Ukrainian Authorities Dismantle Major Bot Farm Linked to Russian Intelligence

Ukrainian authorities have successfully dismantled a sophisticated “bot farm” operation that was providing thousands of fraudulent social media accounts to Russian intelligence services, marking another development in the ongoing information warfare dimension of the Russia-Ukraine conflict.

In a coordinated operation in the northern city of Zhytomyr, Ukraine’s Security Service (SBU) and the National Police detained the suspected organizer of the network and blocked nearly 20,000 fake online profiles. According to officials, these accounts were being utilized in targeted disinformation campaigns designed to destabilize Ukraine’s social and political environment.

The suspect, whose identity has not been publicly disclosed, allegedly sold more than 3,000 counterfeit Telegram accounts monthly to Russian clients. These accounts were created using Ukrainian mobile phone numbers to appear legitimate and were subsequently marketed on specialized online platforms frequently used by pro-Russian actors.

“The main customers were representatives of Russian intelligence services,” a statement from Ukrainian law enforcement explained. “They deployed these accounts to spread propaganda targeting Ukraine’s defense forces and to manipulate narratives about the country’s internal political situation.”

Authorities revealed a particularly concerning tactic involving the use of these accounts to distribute anonymous bomb threats across various Ukrainian facilities. “Through these actions, the enemy sought to provoke panic among the population and destabilize Ukraine’s socio-political environment,” officials stated.

During the raid on the suspect’s residence, which served as the operational hub for the bot farm, investigators seized substantial evidence including computer equipment, mobile devices, USB hubs connected to modems, and approximately 2,000 SIM cards from various Ukrainian telecommunications operators. If convicted, the suspect faces up to six years in prison under Ukrainian law.

Cybersecurity experts note that bot farms typically employ specialized hardware and software configurations that allow operators to manage thousands of fake social media profiles simultaneously. These operations require large quantities of SIM cards to bypass verification systems on platforms like Telegram, which use phone number verification as a primary security measure.

“This case represents a significant disruption to Russia’s information warfare capabilities,” said Anton Gerashchenko, a former advisor to Ukraine’s Ministry of Internal Affairs. “These bot networks allow the Kremlin to create the illusion of widespread support for their narratives and to manipulate online discourse at scale.”

Since Russia’s full-scale invasion in February 2022, Ukrainian authorities have repeatedly uncovered similar operations across the country. Digital forensics researchers have documented how Russian intelligence services utilize these fake accounts not only for propaganda dissemination but also for more targeted operations.

In previous cases, Ukrainian officials reported instances where Russian intelligence agents used fraudulent accounts and phone numbers to target military personnel with sophisticated phishing messages. These messages often contained malicious files designed to install spyware on devices and extract sensitive operational information.

The dismantling of this particular network comes as both Ukraine and its international partners have increased efforts to counter Russian information operations. The European Union’s East StratCom Task Force recently highlighted the growing sophistication of Russian disinformation campaigns targeting both Ukrainian citizens and Western audiences.

Cybersecurity analysts emphasize that while this operation represents an important tactical victory in the information domain, the broader challenge of combating state-sponsored disinformation remains substantial. Russian-linked networks continue to adapt their tactics, techniques, and procedures in response to defensive measures implemented by social media platforms and national security services.