Birds of a Feather Flock Together: Network-Based Detection of Coordinated Disinformation Campaigns on Telegram

Authors: Panteleimon Tsagkarakis, Emmanouil Papadogiannakis, Evangelos Markatos

Venue: SECRYPT, 2026

TL;DR

A graph-based methodology discovers coordinated disinformation campaigns on Telegram by analyzing message-sharing patterns rather than content, requiring only structural relationships. The authors identified 55 disinformation channels and over 86,000 identical message chains spanning multiple channels, revealing a highly synchronized echo-chamber ecosystem where core channels amplify propaganda while leveraging YouTube and Twitter for amplification.

Contributions

1. Language-agnostic graph-based detection: Uses only message forwarding and channel references to identify disinformation channels, eliminating the need for language translation or content analysis of unstructured text.
2. Scalable discovery from seed set: Starting from 18 known disinformation channels (curated by EU External Action Service), iteratively discovers new channels through their interconnections.
3. Echo-chamber characterization: Demonstrates that detected channels operate in tightly-coupled clusters where narratives are reinforced through identical message replicas shared within seconds to minutes.
4. Cross-platform amplification analysis: Identifies over 1,200 distinct YouTube video URLs and over 86,000 references to fake-news websites across detected channels; shows that over 52% of YouTube content has been removed for policy violations.
5. Temporal coordination signatures: Uncovers synchronized posting patterns aligned with major political events (e.g., February 2022 Russia-Ukraine invasion), with coordinated bursts reaching up to 4.5× baseline activity.

Method

The approach follows an iterative graph-based pipeline:

1. Data collection: Fetch all messages from 18 known disinformation channels (period: Jan 2024–Dec 2025) via the official Telegram API.
2. URL extraction and discovery: Extract all URLs from messages; identify shortened URLs (bit.ly, goo.gl, t.me/); resolve them to canonical destinations. For each reference to a channel (via forwarding or mention), add it as a candidate node.
3. Graph construction: Build a directed graph where nodes represent channels and edges represent message interdependencies. Edge weight reflects the proportion of messages from channel X that reference or forward content from channel Y, normalized to [0, 1].
4. Edge pruning and filtering: Retain only the top 20% of edges per channel (by weight); drop edges resulting from fewer than 10 message references. Apply node pruning to keep only channels with sufficient activity (>10 references).
5. Community detection: Apply the Louvain algorithm to identify clusters of tightly interconnected channels.
6. LLM-based propaganda classification: Sample messages from each detected channel (200–300 messages per group, depending on size); feed into OpenAI's ChatGPT-4 with a structured evaluation prompt assessing source reliability, fact-checking indicators, emotional/manipulative language, and propaganda signals.
7. Validation: Two independent assessments by the authors, with human consensus cross-checked against model output.

Results

Detection: Identified 55 Telegram channels as disinformation spreaders from an initial seed of 18 channels.

Content volume: 12 channels exhibited the largest proportion of propaganda messages (59–80% of messages flagged as "Mild Propaganda" or "Severe Propaganda"). One identified channel had over 1.26M subscribers.

Message coordination: - Discovered over 159K identical or near-identical messages distributed across channels - Nearly 2,000 distinct message replicas appeared in at least four channels - Over 86K distinct message chains confirmed across multiple channels - Message sharing follows the Pareto principle: 90% of shared messages originate from only 10% of channels

Temporal patterns: Posting activity peaks during working hours (07:00–17:00 Moscow Standard Time). Coordinated message posting within one-minute intervals observed in over 7.7K instances across at least two channels. Synchronized spikes correlated with major political events (e.g., Feb 22, 2022 Russia-Ukraine invasion; Crocus City Hall attack, March 2024).

Echo-chamber structure: The highest-ranked disinformation channel received 90% of message references from other channels; the top 10% of channels account for 90% of shared messages. Evidence of structured, selective strategy in content propagation.

External amplification: Identified over 1,200 distinct YouTube URLs referenced; over 86,000 references to known fake-news websites. Cross-platform analysis revealed that channels frequently leverage YouTube and Twitter to extend reach; Odyssee (a video platform) was found hosting unmoderated content. Over half (52.5%) of YouTube video content referenced has been removed.

Language observations: Disinformation channels often use Western languages (e.g., English) despite originating from non-Western operators; common rhetorical patterns include blanket accusations, emotional appeals, and quotation marks around phrases like "recognized" and "peaceful transfer" to delegitimize concepts.

Connections

• Related to Coordinated inauthentic behavior detection via network topology; shares temporal-coordination methodology with Setting the clock: Evaluating temporal window parameters for coordinated behavior on strategic timing of campaigns.
• Extends network-based coordination detection from Twitter (e.g., It takes a village to manipulate the media: coordinated link sharing behavior) to Telegram's broadcast-channel structure.
• Methodologically similar to Disinformation Warfare: Understanding State-Sponsored Trolls on Twitter and in characterizing state-sponsored disinformation operations via network structure and account behavior.
• Relevant to Computational Propaganda and Bot detection as applied to instant-messaging platforms.

Notes

Strengths: The language-agnostic approach is a key innovation—it sidesteps translation bottlenecks and applies consistently across multiple languages. The use of graph topology to infer coordination is theoretically principled and requires minimal feature engineering. Temporal analysis strengthens the case for orchestrated activity.

Limitations: The methodology relies on a curated seed set (18 channels from EEAS), which may bias discovery toward politically-aligned disinformation. Private Telegram groups remain inaccessible. The ChatGPT-4 classification, while validated by human agreement, is inherently a post-hoc labeling; the core detection method is truly content-free. The paper focuses on broadcast-style channels; the applicability to group-style channels (where only subscribers see messages) is unclear.

Open questions: Whether the graph-based approach can detect smaller, more fragmented campaigns where coordination is less apparent in message sharing patterns; the durability of the identified channels post-publication; whether the temporal patterns reflect genuine coordination or adaptive response to news cycles.