More than a month on from Russia’s invasion of Ukraine, suggesting that the wheels have fallen off Vladimir Putin’s propaganda machine has become commonplace. Russia’s playbook is outdated and has failed to adapt; Moscow has been stunned either by Ukrainian President Volodymyr Zelensky’s great skill as a media operator or by the viral ferocity of Kyiv’s own digital fighters.

As the researcher Sinan Aral wrote in The Washington Post, “Ukraine and its partisans are running circles around Putin and his propagandists in the battle for hearts and minds, both in Ukraine and abroad.” Even Russia’s lurch back into Soviet-style information control seems to be nothing but a retreat from the gleeful, postmodern, fact-defying dance of digital propaganda in which it had been so masterful. My personal social-media feeds stand as testament to how each of these observations might, individually, be true: They feature wall-to-wall Zelensky, Arnold Schwarzenegger, and farmers towing tanks. I know absolutely no one who thinks the invasion is anything but an outrage.

Despite this, it’s far too early to declare information victory. If anything, this apparent consensus—that Ukraine has won the online war—might be obscuring where battles over the invasion are really raging.

My pro-Ukrainian online world was punctured on March 2, when I saw two hashtags trending on Twitter: #IStandWithPutin and #IStandWithRussia. Very quickly, disinformation researchers began to see suspicious patterns associated with the hashtags, arguing that both bots and “engagement farming” were being used. A deep dive on the profile picture used by one account propagating the hashtags led to a Polish Facebook group dedicated to dating scams. At least in part, the early signs indicated that a deliberate, if hidden, effort was under way to make these hashtags trend.

The pro-invasion hashtags were enough to make my colleagues and I take notice. By March 9, just under 10,000 Twitter accounts had shared one of the hashtags at least five times, an especially engaged, active “core.” So we decided to do our own research into these accounts: Who was behind them? And what were they doing?