The Second War with Telegram: Will the Kremlin succeed in ‘reverse’ isolating the Runet this time?

Seven years of creating the Runet zone

The current moment in the pursuit of the historic task of ‘reverse’ isolating the Runet is the result of the Kremlin’s not always consistent, but steady advance towards this goal over the past seven years. The process, incidentally, was set in motion by the failed attempt to ‘ban’ Telegram in 2018, when Roskomnadzor attempted, and failed, to achieve this by blocking the IP addresses used by the messenger. Since then, a multilayered technical foundation has been created in Russia to implement the project of ‘reverse’ isolation.

The first key step along this path was the 2019 federal law on the ‘sovereign internet’ (Federal Law No. 90 of 1 May 2019), which formally declared the creation of reserve infrastructure in the event of an external threat to the Runet, but in practice laid the groundwork for its autonomy. The law required all providers to use the National Domain Name System (NSDI), a Russian DNS server infrastructure that establishes a national layer of request routing, enabling Roskomnadzor to intervene in this process, including substituting addresses, redirecting users to other resources, or making websites ‘non-existent’. Thus, in February 2026, the domains of at least 13 resources, including YouTube, WhatsApp and Facebook, disappeared from the Russian national DNS registry, meaning that users connected via the NSDI were deprived of the very ability to locate these sites.

A second level of control was provided by the deployment of so-called technical means of countering threats (TSPU), devices for the centralised filtering and blocking of traffic. These were also provided for by the 2019 law,but their mass rollout, requiring mandatory installation on the provider side, began in 2020 and was completed by 2023. If a user circumvents the NSDI, for example by entering an IP address manually or using a foreign DNS server, blocking is enforced by TSPU, which, using Deep Packet Inspection technology, analyse the contents of each packet and enable traffic to be blocked, slowed or redirected at the discretion of Roskomnadzor. These blocks do not appear in any public register and are inherently opaque. The authors of the MediaMetriqa channel on Habr note that in recent years DPI systems have effectively operated in a self-learning mode, accumulating information and statistics on patterns of typical traffic, including that passing through VPNs. It was assumed that, armed with this data, DPI would be able to distinguish between and block different types of traffic.

The third layer of the control system is the National Certification Authority (NCA), established after the invasion of Ukraine, when Russian resources began losing Western security certificates from providers such as DigiCert and Let’s Encrypt,which verify site ownership and confirm encryption between server and user. The new centre began issuing its own certificates, which became mandatory for Runet websites, although they only function properly with Russia-produced browsers. This enables Roskomnadzor to view the content of connections that the user assumes to be encrypted.

New restrictive technologies were deployed following the outbreak of the war in Ukraine. In March 2022, the Russian authorities blocked Facebook, Instagram, Twitter and, to some extent, TikTok almost simultaneously, and in 2024 began to slow down YouTube. In August 2025, the functionality of the highly popular messaging platforms WhatsApp and Telegram began to be curtailed, initially by restricting voice and video calls, and in November Roskomnadzor launched a gradual ‘degradation’ of WhatsApp to encourage users to migrate to the national messenger MAX. Each time, the blocking of networks and services produced a significant initial effect, reducing user numbers, but this was followed by stabilisation and even renewed growth.

The logical culmination of the Runet isolation architecture is intended to be ‘whitelists’ of permitted sites, marking a shift from negative filtering, based on blocking, to positive filtering, whereby everything is blocked except specifically approved traffic. The operation of the internet under such a regime has been repeatedly tested by Roskomnadzor in exercises on ‘internet isolation’. Since June 2025, temporary shutdowns of mobile internet across Russia have become widespread. On the one hand, these were seen as tests of whitelist technologies; on the other, they performed a social function, habituating citizens to digital disenfranchisement and a degradation of digital comfort. In the longer term, the gradual expansion of whitelist technologies could form the basis for a fully sovereign Runet, in which only authorised resources are accessible (→ Re:Russia: Whitelists of Dark Times). In practice, however, this still appears some way off.

Following the Iranian path

The trajectory of the Russian authorities’ fight against ‘banned content’ largely mirrors the history of internet censorship in Iran (→ Re:Russia: Following The Ayatollah). The underlying logic is that an authoritarian government’s active campaign against independent sources of information and networked freedom, through the blocking of undesirable and uncontrolled sites and services, leads to a rapid increase in the popularity of Telegram, which becomes a de facto single gateway to the world of ‘banned information’ and an archipelago of digital freedom. As the authorities, recognising this dynamic, move to confront Telegram itself, there follows a rapid rise in the use of VPN services. In Iran, this process began in the second half of the 2010s and ran its course earlier. The regime of the ayatollahs ultimately failed in this struggle as a result of the mass spread of VPNs, primarily used to access Telegram. Russia effectively embarked on the same path with the start of the full-scale invasion of Ukraine, as the blocking of internet resources, networks and services began to expand rapidly.

This period predictably became a golden age for Telegram. According to data from Mediascope, immediately after Instagram was blocked in March 2022, Telegram’s average daily reach rose from 23% to 33%, reaching 47% by the end of 2023, 52% by the end of 2024, 60% by the end of 2025, and 65% by February 2026. In other words, within the first year of the war Telegram’s audience doubled, as much of the Russian media ecosystem migrated to its platform. In 2023, audience growth slowed to around +20% annually, and to +6% in 2024. However, in the second half of 2025 and early 2026, growth rates returned to approximately +20% per year. The latest strengthening of Telegram is likely a consequence of the ‘degradation’ of WhatsApp.

Average daily audience reach of Telegram and VKontakte, 2022–2026, % of population (aged 12+)

According to data from the Levada Centre, at the start of 2022, only 7–8% of those surveyed cited Telegram among their main sources of information. By the second half of 2025 and early 2026, this figure had risen to 25–28%. The surge in popularity occurred in 2022 and the first half of 2023. In March 2026, in response to a different question from the Levada Centre, 20% of those surveyed said they read Telegram daily, 14% said almost every day, and a further 15% said at least once a week, for a total of 49%. In a survey by the ExtremeScan project in February 2026 (full data available from Re:Russia), 50% named Telegram as a source of information, while 66% reported having used the platform in the previous three months.

The surveys conducted in February–March 2026 were conducted against the backdrop of the Kremlin’s declared vendetta against Telegram and a large-scale campaign to stigmatise the platform. This suggests that some respondents may have been reluctant to disclose their trust in it during polling. Thus, the survey data indicates that around 60% of the adult population is a part of Telegram’s audience. To this should be added the teenage demographic, which is not covered by standard surveys (according to Rosstat estimates, the number of Russian residents aged 14–17 reaches 6 million). In an online panel survey conducted by the Russian Field project (CAWI, 1,000 respondents, 5–9 March 2026), more than 90% of participants identified Telegram as a social network they use regularly (with TikTok in second place at 73%), and 56% named it as a source of news. On the basis of this survey data, Telegram’s audience can be estimated at approximately 65–70 million people. Including adolescents, the figure is likely closer to the upper bound. According to Mediascope data, the platform’s monthly audience stood at around 94 million users at the beginning of 2026.

Consequently, any blocking measures are not only of limited effectiveness so long as Telegram remains accessible, but also contribute to the further growth of its weight and influence. This dynamic, alongside the apparent failure of the MAX messenger, may have prompted the Kremlin to initiate what amounts to an ‘all-out war’ against Pavel Durov’s platform.

At the same time, the popularity of VPN services has, in effect, followed in the footsteps of Telegram’s popularity. According to survey data from the Levada Centre, at the beginning of 2022, 23% of those surveyed used VPNs, while 28% were aware of their existence. The first figure remained largely unchanged until 2024, at around 25%, although awareness rose to 36%. This is readily explained by the fact that most prohibited content, along with users of blocked social networks, migrated to Telegram during this period, when the authorities had not yet launched a campaign against it. For those who did not seek to retain access to the full range of social media and content, there was no urgent need for VPNs. However, at the beginning of 2025, a sharp increase in VPN usage was recorded in connection with the authorities’ campaign against YouTube. At that point, according to the Levada Centre, 36% were already using VPNs. The same figure, 36%, appears in the most recent survey from March 2026. Polls by FOM and ExtremeScan produce similar figures for early 2025 and for 2026.

It is important to bear in mind, however, that the 2026 surveys (February–March)were conducted amid an official campaign to stigmatise and restrict VPN services, which is likely to have affected the candour of responses. Media sources also cite a figure of 39% for VPN usage in Russia, which stems from an unattributed comment by an‘expert in artificial intelligence and information technology’ in a Kommersant article without attribution to a survey. In a FOM survey conducted in early March 2025, a question on VPN usage was included (see table below), and it may reasonably be assumed that this question was repeated a year later. However, the results were not published, likely due to their political sensitivity, which would be consistent with FOM’s usual practice. It is possible that these unpublished findings are those referenced by the Kommersant expert.

‘Do you use services to access the internet without restrictions, such as a VPN? If so, how often?’, March 2022–2026, % of those surveyed

VPN usage according to various survey data, February–March 2025 and 2026, % of those surveyed

Taking into account the ‘insincerity’ factor, we are inclined to adjust survey estimates of VPN usage upwards to around 45%+ of the adult population. Among those aged 18–40, the share using VPNs reaches 55–60%, according to data from the Levada Centre. Finally, the proportion of those who either use VPNs or are aware of this option reaches 75% of the adult population. It is also worth noting that the proportion of those who use VPNs accounts for roughly three quarters of the Telegram user base. This is hardly surprising: most of the groups, services and resources that have built their audiences on Telegram in recent years have actively prepared for potential blocking and have consistently promoted VPN solutions. The paradox is that the rise in VPN usage drives a corresponding increase in user activity, including on previously banned platforms such as Instagram and YouTube, which is reflected in certain statistical indicators (→ Re:Russia: The Unclosed Curtain).

Throughout the years of the war, as the regime’s pressure on the digital environment has intensified, the role of Telegram as the core infrastructure of public communication has steadily increased. As threats to Telegram and its associated digital ecosystem have grown, so too has the scale of VPN usage.

The inverse logic of digital resistance

In his famous post on digital resistance on 4 April, Pavel Durov referred to 65 million Russians using Telegram via VPN and 50 million sending messages daily. In our view, the total Telegram audience at the beginning of March was somewhat higher than this figure, while the number of VPN users was somewhat lower. That said, March may well have seen a sharp surge in the use of circumvention tools.

The current phase of the struggle over the ‘reverse’ isolation of the Runet can be dated to 10 February 2026, when Roskomnadzor confirmed the slowing down of Telegram, and then announced that the messenger would be blocked in early April. According to data from the ‘Na Svyazi’ monitoring project,by late March the mobile and web versions of the service in Russia were accessible in only around one in four attempts. According to data from the Levada Centre, 77% of those surveyed had experienced difficulties accessing mobile internet over the previous month, while 74% had encountered problems accessing social media. A March survey by ExtremeScan reported similar figures, with 76% experiencing disruptions to messaging services. When asked which current restrictions caused inconvenience, 47% cited blocking, rising to two thirds among those under 40.

It is important to stress that this form of digital VPN-based resistance is, in large part, not inherently political. Since 2020, when earlier restrictions introduced in 2018 were lifted, and especially during the war years, Telegram has evolved into a universal environment for communication and information in Russia, encompassing personal and networked interactions, business, media, and even communication between the state and citizens. The latter functions have become particularly salient as television has lost its status as a universal national communication channel during the war, becoming instead one channel among many, primarily oriented towards older audiences (→ Re:Russia: The War Has Killed Television).

Consequently, the crackdown on Telegram has generated an unusual degree of political stress in contemporary Russia and provoked a wave of protest sentiment across diverse segments of society. According to numerous pro-war bloggers and military correspondents, Telegram serves as a primary communication tool for Russian military personnel, and its restriction undermines coordination, the exchange of experience and the flow of information. A second major affected cluster is business, both large and small, for which Telegram functions as a universal medium for internal and external communication and as a working environment. Discontent is also evident within the political and administrative strata of the regime itself, including governors, deputies, bureaucrats and propagandists. As calculated by Novaya Gazeta, pro-government channels on the platform lost 40% of their views in the second half of March due to blocking, compared with 17% for opposition channels, whose audiences are more accustomed to circumvention tools and VPN usage. Cautious critics of the tightening controls over the internet among deputies and officials have become figures in the news agenda. This includes representatives of the generally marginal, Kremlin-backed party ‘New People’, whose leader recently spoke out against the blocks, as well as a deputy from the Communist Party who proposed renaming the Ministry of Digital Development to the Ministry of Digital Degradation.

Public discontent, particularly pronounced among young people, has resulted in an attempt to organise the first coordinated, large-scale protest in the country since 2022. On 14 March, Dmitry Kisiev, former head of Boris Nadezhdin’s campaign team in the 2024 presidential election, announced mass protests against internet blocking on 29 March, a date chosen as a symbolic reference to Article 29 of the Constitution, which guarantees freedom of thought and speech. Demonstrations were planned in at least 28 cities, but none were authorised. Videos calling for people to attend were circulated on TikTok bearing the logo of the ‘Scarlet Swan’ movement, according to reports by the ‘Horizontal Russia’ portal. On 19 March, in Moscow, Sofya Chepik, administrator of the movement’s chat, was detained for a ‘preventive’ interview. Nevertheless, on 29 March, youth gatherings took place at some ‘protest’ locations across the country; in particular, several dozen people, mostly teenagers, gathered in Moscow on Bolotnaya Square, with 17 detained. Two more people were detained in St Petersburg and one in Voronezh.

The inverse logic of digital resistance lies in the fact that most Telegram users did not migrate to the platform primarily for access to independent information or for political engagement. The shutdowns of mobile internet, the offensive against Telegram, and subsequently against VPN technologies constitute the most significant encroachment on the comfort zone of apolitical citizens since the ‘partial mobilisation’. For these individuals, whose apoliticism functioned as a form of tacit loyalty, this encroachment is now becoming a driver of politicisation.

This does not, however, imply direct politicisation in the form of mass protest mobilisation. For the apolitical majority of Telegram users in Russia, the offensive against the platform appears irrational, particularly in light of the authorities’ failure to create a viable alternative in the form of the ‘national messenger’ MAX. Although its formal metrics are growing rapidly, according to Mediascope it has already reached an average daily reach of 50% of the population, its functionality and reliability remain extremely low. This, alongside the regime’s inability to prevail in the war in Ukraine, delivers a double blow to the regime’s reputation, that is, to perceptions of its effectiveness and capacity to achieve stated objectives. This blow will be all the more acute if the goal of blocking Telegram and restricting VPN usage once again proves to be unattainable.

Between destabilisation and degradation

Although the Kremlin is entering the decisive battle against the Telegram-VPN nexus with far greater technical preparedness than both Russian and Iranian authorities demonstrated in 2018, the scale of the challenge has also changed significantly, and the current level of preparedness may prove insufficient. Today, the Runet is not merely a highly developed segment of the global network, but also a vast domain of internet-based economic activity and commerce, while the level of digital literacy and sophistication among both individual and corporate users is incomparably higher.

The principal weak point in the authorities’ crackdown appears to be the capacity of the TSPU systems, which bear the primary burden of real-time traffic analysis. According to the Ministry of Digital Development’s action plan, as reported by Kommersant, the total capacity of deployed TSPU systems in 2025 stood at 382 terabits per second, ostensibly sufficient for full traffic control. However, by mid-March, industry sources claimed that Roskomnadzor was no longer coping with this load, prompting a revision of capacity expansion plans. Capacity is now expected to rise to 460 Tbit/s in 2026 and to 954 Tbit/s by 2030. At the same time, analysts estimate that the declared capacities of leading operators currently amount to 132 Tbit/s, implying that infrastructure equivalent to roughly three times this figure must already be deployed elsewhere.

Furthermore, in real-world conditions, the traffic control system also faces challenges arising from user adaptation and resistance. For instance, TSPU systems are reportedly being overloaded by Telegram’s new built-in proxy, MTProxy, which generates significant volumes of ancillary ‘noise’ traffic, according to sources cited by Forbes. As a result of overload, the system intermittently and unpredictably switches into bypass mode, allowing traffic to pass through and thereby restoring access to previously blocked resources, including WhatsApp. In addition, substantial system capacity is being diverted to the detection of VPNs. Since summer 2023 to early 2024, Roskomnadzor has blocked widely used VPN protocols including OpenVPN, WireGuard, IKEv2 and Shadowsocks; since late last year it has added three more, VLESS, SOCKS5 and L2TP, and by the end of February this year it reported having blocked 469 VPN services. However, as the developer of MegaV VPN explains in a blog post, the regulator has been most effective in blocking VPN services that reveal themselves through distinctive behavioural patterns. For example, DPI packet inspection systems can identify OpenVPN and WireGuard through fingerprinting. Another effective blocking method has been active probing: once a connection is established between a VPN client and server, the system can initiate its own connection to the same IP address, and if this ‘probe’ confirms that the IP belongs to a blacklisted VPN, the address is blocked.

None of these techniques, however, can reliably detect VPNs that disguise their activity as standard HTTPS browser traffic, so called obfuscation protocols, the MegaV VPN developer notes. Protocols such as VLESS + Reality (XRay), ProtonVPN Stealth and Windscribe Stealth, use a legitimate domain from the ‘whitelist’ as the server name indicator (SNI), such as tunnel.vk-apps.com or browser.yandex.com. Attempting to identify all types of encryption risks blocking thousands of corporate systems, international banking connections and CDN networks that use them. When blocking a protocol, the system cannot distinguish legitimate financial traffic that uses similar cryptographic methods. As a result, a further proposed solution is the creation of white and black lists of VPNs, which would place additional strain on the system.

On 3 April 2026, Roskomnadzor’s actions triggered a major disruption across the Russian internet, affecting banking applications and services of Sberbank, VTB, Alfa-Bank, T-Bank and Gazprombank. Turnstiles in the Moscow metro and on suburban rail services stopped accepting bank cards, forcing staff to allow passengers through without charge in order to prevent crowding. Within the first hour alone, more than 3,300 complaints were recorded regarding Sberbank services (primarily from Moscow, St Petersburg and Sverdlovsk region). Fedor Muzalevsky, Director of the Technical Department at RTM Group, stated that the disruption to banking services was the result of ‘friendly fire’ caused by VPN blocking. Telegram founder Pavel Durov likewise wrote that the ‘large-scale banking disruption’ was caused precisely by internet blocking, claiming that ‘the whole country has mobilised to circumvent these absurd restrictions’.

Even Natalya Kaspersky, co-founder of Kaspersky Lab and a staunch supporter of the Kremlin, wrote on her Telegram channel that Roskomnadzor, ‘in its frenzy to counter the circumvention of blocks, has brought down half of the services on the Runet’. She added that experts had told her there is no technical means of blocking VPNs without disrupting the wider internet. Later the same day, however, she issued a retraction following a conversation with Roskomnadzor head Andrey Lipov. The agency is extremely sensitive to reports about its inability to fulfil its mandate. According to the Dvach channel, Roskomnadzor instructed Russian media outlets to remove reports linking the large-scale disruption to its blocking measures, arguing that such material was ‘aimed at destabilising the socio-political situation in the Russian Federation’. Three days later, another major outage affected Rostelecom, Alfa-Bank, NTV Plus, Tricolor, Gosuslugi, T2 and other services. Roskomnadzor attributed this incident to a fault on Rostelecom’s backbone network.

Further evidence that Roskomnadzor is struggling to meet its objectives is provided by a subsequent stopgap measure: shifting responsibility for combating VPN usage onto the digital commerce sector itself. According to RBC, in late March the Minister of Digital Development, Maksut Shadayev, held a meeting with the heads of Russia’s largest online platforms by monthly active users, including Sberbank, Yandex, VK, Wildberries & Russ, Ozon and others, instructing them to restrict access to users with VPNs enabled by 15 April. These measures began to take effect on 7 April, when users accessing marketplaces such as Wildberries, Ozon and VkusVill via VPN reported difficulties loading product pages and completing purchases, Izvestia reported.

In parallel, the Ministry of Digital Development has increased pressure on IT companies to assist in identifying VPN traffic. As Kommersant reported, at the end of March, the Ministry of Digital Development began considering revoking IT accreditation from companies that fail to restrict access via VPN, which would deprive them of various benefits, including VAT exemptions and a reduced corporate profit tax rate of 5%. On 5 April, the ministry sent a guidance document to the largest internet companies outlining methods for identifying VPN traffic. However, diverting resources of major market participants towards VPN enforcement is likely to impose significant costs on them and confer a relative advantage on smaller competitors that do not bear these obligations.

The result of the regime’s determined campaign against Telegram and VPNs has been growing disorder and degradation across the Russian internet segment. A central issue remains the absence of a viable alternative to Telegram, compelling users at all levels to devote increasing effort to circumventing new restrictions. A fundamental reason for the failure of the MAX messenger project lies in the prioritisation of total control in its design over the interests of users. The regime is now attempting to shift the consequences and costs of this failure onto individual and corporate users of the Russian internet. Such a strategy undermines the formation of stable compliance with official requirements, as compliance entails a marked deterioration in the level of digital convenience to which users have become accustomed. As with the ‘special military operation’, public acquiescence to the Kremlin’s objectives, which are not always clearly understood by the population, has been predicated on assurances that they can be achieved without significant costs to citizens. The inability to meet these objectives is now translating into the imposition of increasing ancillary costs on the population, which is likely to prompt a reassessment of the regime’s capacity and of the implicit social contract. While such a reassessment does not in itself pose an immediate governance or political crisis, it is likely to contribute to a gradual erosion of loyalty.