“Urgent: Please Verify.” How Coordinated Disinformation Networks Are Trying to Penetrate Armenia’s Media Space

“This news needs to be verified.” “Please fact-check this news item. Urgent request for fact-checking.” “News from X and Bluesky. Please check this news item.”

For more than two years, #CivilNetCheck has been receiving emails with short, “urgent”-sounding subject lines like these.

The messages arrive from unfamiliar Gmail addresses. All are written in English and use nearly identical wording, urging journalists to “check urgently.” Attached are links to posts on X, Bluesky, TikTok, or Telegram channels, with senders asking fact-checkers to verify the content.

At first, the main targets were Ukraine, France, Moldova, and other European countries. However, since late 2025, the same methods have increasingly been used to circulate senzational claims about Armenia involving corruption, elections, foreign influence, and the country’s leadership.

Our investigation suggests these are not isolated messages from random users. The structure of the emails, the accounts being used, the recurring sources, and the narratives they promote all point to a coordinated disinformation campaign that now appears to target fact-checkers themselves.

Why are the same emails being sent to fact-checkers?

#CivilNetCheck is not the only organization receiving such messages. European fact-checking groups have reported similar experiences.

In a converzation with #CivilNetCheck, Stefan Rathmanner, editor of the fact-checking division at the Austrian Press Agency (APA), said their organization began systematically cataloging such emails in early 2024. However, the first Armenia-related messages arrived only in early December 2025. 

“I was quite alert when the first emails arrived because I assumed that there might be elections coming up, which obviously is the case. We saw the same pattern with Moldova last year. About half a year prior to the elections, we started receiving e-mails containing claims about Moldova,” Rathmanner noted.

APA received around 56 such emails concerning Moldova, most of them in the weeks leading up to the elections. So far, at least 23 similar emails related to Armenia have been recorded. Rathmanner believes their number is likely to increase as Armenia’s elections approach.

“The primary target in Moldova was President Sandu, as now in Armenia it is Prime Minister Pashinyan,” he said.

Among international fact-checkers, these tactics are associated with the “Matryoshka” campaigns: coordinated disinformation operations in which the same false narratives are presented across multiple platforms and accounts to create the illusion of numerous “independent sources.”

Emails sent to fact-checkers are part of that method. False claims are first spread on X, Telegram, or other platforms, after which links to those posts are emailed to newsrooms from various addresses in an attempt to attract additional attention.

An investigation by the American magazine Foreign Affairs found that Russian companies involved in such operations closely monitor how their content is received by media outlets, social media platforms, and fact-checking organizations.

According to leaked internal documents, these organizations compiled reports tracking media coverage, investigations, and account removals related to their operations, presenting them as evidence of the campaigns’ “effectiveness.” Foreign Affairs concluded that such reactions were used to justify continued funding for future operations.

How the Campaign Operates: Newly created gmail accounts and random names

At first glance, the emails appear to come from different individuals, however they share one striking pattern: nearly every email is sent from a newly created Gmail account that is never used again. 

Most of these addresses consist of random letters and numbers and contain no real names or identifying information. Available technical data suggests many of the accounts were created recently and, in some cases, generated automatically. 

At the same time, the senders often use real-sounding names in an apparent attempt to make the messages appear to come from ordinary users. Yet those names are often unrelated to the email addresses themselves.

What suggests this is a coordinated operation?

Several indicators point to a systematic campaign.

Typically, posts published on social media are sent to fact-checkers one or two days later from multiple email addresses. Although the addresses differ, the attached links are often identical and even sent in the exact same order, featuring the same Telegram channels and X accounts.

It is difficult to imagine unrelated users randomly sending the same content in the same sequence using identical structures.

For example, emails sent from [email protected] and [email protected] contained links to the same X and Bluesky accounts in identical order. 

These emails often include four or five Armenia-related posts submitted for “verification” at once. Most of the posts were published on the same day, sometimes only minutes or hours apart. Nearly all are written in English and repeat the same narratives. 

For instance, one email received on May 2 requested verification of several posts that had been published the previous day. One claimed that the Institute for the Study of War (ISW) had reported that Armenia was preparing for war against Russia. Another alleged that Prime Minister Pashinyan’s press secretary had confirmed the construction of a drone factory in Armenia using Ukrainian technology.

A separate post published that same day claimed that Prime Minister Pashinyan owns eight apartments in Paris.

In a post by a user named doinb_alex claiming the American-Armenian pop diva Cher is demanding Pashinyan’s immediate resignation, her name was misspelt as “Sher,” which may indicate that the author is not a native English speaker or that the content was incorrectly translated from another language. 

Russian-language Telegram channels and removed bot accounts

The emails frequently contain links to the same Russian-language Telegram channels, including Шкварка 2.0, Республика Одесса, and Шаман Раху. Senders usually ask fact-checkers to verify claims originally published on those channels.

These channels regularly circulate false or manipulative content about Armenia.

For example, one email asked fact-checkers to verify a claim published by Шкварка 2.0 alleging that an Armenian man involved in laundering Pashinyan’s money through cryptocurrency in Dubai had disappeared.

Available data regarding the channels’ location and language suggests that at least some operate from Russia and primarily publish in Russian.

#CivilNetCheck has previously reported on those same Telegram channels targeting Armenia.

Social media platforms are removing bot accounts

As many of the X (formerly Twitter), Bluesky, and TikTok accounts linked in the emails are often quickly removed by the platforms, #CivilNetCheck examined archived versions of the accounts.

Social media companies generally remove accounts they identify as engaging in “fake or inauthentic behaviour.”

The investigation found that some X accounts had remained inactive for years before suddenly beginning to post political content about Armenia, suggesting the possible use of hacked or purchased dormant accounts.

There were also inconsistencies between display names and usernames. In genuine user accounts, these typically correspond to the same identity; however, in this case, the display names and usernames differed across all examined accounts, another indication that they may not belong to real users. 

What narratives are being promoted about Armenia?

While emails related to Armenia were relatively infrequent around October 2025, their volume increased sharply beginning in April 2026. 

Soon there were days when several emails from different addresses arrived simultaneously, all asking fact-checkers to review the same posts.

Analysis of the attached content shows that many of the narratives center around Armenia’s 2026 parliamentary elections. Claims concerning election fraud, Western interference, social unrest, and political instability are widespread.

Similar surges in information activity have also been observed during major political events, such as the European Political Community summit.

The most common narratives revolve around corruption, loss of sovereignty, and Armenia’s foreign policy orientation. The emails promote allegations about Prime Minister Nikol Pashinyan and his associates supposedly owning foreign assets or participating in corrupt schemes, topics repeatedly addressed and debunked by #CivilNetCheck.

Other posts claim that foreign companies are acquiring Armenian territory or natural resources. One alleged that the American financial company BlackRock had purchased 33 percent of the Shikahogh Reserve. Others claimed Armenia’s agricultural lands were being sold to foreign corporations and that the country had become a “testing ground for social experiments.”

Some narratives focus on alleged government repression and persecution of critics.

One email urged fact-checkers to verify claims that an Armenian blogger had died in France after being attacked because he had criticised Pashinyan.

As the 2026 parliamentary elections draw closer, election-related narratives are becoming increasingly aggressive. Claims are spreading that the elections will be rigged and that Western actors are interfering in Armenia’s internal political affairs.

One email, for example, requested verification of a post claiming Facebook was mass-blocking accounts belonging to members of the Armenian diaspora who called on voters not to support the ruling Civil Contract party.

Other posts alleged that the European Union monitoring mission operating in Armenia would be involved in election “fraud.”

Separate narratives attempt to link Armenia to the war in Ukraine. Claims circulate alleging that Ukrainian oligarchs are financing Pashinyan or that drone factories using Ukrainian technology are being built in Armenia.

Another recurring theme portrays Armenia’s relationship with France as creating the risk of war with Russia. Some posts claim France is pushing Armenia toward conflict with Russia, while others falsely state that the Institute for the Study of War (ISW) reported Armenia was preparing for war against Russia.

The emails also circulate content related to LGBT+ issues, portraying the authorities as having “abandoned traditional values.”

In nearly every case, the same tactic is used: the names and logos of reputable international organizations and media outlets such as Reuters, CNN, Der Spiegel, ISW, and Human Rights Watch are used to create the impression that the claims originate from credible sources.

However, the investigation found that none of these organizations had published the alleged reports. Many of the narratives simply recycle claims previously spread in other disinformation campaigns that were later debunked, including by #CivilNetCheck.

Similar narratives are being spread about other countries

The links attached to the emails also promote disinformation targeting European countries.

In France, the dominant narratives focus on the alleged “weakening” of the military, loss of control over nuclear weapons due to refugees, and efforts to discredit President Emmanuel Macron.

For Germany, the narratives include claims about “Nazi” military leadership and growing sympathy for Russian President Vladimir Putin. At the same time, another recurring theme suggests that attitudes toward Russia in parts of Europe are becoming more positive, portraying Russia as waging a supposedly “more humane” war. 

The investigation shows that such campaigns often intensify ahead of elections and other major political developments in European countries.

At the same time, Ukraine-related narratives remain constant in these emails regardless of the political context.

In Armenia’s case, the same methods have clearly begun to be used more aggressively ahead of the 2026 parliamentary elections. Observations by European fact-checkers also suggest that such information campaigns become especially active during politically sensitive periods.