In the early days of Russia's full-scale invasion of Ukraine, as Moscow's forces surged toward Kyiv, online photos of crosses on Ukrainian infrastructure sparked widespread fears of potential Russian missile attacks. Nearly two years later, the question remains: Were these crosses for real, and, if so, who painted them and why?
Sometimes it was a red Celtic cross on a road or on the roof of an apartment building, other times, a miniature black cross on a gas line, or a mark on a power substation.
An investigation by Systema, RFE/RL's Russian investigative unit, found that a social-media disinformation campaign by Russian ultranationalists to "paralyze" Ukrainian emergency services and law enforcement during the war was behind at least some of the images.
In the first year of Russia's full-scale invasion, roughly half of the 50,000 messages received by a Ukrainian government chatbot about Russian military movements concerned these crosses, according to the National Police of Ukraine's Cyber-Police Department, which runs the bot.
Journalists found no concrete evidence that the crosses were the work of Russian military intelligence, known as the GRU. But both the Security Service of Ukraine (SBU) and the Interior Ministry asked Ukrainians to conceal any such marks they saw.
A diplomatic source in Kyiv told Systema that the Ukrainian government and military also had asked diplomats to look for marks on the roofs of diplomatic missions.
The earliest social media post about the marks appeared on February 24, 2022, the first day of the invasion, in the official Facebook group for Novhorodka, a town in Kirovohrad Province about 340 kilometers southeast of Kyiv.
Two photos showed green and red crosses, each with a circle in the center, painted on a highway and a strip of road that Systema geolocated to a feeder road off a highway near Novhorodka.
The caption described the signs as "for landing enemy paratrooper(s)" and advised that they should be covered with earth, rubber, or paint.
The secretary of the Novhorodka administration, Oleh Vyetrov, told Systema that he himself had photographed the red cross after social media users had sent him photos of crosses. He could no longer recall who these users were.
The people who painted the crosses were never found, though rumors circulated in the village about individuals in Toyotas stopping along local roads, Vyetrov said.
With an official population of under 6,000 people, the farmland town of Novhorodka might not seem like a priority target for attacks, though Russian missiles have hit the broader region repeatedly during the invasion.
But as Ukrainians nationwide sheltered from a barrage of Russian missile attacks amid a three-pronged invasion from the north, south, and east, photographs of other crosses began to spread online.
The crosses panic lasted three full days. On February 27, 2022, then Ukrainian presidential office adviser Oleksiy Arestovych underlined, on behalf of the military, that the crosses served no military purpose -- apart from sowing chaos.
"The military equipment of today isn't guided by signs on roads. It's guided with the help of other modern technical means," Arestovych said in a briefing. "This practice [of painting crosses] could be set up to spark spy mania among us."
For Russian ultranationalist Igor Mangushev, Arestovych's words signaled success: "Every distracted cop is minus one gun. Every SBU officer catching 'saboteurs' is minus one gun," Mangushev wrote in a post on his Telegram channel Zapiski avantyurista (Notes Of An Adventurist) on February 27, 2022.
Mangushev styled himself as a disinformation impresario, "part PR person, part political strategist, part solider," as well as "a con man and mercenary," his Telegram biography reads.
An ardent ultranationalist notorious for displaying what was purportedly the skull of a Ukrainian soldier at an August 2022 event in the Russian-occupied city of Donetsk, he fought against Ukrainian government forces in the Luhansk region beginning in 2014. He reportedly had ties with figures and forces ranging from the late Russian mercenary boss Yevgeny Prigozhin to the GRU.
In February 2022, he was living in Beirut to avoid the risk of criminal prosecution in Russia for a far-right movement he had co-led, E.N.O.T. (United People's Community Partnerships). While in Lebanon, he organized rallies in support of Russia's war against Ukraine, including one attended by the Russian ambassador to Lebanon, Aleksandr Rudakov.
But he saw "scandalous information campaigns" as his mission -- "not just how I earn a living, but my hobby," he told the liberal Russian daily Novaya Gazeta in 2019.
One day after the start of the full-scale invasion, on February 25, Mangushev called on "fighters in the information war" to sow "panic" among Ukrainians and to organize the "paralysis" of the Ukrainian security agencies and emergency services by attacking the Ukrainian cyber-police's bot and by calling the SBU, the Interior Ministry, and fire stations with false reports about saboteurs and artillery spotters.
On February 26, Mangushev also urged his Telegram readers to call Ukrainian territorial defense forces from Ukrainian Internet phone numbers and inform them about "ballistic crosses."
Mangushev's widow, Tatyana Azarevich, said these crosses were her husband's idea.
"The crosses, flooding ambulance phone lines with fake calls, bot attacks, using the Z symbol -- that's all his doing. He tried to create maximum chaos," she told Systema in January.
Mangushev attributed the "chaos" approach to the Russian military chief of staff, General Valery Gerasimov, and was eager to implement it, former associate Vladislav Ugolny told Systema, also in January. Ugolny, a blogger, said rumors that had circulated in the region in 2014 about red jackets and T-shirts symbolizing support for the Ukrainian military had inspired the red crosses.
"We projected the Luhansk experience onto Kyiv," he said.
In his February 27, 2022 Telegram post, Mangushev scoffed at conjecture that "professionals from the GRU" or a Russian military psychological operation had overseen the campaign.
Rather, on March 25, 2022, he claimed that "the creators of a few Telegram channels and their subscribers" were responsible.
He attributed the idea to "a few drunken media people." The first such marks, he said in a June 6, 2022 article on the Russian website Ukraina.ru, had been drawn by "our friends," described as "juvenile drug addicts," on the roof of a house in Moscow's Altufyevo district.
"Our volunteers broke into Ukrainian chat rooms, (and then) distributed information about saboteurs drawing marks," he claimed.
How many people took part in any such campaign -- and what happened to them -- is unknown. When the full-scale invasion began, Mangushev's Telegram channel had fewer than 6,000 subscribers, according to TGStat, a service that analyzes Telegram traffic.
Following Mangushev's violent death in 2023, multiple claims surfaced about the crosses' origin and the ultranationalist's ties. A former media manager for Prigozhin, Sergei Zagatin, has claimed co-creation of the crosses, while Dossier Center, an investigative news outlet funded by exiled former oil tycoon Mikhail Khodorkovsky, a vocal critic of Putin, reported that a GRU colonel's "working papers" had mentioned plans to pay Mangushev 4,000 euros ($4,032) a month to run a GRU front organization. The Dossier Center report did not show official documents proving this specific claim but included related materials including leaked e-mails from the purported GRU officer.
Azarevich claimed her husband organized the campaign by phone only in the eastern Ukrainian city of Kharkiv. Ugolny, who said he didn't work on the crosses, attributed their spread to "our supporters in Kyiv."
"It wasn't anything very complicated," he said. "They just put down a series of marks."
In February and March 2022, Ukrainian media reported on dozens of detentions for drawing crosses and marks, but Ukrainian law-enforcement sources told Systema that police had let such detainees go after issuing a warning. The Ukrainian court registry's cases mostly involve fines or warnings, including for the parents of children making prank calls.
Kateryna Bazykina, 25, a native of the eastern Ukrainian mining town of Novohrodivka, is an exception. Bazykina was sentenced in August 2023 to 12 years of prison for state treason and "prior conspiracy," including for allegedly painting five crosses on February 25, 2022, in Novohrodivka at the behest of a Russian soldier.
The Dnipro court of appeals later ruled that Bazykina's recruitment had not been proven -- despite a police video in which she claimed that a Donetsk separatist fighter had paid her 2,000 hryvnyas ($52) for each of the marks.
Bazykina's case is now under review, though she remains in prison.
Prosecutors assert Basykina delivered the photos via an Instagram intermediary. The man she identified in the video for this role, a former neighbor, Vladislav Khmelevoi, however, dismissed the assertion that the Russian military recruited Bazykina to draw crosses as "total nonsense."
"It's a digital world now. To carry out a strike, it's enough just to have an address, without crosses, or to have a photo with the coordinates," Khmelevoi, who fought for Russian-backed forces in the Donbas beginning in 2014, told Systema in a Telegram chat from Moscow in January. "I could identify any military facility without the help of recruiting (anyone)."
Claiming that the "special services" shut down his Instagram account before 2023, he denied he had conversed with Bazykina on Instagram. He refused to answer whether he knew Mangushev.
Mangushev died in Ukraine in February 2023, when he was commanding an anti-drone unit during the Russian withdrawal from the Luhansk region city of Kadiyivka.
Russia's Investigative Committee is still examining the circumstances of Mangushev's death from a noncombat-related gunshot wound to the head, his widow said.
Whether his creation or not, the crosses live on -- ironically, most recently in Russia, where they were sighted on streets in Moscow before the World War II Victory Day celebrations in May 2023.
