Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Social Media

Ukraine Takes Down Domestic Pro-Kremlin Bot Farms

More Than 100,000 SIM Cards Seized; Some Linked to Russian Mobile Operators
Ukraine Takes Down Domestic Pro-Kremlin Bot Farms
Ukrainian police seize a pro-Russian bot farm. (Image: Cyber Police of Ukraine)

Ukrainian law enforcement dismantled more than a dozen bot farms that were active inside the country, accusing their operators of spreading Russian propaganda through more than 1.5 million fake accounts.

See Also: OnDemand | Combatting Rogue URL Tricks: How You Can Quickly Identify and Investigate the Latest Phishing Attacks

Searches conducted by the Cyber Police of Ukraine - a unit of the Ministry of Internal Affairs - resulted in the seizure of more than 100,000 SIM cards, including cards from Russian mobile operators, Ukrainian authorities said on Tuesday. Police arrested 31 individuals across 24 locations.

Russia's attempted conquest of Ukraine is accompanied by heavy doses of online disinformation and propaganda aimed at splitting support for Kyiv. The rise in internet usage in Ukraine over the past decade is fueling the spike in Kremlin digital messaging. Three-fourths of Ukrainians are online and nearly 9 out of 10 can receive cellular signals at least as fast as 3G. The goal, wrote the Organization for Economic Cooperation and Development, is to "cause confusion, complicate efforts to reach consensus, and build support for Russia's goals, while undermining the legitimacy of Ukraine's response."

Messaging that began by smearing Kyiv as a Nazi regime has shifted to intimations that Ukraine is plotting a "dirty bomb" attack and accusations that the United States is developing biological weapons through secret labs in Ukraine.

The police operation, dubbed "Botofarm," took down 28 web resources used to register mobile numbers for use by the bot networks. Among the seizures were more than 150 mobile phones and around 300 gateways for connecting GSM signals to IT networks.

The operation was executed by the cyber police, territorial units of the national police and the prosecutor's office of Ukraine with the cooperation of national cellular operators.

Ukrainian authorities describe the bots they just took down as being used to spread narratives that justify the actions of Russian occupiers and that discredit the Ukrainian military and authorities. This takedown is the latest in a string of raids, including the September dismantling of two bot farms and the August dismantling of a group that operated more than 1 million bots.

Russian disinformation campaigns have included outright hacking, including a July incident in which a radio signal was hijacked to broadcast a fake message about Ukrainian President Volodymyr Zelenskyy's health, claiming he was in the intensive care unit. Zelenskyy took to Instagram to refute the message, saying he "never felt as good as now" (see: Malware Attacks and Disinformation Campaigns Target Ukraine). Zelenskyy is traveling to the United States and is set to deliver an address to Congress on Wednesday evening.

About the Author

Mihir Bagwe

Mihir Bagwe

Principal Correspondent, Global News Desk, ISMG

Bagwe previously worked at CISO magazine, reporting the latest cybersecurity news and trends and interviewing cybersecurity subject matter experts.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.