Social Media Intelligence

Social media intelligence is the branch of open-source intelligence that works from what platforms expose: public posts and channels, photos and video, and the account data behind them. Its sources and its subjects overlap, because the platforms investigators collect from also carry sabotage recruitment, state propaganda and evidence of military supply chains.

Russia's military intelligence agency, the GRU, recruits ordinary citizens as saboteurs through Telegram job ads. Repost graphs, transparency data and cloned news sites have exposed influence networks aimed at Latvia, Israel's election and the Baltic states. Photos and video have identified a senior executive and drone parts tied to Russia's Alabuga drone plant, and takedowns on Telegram and TikTok shape what remains to collect.

As of October 2026, Estonia, Poland and Denmark had publicly tied sabotage against defence and Ukraine-support targets to Russia, and The Insider's findings on Chinese mesh modems in Russian drones rested on its own reporting.

Sabotage recruitment on Telegram

The GRU uses Telegram as a hiring channel for sabotage in Europe. An investigation by the outlet Vot Tak documented more than 20 million Telegram job ads in the first half of 2026 that recruited saboteurs in more than 20 countries. Recruits take arson, reconnaissance or parts-buying tasks paid in cryptocurrency, and handlers delete the intermediary account within days. Of 172 perpetrators the International Centre for Counter-Terrorism identified in 151 Russian-linked sabotage incidents in Europe between 2022 and 2026, 95% were ordinary citizens rather than intelligence professionals.

Several governments have tied attacks to Russia. Estonia's Internal Security Service blamed Russian special services for an arson attack on defence robotics maker Milrem Robotics, and Polish officials called an arson at a Starlink ground station relaying connectivity to Ukraine's armed forces Russia-linked sabotage. Denmark's intelligence service said Russia had moved from planning to executing sabotage against Danish suppliers to Ukraine, recruiting homeless and substance-dependent people through Telegram and other platforms.

Mapping influence networks

Network analysis exposes influence operations that pose as local voices. The Insider's repost graph of 72 Latvian Telegram channels traced 43.7% of 93,000 reposts directly to Russian state media, government accounts, military bloggers and pro-war channels. The Insider and the Latvian outlet tv3.lv both found roughly a third of Latvia's socio-political channels run by Kremlin-aligned operators. The Insider found most of the five largest run from Russia or Belarus.

Platform metadata can contradict a persona's claimed identity. The AI-assisted platform Golden Owl mapped an Iran-linked network aimed at Israel's 27 October 2026 election. X's own transparency data placed some self-described Israeli accounts in Germany, Finland, Egypt or Yemen, and several reached the platform through what X labels the "Iran Android App".

Cloning real news outlets is another tell. DFRLab traced false claims about the Baltic states that spread on X from August 2026 to accounts linked to Storm-1516, an operation first identified by Clemson University's Media Forensics Hub that researchers link to the GRU through its habit of copying the websites and logos of legitimate media.

The Alabuga drone plant

Public imagery has exposed a senior executive and drone parts tied to Russia's Alabuga special economic zone, which builds Iranian-designed Shahed-type drones. The Ukrainian team Evocation.info identified the man Vladimir Putin hugged after a briefing on jet-powered Geran drones as Ildar Tazutdinov, an Alabuga executive under US sanctions since February 2024.

From photos of a downed Geran-4 shared on Telegram, The Insider found a 32-element anti-jamming antenna closely resembling a design by Harxon, a sanctioned Chinese supplier it had traced as Alabuga's main antenna source. Doubling the earlier maximum of 16 elements could make Geran and Gerbera drones significantly harder for Ukraine to jam, The Insider said. Militarnyi corroborated the 32-element design and its Alabuga-linked "ALB" marking, while crediting the Harxon match to The Insider. The Insider read the engraved marking as pointing to assembly at Alabuga, and the rough finish and engraved serial numbers as a sign of possible local assembly from Chinese-made circuit boards.

In a follow-up with the open-source group Nordsint, an investigator posing as an Alabuga-based Russian military supplier obtained an invoice from Shenzhen Xingkai Technology for 500 mesh data-link modems. The Insider estimates Xingkai holds about half the market for the high-power modems used in Geran and Gerbera drones. As of October 2026, no second outlet had confirmed the modem findings.

Platform takedowns

Platform enforcement shapes what remains to collect. Telegram blocked more than 43.5 million channels and groups in 2025, but the criminal networks investigators track outlast the removals because blocked communities typically re-form elsewhere, Check Point Research found. After appeals from Ukraine's Center for Countering Disinformation, TikTok removed more than 1,000 posts tied to Alabuga and blocked six accounts under its rules on the exploitation of people, which the centre ties to minors working on Alabuga's assembly lines.