Russian Intelligence-Linked Bot Farm Dismantled in Zhytomyr

Ukrainian Security Services Dismantle Major Bot Farm Supplying Russian Propaganda Network

Ukrainian law enforcement has successfully neutralized a significant bot farm operation in Zhytomyr that was providing thousands of fake social media accounts to Russian intelligence services, dealing a blow to Moscow’s ongoing disinformation campaign against Ukraine.

The Security Service of Ukraine (SBU) and National Police conducted a joint operation resulting in the detention of the operation’s organizer, who allegedly supplied over 3,000 fraudulent accounts monthly to entities in Russia. These accounts were specifically created to spread Kremlin propaganda and false information about Ukrainian forces.

According to officials from the SBU’s Zhytomyr regional office, the suspect created “dummy” social media profiles registered to Ukrainian mobile phone numbers, which were then sold through specialized online platforms known to be hostile to Ukrainian interests. Investigators determined that Russian intelligence services were among the primary customers for these fake accounts.

“These accounts were systematically used to disseminate disinformation about the Ukrainian military and misrepresent the internal situation within our country,” an SBU representative explained. The fake profiles also played a role in distributing anonymous bomb threats targeting various facilities across Ukraine, creating public anxiety and wasting emergency response resources.

In a significant counterintelligence victory, SBU officers managed to block nearly 20,000 fake online profiles that had been actively operating on behalf of Russian special services. This represents one of the larger disruptions of Russia’s digital influence operations since the full-scale invasion began.

During searches of the suspect’s residence, authorities seized substantial evidence, including computer equipment, USB hubs with modems, multiple mobile phones, and approximately 2,000 SIM cards from various Ukrainian mobile operators. This hardware infrastructure allowed the operation to create and manage thousands of seemingly legitimate Ukrainian-based accounts.

The case highlights the sophisticated nature of Russia’s hybrid warfare tactics against Ukraine, which combine traditional military operations with coordinated information warfare campaigns. Digital disinformation has been a cornerstone of Russia’s strategy to undermine Ukrainian morale, sow discord among the population, and distort international perceptions of the conflict.

Cybersecurity experts note that bot farms like the one in Zhytomyr represent just one component of Russia’s broader digital influence operations targeting Ukraine and its allies. These networks typically work in concert with state-backed media outlets, official diplomatic channels, and covert intelligence operations to amplify pro-Kremlin narratives.

The suspect has been formally charged under Part 2 of Article 361 of Ukraine’s Criminal Code, which prohibits unauthorized interference with information systems and electronic communications networks when committed by organized groups. If convicted, the suspect faces significant prison time.

Ukrainian authorities indicated the investigation remains active as they work to uncover additional elements of the operation and potential connections to other Russian-backed influence networks. Officials are examining whether the suspect acted alone or as part of a larger organized group with connections to Russian intelligence services.

This operation follows a pattern of increased counterintelligence activity by Ukrainian security services, who last month detained Russian agents in Dnipro and Odesa for alleged arson and sabotage activities.

Since Russia’s full-scale invasion began in February 2022, Ukraine has intensified efforts to combat both physical and digital threats, including foreign-directed sabotage, espionage, and information warfare operations within its borders.