Ukraine busts ‘bot farm’ supplying thousands of fake Telegram accounts to Russian spies

Ukrainian authorities have dismantled a so-called “bot farm” that police say was supplying thousands of fake social media accounts to Russian intelligence services for use in disinformation campaigns against Ukraine.

Ukraine’s Security Service (SBU) and the National Police said on Monday they detained the suspected organizer of the network in the northern city of Zhytomyr and blocked nearly 20,000 fraudulent online profiles allegedly used in information operations directed by Moscow.

According to law enforcement, the suspect sold more than 3,000 fake Telegram accounts each month to Russian clients. The accounts were created using Ukrainian mobile phone numbers and then marketed on specialized online platforms used by pro-Russian actors.

Authorities say the main buyers were representatives of Russian intelligence services, who used the accounts to spread propaganda about Ukraine’s defense forces and the country’s internal political situation.

The accounts were also used to circulate anonymous messages posing as Ukrainian citizens and falsely claiming that various facilities across the country had been mined. “Through these actions, the enemy sought to provoke panic among the population and destabilize Ukraine’s socio-political environment,” authorities said.

Law enforcement officers detained the suspect at his residence, where he had allegedly set up the bot farm. During searches, investigators seized computer equipment, mobile phones, USB hubs connected to modems, and nearly 2,000 SIM cards from multiple Ukrainian telecom operators.

If convicted, the suspect faces up to six years in prison.

Bot farms typically rely on specialized hardware and large numbers of SIM cards to create and manage thousands of fake social media accounts simultaneously. Ukrainian authorities say Russia has repeatedly used such networks during the war to amplify propaganda, spread disinformation, and manipulate online discussions.

Officials have also previously reported cases in which Russian intelligence used fake accounts and phone numbers to target Ukrainian military personnel with phishing messages containing malicious files designed to install spyware and steal sensitive data.