KYIV, Ukraine — From a hotel on a posh street in Barcelona, a 22-year-old Ukrainian in a red beanie and big black headphones is helping take down some of Russia’s most powerful websites — including state media and even the official page of the Kremlin.

Alex Horlan would prefer to be at home, preparing to confront the Russian invasion of his homeland with a gun. But when he got stuck in Spain after Ukraine’s airports closed last week, he tapped into his expertise in cybersecurity to launch his own war against Russia online.

The attacks he and others are helping to carry out on Russian websites are part of a wide information war in the background of the much larger conflict here, as Ukrainians target Russian websites to rewrite the narrative Moscow is presenting to Russians back home.

“We are creating an IT army,” Ukrainian vice prime minister Mykhailo Fedorov tweeted last week.

Horlan is a cybersecurity expert who recently launched an app called Disbalancer that helps take down scam websites by overwhelming them with online traffic. He has redirected his team’s efforts in recent days to instead target Russian websites he says are spreading dangerous disinformation about the Russian invasion of Ukraine.

The pages they are most eager to shut down, if only temporarily, are any that suggest the Russian invasion “is not a war” or that Russia is in fact “helping the Ukrainian people,” Horlan said.

“A lot of people are dying right now and the Russian people must know it because if they don’t know that, they can’t even try to help,” he said.

Historically, it’s been Russia that has faced accusations of hacking Ukraine. But as much of the country hunkers down at home or in bunkers, the war is increasingly playing out not just in the sky and on the ground but also on residents’ laptops and phones, with much of the coordination happening on the Telegram app.

The war within the war is important. Thousands of people are joining Horlan and others’ efforts to target the Russian sites, with around 2,000 logging into his app at any given time, he said. The main challenge is that many are losing WiFi when air raid sirens force them to retreat to underground bunkers.

“We have two types of warriors,” said Liuba Tsbulska, a Ukrainian analyst and activist who has tracked Russian disinformation for eight years. “First, military warriors, those who defend us physically. And we have information warriors, those who fight against Russian disinformation, Russian special forces psychological information operations and so on.”

She said the goal of those campaigns “is to demoralize society, to spread panic, to basically bread them down psychologically so they would stop supporting the army and start thinking about surrendering.”

The Russian disinformation campaign, she said, has been intensifying since the Russians invaded Ukraine last week. But so has the Ukrainian response. Volunteers are gathering information on attacks and casualties to fact check and challenge Russia’s version of events, she said, posting messages on Telegram and other Russian social media platforms. Others work to educate international audiences or produce patriotic content.

Some also target Russian military and intelligence officers, flooding their emails and other platforms with messages. Volunteers are reaching out to the mothers of Russian soldiers to convince them to call for Putin to bring their boys back home.

In Kharkiv, after reports that Russian troops and armored vehicles entered Ukraine’s second largest city early Sunday, one local Telegram channel with more than 400,000 subscribers urged people to continue to document the adversary’s movements as a way to aid Ukraine’s forces in the area.

In one message, the Truha Kharkiv channel asked citizens to “carefully film and send information about the movement of Russian troops to our channel. This is vital to the defense of our city.”

Another message instructed citizens on how to make molotov cocktails.

Videos posted to social media of Ukrainians interacting with Russian troops in some cities have also served to debunk Russian propaganda claims.

In one from Melitopol, a southeastern city that came under Russian control, a man scolds Russian troops, asking, “What are you doing here?” Meanwhile, the Russian Ministry of Defense had alleged that elderly residents greeted Russian soldiers waving red flags.

On Sunday, Telegram founder Pavel Durov warned users to carefully consider the information they read about Ukraine on Telegram, noting they do not have the “physical capability to check all publications on channels for accuracy.”

In the capital on Sunday, the streets were eerily quiet. The only vehicles driving appeared to belong to members of the security forces, intelligence organizations and Kyiv’s territorial defense forces, composed of civilians who signed up to fight and were issued weapons to protect their neighborhoods.

Their objective was to find Russian “saboteurs” who had infiltrated the city. Ukraine’s President Volodymyr Zelensky, in a video address, said that Russian units had entered Kyiv and that he was “target No. 1” followed by his family. A 36-hour curfew, starting Saturday night and ending Monday, was intended to flush out these saboteurs, Ukrainian officials said.

They urged residents to report suspicious people in their neighborhoods, including anyone wearing red armbands that they said was how the saboteurs identified each other.

In the late morning, a group from the territorial defense forces deployed in the city’s center stopped an ambulance after receiving information that saboteurs were using ambulances to sow chaos, according to a hotel security guard who witnessed the stop. The militiamen checked the vehicle and let it go, satisfied that it contained medical personnel.

Later in the afternoon, Anton Herashchenko, an adviser to Ukraine’s Interior Ministry declared on his Telegram channel that “a group of Chechen saboteurs who were moving around Kyiv in an ambulance had just been shot by the valiant Ukrainian military intelligence officers in Kyiv, partly shot, partly detained!”

His claim could not be independently verified.

Andriy Kozinchuk, a psychologist and veteran who is now serving in the territorial defense, said that he and his colleagues were forced to deploy their weapons on Saturday night. “The main task was to prevent the sabotage group’s activities,” he said.

On the questions of saboteurs in Kyiv, Tsbulska said it could be possible that Russia is sowing disinformation to inflict fear into residents and distract the government. There have been Russian-origin messages on Telegram declaring the Chechens were coming to kill Ukrainians, she said.

But she also said it’s possible the threats are real. Russia, she said, has a history of using unconventional military tactics such as disguising their soldiers in enemy uniforms or sending spies and covert operatives into enemy territories.

“They apply different techniques, and disinformation is one of the main parts of this war,” she said.

Lina, an employee at the guard’s hotel, said the Russian disinformation campaign is still going on in Donetsk, where her father lives. She recently contacted her father’s neighbor to ask him to go next door and knock on her father’s door and check if he was safe.

“There is no war,” Lina recalled the neighbor saying. “The Russians are not fighting you.”

She told him she was in the basement to keep safe from the bombing. But he still refused to believe her, and “so I kept my mouth shut,” she said. “We have different views.”

Khurshudyan reported from Khirkiv, Ukraine.