterns.It represents inter-channel relationships rather than examining linguistic traits, eliminating the need for text translation.Source: §3 · p. 3

3.1 Detection & Data Collection

  • The seed set comprises 18 Telegram channels identified in an EEAS analysis of more than 100 incidents of information manipulation.The source attributes all 18 channels to Russia, including channels using different languages or targeting non-Russian residents.Source: §3.1 · p. 3
  • The graph represents channels as nodes and references or forwards as directed, weighted edges normalized against each channel’s highest reference count.The weight measures the relative strength of interaction between channels.Source: §3.1 · p. 3
  • The method retains each channel’s top 5% of connections with at least 10 messages, keeps the top 20% of nodes by in-degree, iterates discovery, and clusters mutual references with Louvain.The selected pruning thresholds were described as stable and consistent; higher thresholds make graphs sparser and increase computational cost.Source: §3.1 · pp. 3–4
  • 55 disinformation Telegram channels, including 37 newly discovered channels, were identified in 9 information-alignment clusters from over 1,800 cross-channel references.The analysis began with 18 seed channels and collected messages through 2024-12-31; the channel list is publicly available.Source: §3.1 · p. 4

3.2 Disinformation Classification

  • Propasafe labeled 24.08% of approximately 2M messages as mild propaganda and over 88K messages (4.57%) as severe propaganda.Across the identified channels, the analysis found over 550K propaganda messages.Source: §3.2 · p. 4
  • ChatGPT-4o classified all but two sampled groups as propaganda or fake news; the remaining two were misinformation-prone, and none was rated trustworthy.Two authors independently assessed the reports and fully agreed with the model’s decisions; control channels were correctly identified as reliable sources.Source: §3.2 · p. 4

4 INTERCONNECTED ECOSYSTEMS

The section finds that Telegram disinformation activity is concentrated in a small set of channels, repeated across echo chambers, and coordinated in timing. It also documents propaganda-heavy content and links to misinformation websites and other platforms.

4.1 False Claims & Propaganda

  • 12 of 55 identified channels had more propaganda messages than neutral ones, and kvmalofeev’s mild or severe propaganda share reached 79.67%.Manual analysis also found selective quotation, emotionally charged language, blanket accusations, and unsubstantiated claims.Source: §4.1 · p. 5

4.2 The Echo Chamber Effect

  • 90% of messages shared by disinformation channels came from the top 10% of referenced channels, while ∼56% came from the top 1%.Channels repeatedly amplified selected sources while minimally interacting with most others.Source: §4.2 · pp. 5–6, Figure 3 · p. 6
  • Over 159K messages were reshared verbatim across at least two disinformation channels, forming 86K distinct message chains.Ten channels initiated 59% of chains; SputnikLive initiated over 12K, or 13.74% of all chains. Nearly 2,000 distinct messages appeared in at least four channels, and 8.5% of messages were reposted within one minute.Source: §4.2 · pp. 6–7

4.3 Misinformation Spreaders

  • About 84% of discovered channels shared at least one article from a list of misinformation websites, while channels also shared YouTube and other-platform content.More than half of over 1,200 collected YouTube URLs resolved to channels subsequently banned for policy violations; sputniksrbija shared over 53K Odysee videos in 28 months.Source: §4.3 · p. 7

4.4 Coordinated Activity Patterns

  • Posting volume was 34% higher on weekdays, and 56.87% of messages were posted from 07:00 to 17:00 MSK.The authors suggest this regular schedule may reflect working-hour audience targeting or channel operators’ routines.Source: §4.4 · pp. 7–8, Figure 6 · p. 7
  • SputnikLive and Sputnikby shared over 3,300 identical messages within one minute; 71 distinct channel clusters posted at least 10 identical messages within one minute, while barantchik saw a 4.5× increase on February 24, 2022.Source: §4.4 · p. 8

5 RELATED WORK

Prior work examines coordinated activity across platforms and uses network structure to identify campaigns and fake-news sources. Telegram research addresses its fragmented network, fake channels, misinformation media, and channel-discovery methods.

5 RELATED WORK

  • Studies connect coordinated campaigns across platforms with deceptive account activity, synchronized websites, and polarized Telegram communities.Research also documents cross-platform coordination involving X, Facebook, and Telegram.Source: §5 · p. 9
  • Twitter campaign detection has reported over 95% precision using behavioral similarity networks, while fake-news website detection uses structural features rather than article content.The cited website features include domain age, DNS records, IP links, and third-party ad requests.Source: §5 · p. 9
  • Telegram's sparse, fragmented network and image- and video-based misinformation distinguish its research setting; prior fake-channel detection trained a model on manually labeled channels.That study examined channels impersonating public figures, companies, and services.Source: §5 · p. 9
  • Telegram studies have expanded channels from seed sets, mapped narrative-overlapping communities, and detected coordinated pro-Russian and pro-Ukrainian networks through reply relationships.TGDataset contains over 120,000 channels and 400 million messages; another dataset covers over 43,000 chats and 1 billion messages focused on the 2024 U.S. election.Source: §5 · p. 9

6 DISCUSSION & CONCLUSION

The paper presents Telegram disinformation as an interconnected, cross-platform ecosystem whose channels reinforce narratives and coordinate message dissemination. Its findings are bounded by the inaccessibility of private groups and ephemeral content.

6 DISCUSSION & CONCLUSION

  • Telegram disinformation channels disproportionately share messages from politically aligned channels and use emotional, sensationalized narratives, forming echo chambers.The paper also reports that channels use other social platforms and known disinformation websites to amplify reach and acquire false credibility.Source: §6 · pp. 9–10
  • Timeline analysis finds coordinated activity to amplify narratives across Telegram channels, particularly during major political events.Identical messages are sometimes posted across channels within seconds, suggesting coordinated dissemination strategies that may be automated or orchestrated.Source: §6 · p. 10
  • Telegram privacy limits content-moderation opportunities, while cross-platform amplification makes mitigation harder when efforts remain on a single platform.The paper calls for coordination among social media companies, regulators, and fact-checking organizations.Source: §6 · p. 10
  • The method captures only a subset of Telegram disinformation because private groups and ephemeral content remain inaccessible.Source: §6 · p. 10

A ChatGPT Evaluation Prompt

The prompt evaluates messages for source credibility, factuality, manipulative or repetitive tactics, bias, mobilization, and accountability, then assigns an overall information-quality category.

A ChatGPT Evaluation Prompt

Related papers

Loading 2610.00222v1…