Coordinated social media campaign targets NABU director Semen Kryvonos on Threads

A series of posts against the director of the National Anti-Corruption Bureau of Ukraine (NABU), Semen Kryvonos, from newly created Threads profiles with minimal or no audience has appeared in recent weeks, Threads users noted. The nature of the activity of some of these accounts may indicate a coordinated spread of negative materials, but it is impossible to establish their connection with certainty without data from the platform itself.

Original photos used. AI-generated collage

ZMINA recorded at least 130 negative posts on Threads about the NABU director and around 180 comments under popular publications on other topics.

A significant part of such content was spread by similar profiles with a minimal or non-existent audience. Many of them were created in September 2026, and some as recently as October. Some accounts may appear more than once in different posts and comments, so these figures reflect the number of recorded publications and comments, not the number of unique profiles.

The publications share a similar theme. The authors question the NABU director’s integrity and mention old stories from his biography, the competition for his post, a land case, the dismissal of former NABU first deputy director Gizo Uglava and other episodes. Some of the posts are accompanied by old photos, interview excerpts and videos from media outlets.

At the same time, the publications themselves do not contain evidence for many of the accusations they make. Some assertions are presented as established facts, although they previously appeared as claims by Kryvonos’s critics or as circumstances of old proceedings.

One of the most noticeable signs that may indicate inauthentic activity is the simultaneous appearance of several profiles. The information available on Threads about some of the accounts indicates that they joined the platform in September 2026. While they have practically no audience of their own, they are already actively publishing materials on the same topic.

The profiles also demonstrate a narrow thematic focus: a significant part of the available publications concerns Kryvonos and criticism of NABU. The posts repeat the same stories and similar wording, and the wave of activity coincided with a period when the bureau’s director was actively attacked on other social networks.

Meta defines coordinated inauthentic behaviour as the joint actions of networks of accounts that conceal who they are or who is behind their activities and try to manipulate public debate. The company says it primarily assesses the behaviour of accounts and the coordination between them, rather than the truthfulness or political orientation of the content. Therefore, it is impossible to determine from public profiles alone whether these pages are run by a single person or entity, whether they use automated posting, and who created them. Such a conclusion requires the platform’s technical data or a separate digital investigation.

Another common feature of some accounts is a distinctive structure of the posts. The authors often start them with sharp statements, questions or emotional wording intended to immediately attract attention, and only then move on to accusations against the NABU director.

For example, a number of publications start with an all-caps call “KRYVONOS, SHOW THE DOCUMENTS”, followed by a series of rhetorical questions about old cases and the competition for the post of NABU director.

Another account starts the text with a comparison to school bullying: the author writes about a situation where a child is bullied at school and adults are asked why they did not stop it. Only after this does the post abruptly shift to Kryvonos, NABU and the accusations previously made publicly against him.

Such a structure – an emotional introduction, a provocative question or a categorical call at the beginning, followed by a transition to the main accusation – helps catch a person’s attention even before they understand what the publication is actually about. At the same time, this style alone does not prove that the accounts are coordinating with each other.

Meta has previously described similar methods of attracting engagement as engagement bait – content that attempts to artificially stimulate reactions and gain more reach. The company noted that it is reducing the visibility of spammy, sensational and manipulative content.

Another notable practice is publishing messages about Kryvonos in discussions that do not concern him at all.

In one case, an account created a long post demanding that Kryvonos show documents in a thread under a publication by Ukraine’s Human Rights Ombudsman Dmytro Lubinets. The ombudsman’s post itself concerned possible violations by territorial recruitment centre staff, entry into private homes and mobilisation – NABU or its director were not mentioned in it at all.

Meta specifically identifies irrelevant comments and coordinated fake engagement as a problem. In 2025, the company stated it would reduce the visibility of comments that its system identifies as coordinated inauthentic activity. It also said it would test a way to flag comments that are unrelated to the conversation or do not match its content.

The current activity on Threads follows several waves of negative campaigns against Kryvonos on Telegram.

Monitoring of 20 large anonymous Telegram channels between 1 June and 23 September covered over 100,800 publications, of which approximately 6,300 were identified as discrediting. Semen Kryvonos was among the top five targets of such materials. In the two analysed groups of channels, a total of 46 discrediting publications concerning him were counted, all of which appeared in September.

On 7 September, ZMINA also recorded the synchronous spread of identical claims against NABU: six anonymous Telegram channels published messages with almost identical content within just 16 minutes. They were later picked up by other Telegram channels, and the publications’ total audience reached around 1.14 million views.

Back in February, based on its own monitoring results, NABU identified over 300 Telegram publications showing signs of coordinated information attacks. The bureau’s head of communications, Marharyta Zhyvaha, told ZMINA at the time that characteristic signs of such campaigns include materials appearing almost simultaneously, identical or very similar texts and the same manipulative messages repeated on different platforms.

In September, Kryvonos also stated that NABU was observing attempts to draw the bureau into a political confrontation through anonymous Telegram channels that spread out-of-context materials and accusations against anti-corruption bodies.

Related: Information attacks against Kryvonos: who stands to gain from discrediting the NABU head?

Follow ZMINA on X, Bluesky and LinkedIn for daily human rights coverage from Ukraine – we invite you to share your feedback on what you’d like to see more of in our survey here.