By Artur Koldomasov, Andriy Pylypenko, for Detector Media
Pro-Russian Telegram channels had no evidence linking the Kraków gunman to Ukraine. Within hours, they made that link the main lens through which they covered the tragedy.
At around 3 p.m. local time on 7 November 2026, a man in camouflage and body armour drove onto Kraków’s Main Market Square and opened fire on passers-by with a rifle. Six people were killed and 15 wounded, including two police officers. Police shot and detained the attacker about a kilometre from the square. Officers later found the bodies of his parents and sister at the family home in the Świętokrzyskie region. According to official information, the attacker was a 24-year-old Polish citizen who acted alone and had never served in the military. He died in hospital on 9 November, Małopolska police said.
Within the first hour, pro-Russian Telegram channels writing in Russian and Polish began searching for a “Ukrainian trail”. Over the next three days they built at least five disinformation narratives around the attack:
- the gunman had supposedly fought for Ukraine;
- Poland was “paying the price” for supporting Kyiv;
- a Russian woman was among the victims and had died;
- “Ukrainian propaganda” would blame Russia for the attack;
- the Polish authorities were “hiding the truth”.
None of these claims was backed by evidence.
Data and method
Detector Media collected and analysed 145 Telegram posts published between 7 and 9 November. The data, supplied by LetsData, came from a keyword search for posts that mentioned Kraków together with the shooting or a terrorist attack, and with Ukraine or migration (Ukraine, khokhly — a Russian slur for Ukrainians — Banderites, Zelensky, the Armed Forces of Ukraine, the SBU, refugees, migrants, citizenship, origin and similar terms). Because the query only captured posts that already linked the attack to Ukraine or migration, the sample shows how these narratives developed rather than the full Telegram coverage of the attack.
Activity peaked early: 67 posts appeared on the day of the attack, 63 the following day and 15 on the third. Of the 145 posts, 107 (74%) came from channels that LetsData labels as “destructive actors”, its internal category for pro-Russian propaganda channels. These include Ukraina.ru, RT, Tsargrad, Ostashko! Vazhnoye, former Ukrainian MP and collaborator Oleg Tsaryov, and Svodki Opolcheniya (Militia Reports). The remaining posts came from other channels, including the Telegram feeds of independent Russian-language media such as TV Rain, Meduza and BBC News Russian, which we used for comparison.
Number of Telegram posts per hour, 7–9 November 2026 (145 posts), with the moments when key versions of events appeared. Data: LetsData.
We grouped the posts using BERTopic topic modelling, and Detector Media analysts validated the results. The model identified a cluster about the “FOG patch” (14 posts), a cluster of commentary and interpretation (14), a cluster of reposts of one identical text about a “mercenary who fought in Ukraine” (7) and a large general news cluster (108). The narrative frames below were identified from these clusters.
To account for local context, we calibrated these frames against the work of the Polish fact-checkers at Demagog. As an additional check, we analysed a manually collected set of 68 posts from eight Polish- and Russian-language Telegram channels, published on 7–8 November. In this set, the topic was pumped up relentlessly from the very first reports: channels moved almost without pause from casualty figures and eyewitness accounts to arrest footage, photos of weapons, speculation about motives and political commentary. Not every post was disinformation. What mattered was the pace, the repetition and the speed with which interpretations were layered onto incomplete information.
Narrative 1: the gunman’s supposed links to Ukraine
Tying the gunman to Ukraine was the central narrative, appearing in at least 43 posts across 32 channels. It surfaced before the Polish authorities or police had said anything about the attacker. Within the first hour, when nothing was known about his identity, the channel Donrf added a single word to a news report: “Ukrainian?” Half an hour later, Vypuskayte Krakena Z (Release the Kraken Z), a channel with around half a million subscribers, posted footage of the arrest with the caption: “In camouflage. Some Ukrainian army fighter?”
The propaganda channels Svodki Opolcheniya Novorossii and Voyna (War) invented a telling detail: that the gunman had supposedly obtained Polish citizenship in 2022. This is a familiar marker in the Polish-language disinformation space, which draws a sharp line between Polish citizens and ethnic Poles to push the claim that Poland is “handing out passports” to Ukrainian refugees. The narrative fell apart once officials confirmed the gunman was Polish, and some propagandists changed their tune. Oleg Tsaryov, for instance, wrote that “by all appearances, this is simply a mentally ill man who first killed his family and then started shooting at random at people on Kraków’s main square”.
Screenshot of a Polska Agencja Prasowa post showing the patch on the gunman’s uniform in the boot of his car. The photo was widely shared on Polish social media.
On the evening of 7 November, the “Ukrainian trail” acquired its “evidence”. Photos of equipment from the boot of the gunman’s car spread online, and a patch on his body armour was declared to be the insignia of Forward Observations Group (FOG), a US private company. In our dataset, Ukraina.ru was the first to run the claim, citing the Telegram channel Shot. Within an hour and a half it had appeared on the channels of RT, Tsargrad, Ostashko! Vazhnoye, Oleg Tsaryov and others, with a combined audience of around 3.7 million subscribers.
“A patch of the American private military company Forward Observations Group, which fought on the side of the Ukrainian army, was spotted on the Kraków shooter,” RT wrote. Tsargrad added that FOG fighters had “shown up” during Ukraine’s incursion into Russia’s Kursk region and linked them to Azov.
Overnight into 8 November, the propagandist Sergei Kolyasnikov (Zergulio, 447,000 subscribers) turned speculation into a verdict: “A mercenary who fought in Ukraine has lost his mind.” At least five channels reposted the text word for word, including Svodki Opolcheniya Novorossii and Pervyi Kharkovskiy (First Kharkiv). The anonymous channel Golos Mordora (Voice of Mordor) went further, claiming the gunman had “fought in Ukraine, in a unit linked to the terrorist organisation Azov” and was “almost certainly a Nazi”.
Polish fact-checkers at Demagog established that the patch shows the flag of the 18th-century pirate Edward Teach, better known as Blackbeard: a skeleton piercing a heart with a spear. Such patches are sold widely and worn by special forces soldiers in many countries; in 2019, for example, a British SAS soldier was photographed wearing one in Nairobi. The FOG logo is different: it shows a devil rather than a skeleton, and a stylised letter F in place of the heart. Poland’s defence minister, Władysław Kosiniak-Kamysz, said the attacker had never been a soldier. Demagog also found that an image of the gunman with a Ukrainian flag on his vest had been generated by AI.
Tellingly, the Ukraine link was debunked and mocked even within the “Z” segment of pro-war Russian Telegram. On 8 November, the channel Rosich ridiculed the “OSINT geniuses”: the pirate on the patch, it noted, is a symbol “slapped on every other Chinese pouch from AliExpress”. Yet even this post ended with the line: “and the khokhly will answer for it”. The debunking did not stop the claim from spreading among other pro-Russian channels, including in Russian-occupied territories: Berdyansk.Aktualno reposted the FOG version as late as 9 November.
These posts did not exist in isolation. In the same channels’ feeds, the Kraków tragedy ran alongside other anti-Ukrainian stories, about corruption in Ukraine, the conduct of Ukrainian officials and the supposed ineffectiveness of Western aid. This mixing creates a cumulative effect: even when individual posts prove no link to the shooting, their proximity nudges audiences to see everything Ukrainian as the single source of threat.
Narrative 2: “A Russian woman among the victims”
For pro-government Russian channels, the key fact of the tragedy was that a Russian citizen had been wounded. At least 22 posts across 17 channels mentioned her, while a British man killed in the attack was mostly mentioned only in passing. The news was placed alongside reports of villages “liberated” at the front and strikes on Ukraine’s energy infrastructure, as in TASS’s evening digest.
This framing soon produced a fake. On 8 November, Ukraina.ru (494,000 subscribers) and Ostashko! Vazhnoye (427,000) reported that the Russian woman had died: “A Russian citizen has died after the attack on Kraków’s Main Market Square… doctors were unable to save her.” The Russian embassy denied this about two hours later, by which time the claim had reached an audience of more than 900,000 subscribers. Earlier, Russian channels had similarly spread unconfirmed claims about an “accomplice” and “both attackers detained”, even though police had ruled out any attacker other than the one detained.
The narrative’s second focus was the fate of the gunman himself. From the first hours, channels lingered on footage of the shootout with police and on his condition. When reports of his death in hospital emerged on 9 November, at least 17 channels, from RT to Tsaryov, picked them up. Otkrytaya Ukraina (Open Ukraine) used the moment to add a new “ideological” detail: “The terrorist held far-left and non-traditional views.” His death removed any chance of hearing his motives from him directly, leaving propagandists free to speculate.
Narrative 3: “Ukrainian psyops will pin the attack on Russia”
While searching for a “Ukrainian trail”, the channels also pre-emptively discredited any suggestion of Russian involvement. The Polish authorities had made no such suggestion, but propagandists rebutted it in advance. Within minutes of the first reports, Yulia Vityazeva, a Crimea-based collaborator, wrote: “Khokhly, probably. But they’ll blame us.” The channel IzKhersonets added: “It was obvious. But Western politicians will, of course, talk about ‘the Kremlin’s hand’.”
Myroslava Berdnyk, an anti-Ukrainian blogger who styles herself a writer, feigned surprise at “the absence of statements that Russia is behind the Kraków shooter” and predicted: “I think it won’t be long; Ukrainian psyops are surely already preparing the relevant stories.” The channel Rasstrelny went as far as claiming: “The khokhly have already found a ‘Russian trail’ in the Kraków attack.” The Russian propagandist and war correspondent Dmitry Steshin spelled out the logic: “You can’t drag Russia into this vile and bloody story,” adding that any panic “in the enemy camp is objectively to our advantage”.
This is classic pre-emptive inoculation. Audiences are primed in advance to treat any investigation into possible Russian influence as a “Ukrainian provocation”. Posts along the lines of “everyone is looking for trails, but there are none” served a similar purpose, flattening the picture so that Ukrainian, Russian and American “trails” all appeared equally plausible.
Narrative 4: “The war has come home to Poland”
Commentary channels turned the invented “Ukrainian trail” into a moral: Poland only had itself to blame for helping Ukraine. Steshin wrote that the shooting “could not have happened without a Ukrainian trail” and that Poland had “caught a ricochet, payback for nurturing the Banderite regime”. His conclusion: “You unleashed the demon of war, so now feed it with your own blood.”
The propaganda channel Voenkor Kotenok (309,000 subscribers) invented details about the gunman’s psychology and motives — “the burden of war on the eastern front” — and tied the attack to the Volhynia massacres of the Second World War, a highly sensitive subject in Poland: “So a Pole sided with forces that continue the work of those who murdered Poles in the Volhynia massacre. He disgraced and effectively cursed his family. By supporting the Banderites, the lathe operator Oksiński became possessed.” The same post urged the Polish government to “immediately recall all Poles fighting in Ukraine”, reprising the Kremlin narrative about “Polish mercenaries” supposedly fighting for Ukraine.
Golos Mordora and Spletnitsa developed the idea that people returning from the front pose a threat. “Ahead lies the return to Poland of citizens fighting for Ukraine… full of hatred and PTSD,” the former wrote. Such people were described as “a deterrent to supporting Ukraine”, and President Volodymyr Zelensky was promptly accused of “sabotaging peace talks”.
The Russian political commentator Sergei Mikheyev promoted his appearance on the radio station Vesti FM on Telegram with the line: “The terrorist attack in Kraków. The Ukrainisation of Europe is in full swing.” This narrative targets Polish support for Ukraine directly and exploits Volhynia, a subject that resonates deeply with Polish audiences.
Some of the channels we analysed repeatedly posted graphic, often uncensored footage from the scene: the moment of the shooting, the black Subaru on the move, wounded police officers and the arrest. This was visible in several posts by the Russian-language channel Varshavskaya Rusalka (Warsaw Mermaid), as well as on the Polish-language outlets of Russian disinformation networks on Telegram, NewsFactoryPL and Pravda PL. Reposting different fragments of the same scene kept audiences emotionally engaged and created the impression of a constant stream of new material. Some posts lacked adequate content warnings or protection of victims’ privacy.
The Polish source most often cited for video in this corpus was the conservative broadcaster Telewizja Republika: much of the footage that circulated came from its live broadcasts or reused clips from its coverage. This is not in itself evidence of any link between the broadcaster and Russia. It does suggest, however, that in moments of crisis pro-Russian channels chose to amplify this outlet above others in the Polish-language information space. The broadcaster’s coverage has also drawn criticism in Poland: its airtime carried conspiracy theories about the attack, such as the claim that police had known about it in advance, repeated live from the scene by the company’s president. Speculation that the attacker might be of foreign origin was also aired, and Poland’s National Broadcasting Council (KRRiT) has opened disciplinary proceedings against Telewizja Republika.
Narrative 5: “The government is lying” — Tusk and the “British trail”
When Interior Minister Marcin Kierwiński said the attacker held far-right views, the channels pivoted to undermining trust in the Polish government. Citing screenshots of the gunman’s supposedly deleted Facebook profile, they declared him an LGBT supporter and a liberal. Oleg Tsaryov wrote that the ministry’s version had been “called into question” and that each camp would now “try to assign the terrorist to the opposite camp”. Steshin added: “And they’ll remember everything about Tusk… Let’s hope they don’t stir up a Maidan there.” Even before any official comment or details, the channel Ukraina Live asked who benefited from the attack — and answered: “Tusk’s current government, to tighten control.”
The channel Pervyi Kharkovskiy called the gunman a “biodrone” and framed events as “a British trail of controlling the shooter in order to intimidate Poles”. In another post it predicted “police terror… cancelled elections” for Europe, adding: “London knows which buttons to press.”
The Polish- and Russian-language segment also saw a separate attempt to link the attacker to Donald Tusk’s political camp. A post on the Russian-language channel Russkiy Troll dlya Polshi (Russian Troll for Poland) claimed that the gunman and his father had been Tusk supporters, citing as evidence the father’s work on an electoral commission in 2020 at the nomination of Paweł Tanajno’s election committee — even though Tanajno was publicly distancing himself from all political parties at the time. The post shows how a single information ecosystem could simultaneously push incompatible versions: the gunman as an “Azov Nazi” and as a supporter of the liberal camp. What united them was not consistency but a shared purpose: discrediting Ukraine and the Polish government.
Taken together, these examples show how quickly a set of contradictory claims shifted, with propagandists never settling on a single “correct” version of events. Their tools were speed, recycled video, appeals to the authority of Russian state media and the embedding of the tragedy in a broader anti-Ukrainian and domestic political context. That combination could amplify reach and emotional impact regardless of whether coordination between individual channels can be proven.
How narratives about the Kraków attack evolved across Telegram, X, Tumblr and the media, and how fact-checkers debunked them. Visualisation made with Claude.
Beyond Telegram: Kraków disinformation on X and Tumblr
Disinformation about the attack also spread beyond pro-Russian Telegram channels. On 9 November, fake videos styled as Euronews and DW reports appeared on X; each had more than 245,000 views when Detector Media analysts recorded them. Almost simultaneously, five accounts with generated names posted the same fake clips on Tumblr. This is the first time Detector Media has recorded Russia’s Matryoshka campaign (also known as Operation Overload) on Tumblr.
The videos repackage the Telegram narratives: the gunman allegedly acted “in the interests of the SBU” and bought his weapons on the black market, where Ukraine supposedly resells arms supplied by its partners. Other fakes link the attack to the cost of aid to Ukraine and to the Volhynia tragedy. The posts tagged dozens of newsrooms en masse. The fake Euronews clip uses genuine audio of Polish police spokesperson Katarzyna Cisło, with the fabricated claims added only as burned-in subtitles, which are harder for automated moderation to detect.
Conclusions
Pro-Russian Telegram channels had no evidence of any link between the gunman and Ukraine, yet within hours they made a “Ukrainian trail” the main lens through which they covered the tragedy. Debunkings by the Polish police, the defence ministry and Demagog’s fact-checkers did nothing to change that. The narratives contradicted each other, casting the gunman as anything from an “Azov mercenary” to a “Tusk supporter”, but all pointed to the same two conclusions that suit the Kremlin: supporting Ukraine is dangerous for Poles, and the Polish government cannot be trusted.
By Artur Koldomasov, Andriy Pylypenko, for Detector Media
Artur Koldomasov, Andriy Pylypenko are Detector Media analysts.
Photo collage REUTERS/Jakub Porzycki
