Russian Bot Farm Disrupted by Ukrainian Authorities in Disinformation Crackdown

Ukrainian Authorities Bust Major Bot Farm Linked to Russian Intelligence

Ukrainian security forces have dismantled a sophisticated operation that created thousands of fake social media accounts used by Russian intelligence services to spread disinformation and propaganda against Ukraine, authorities announced Wednesday.

The Security Service of Ukraine (SBU) and the National Police conducted a joint operation in the Zhytomyr region, where they arrested a suspect who allegedly managed a bot farm that provided more than 20,000 fraudulent accounts to Russian intelligence operations.

“Through these actions, the enemy sought to provoke panic among the population and destabilize the sociopolitical environment of Ukraine,” Ukrainian authorities stated in their official release.

According to investigators, the accounts were primarily deployed on Telegram and other platforms to disseminate Kremlin propaganda and create a false impression of Ukrainian public opinion. The fake profiles would pose as ordinary Ukrainian citizens while spreading alarming misinformation, including fabricated bomb threats targeting various Ukrainian facilities.

During the raid on the suspect’s residence, authorities seized substantial evidence, including computer equipment, mobile phones, USB hubs connected to multiple devices, and nearly 2,000 SIM cards from various Ukrainian mobile operators. This hardware infrastructure allowed the operation to generate and manage the fake accounts at scale.

The operation was particularly prolific in creating Telegram accounts, a platform that has become increasingly important in the information war between Russia and Ukraine. Investigators revealed that the suspect sold more than 3,000 fraudulent Telegram accounts monthly to Russian clients. These accounts were created using Ukrainian phone numbers to appear authentic and were subsequently promoted on digital platforms frequented by pro-Russian actors.

This case highlights the evolving nature of information warfare in the ongoing conflict between Russia and Ukraine. Since Russia’s full-scale invasion in February 2022, both sides have engaged in cyber operations, but Russia has been particularly active in deploying disinformation campaigns to undermine Ukrainian morale and international support.

Digital security experts note that such bot farms represent just one component of a broader Russian strategy that combines traditional propaganda with sophisticated digital operations. The use of fake bomb threats is a tactic previously observed in Russian information campaigns, designed to create public anxiety and strain emergency response resources.

“These operations are becoming increasingly sophisticated and difficult to detect,” said Mykhailo Fedorov, Ukraine’s Minister of Digital Transformation, in a recent statement about digital threats facing the country. “They’re designed to look authentic and exploit existing societal tensions.”

The suspect has been charged under section 2 of article 361 of the Ukrainian Criminal Code, which addresses unauthorized interference in computer systems, electronic communication networks, and information systems committed by a group of people with prior agreement. This suggests investigators believe others may be involved in the operation.

If convicted, the detainee could face up to six years in prison. However, authorities indicated that the investigation is ongoing, and additional charges may be forthcoming as they uncover more details about the operation and potential accomplices.

The SBU has intensified its efforts to counter Russian information operations since the beginning of the conflict, working closely with international partners to identify and neutralize digital threats. This latest bust represents one of the larger operations disrupted in recent months.

Ukrainian officials have repeatedly warned about the dangers of Russian disinformation and its potential to influence both domestic and international perceptions of the conflict. They continue to urge citizens to verify information sources and report suspicious online activity.