Copyright © 2024

The work of Euromaidan Press is supported by the International Renaissance Foundation

When referencing our materials, please include an active hyperlink to the Euromaidan Press material and a maximum 500-character extract of the story. To reprint anything longer, written permission must be acquired from [email protected].

Privacy and Cookie Policies.

SBU busts two Lviv-based bot farms reportedly involved in fake bomb threats

bot farms Ukraine
Bot-farm which used GSM mobile equipment for operating multiple social media accounts and its suspected administrator. Lviv, February 2022. Photo: SBU
SBU busts two Lviv-based bot farms reportedly involved in fake bomb threats
The fake bomb threat call saga unleashed on Ukraine just after the New Year continues as Ukraine’s security service says it has shut down two bot farms. The farms operated fake mobile phone accounts to “sow panic” and disseminate fake reports on laying mines in public places. The law enforcers suspect Russian handlers to be behind the farms.

On 8 February, the Security Service of Ukraine (SBU) reported that its cyber experts “revealed and liquidated” two bot farms in the west-Ukrainian city of Lviv. The total capacity of the two was 18,000 fake mobile accounts.

Such accounts can be used to register social media accounts, access the Internet using local mobile networks, or make mobile phone calls.

According to preliminary information, the administrators of the bot farms were supervised by commissioners from the Russian Federation, the security agency says.

A flow of hoax bomb threats inundated Ukraine at the beginning of the year, spanning through entire January and early February. According to Ukraine’s foreign ministry, in January alone, Ukrainian law enforcers received 945 anonymous messages containing minelaying threats. The hoax threats promised to damage a total of 9,907 facilities, including about 8,000 schools and other educational institutions.

Bot farms in Lviv

The investigators found that three residents of Lviv Oblast were allegedly involved in illegal activities. Two suspects reportedly provided their apartments for hosting the equipment used to run the bot farms, while the third used to maintain the farms.

SBU says that the bot farms worked predominantly on social media. In particular, they disseminated fake stories to instill panic. The investigators also revealed that the fake accounts maintained by the farms were used to publish false information about mines laid in various facilities, including social and critical infrastructure.

bot farms Ukraine
GSM gateways used to operate a bot farm of mobile phone accounts. Photo: SBU

According to the Agency, during the searches, law enforcement officers found and seized:

  • two sets of GSM gateways with 92 and 375 online channels respectively;
  • 3,000 SIM cards of mobile operators;
  • laptops with “evidence of illegal activity”;
  • draft accounting notes.

SBU has initiated criminal proceedings under Article 259 of the Criminal code of Ukraine, “deliberately false information about the threat to public safety, destruction or damage to property.” The article envisages a penalty of two to eight years’ imprisonment depending on the circumstances and ramifications of the offense.

Another bot farm in Zhytomyr

On 4 February, SBU said that it had busted a factory of fake accounts for Russian information operations” in Zhytomyr, a north-Ukrainian regional capital.

According to the agency, two residents of Zhytomyr used special Russian-developed software to mass-register fake social media accounts. The software reportedly enabled them to create accounts without using mobile communication services. 

The suspects used to sell the mass-produced fake accounts to Russian customers, who paid using “non-banking payment systems banned in Ukraine” – allegedly WebMoney, Yandex.Money or some other Russia-based online payment system.

“Through these accounts, the aggressor state (Russia, – Ed.) disseminated destructive anti-Ukrainian content, including manipulative narratives, and carried out malign influence operations against our country,” SBU reported, adding that these accounts were used to “spin disinformation and spread provocative material with the aim to destabilize domestic political situation across Ukraine.”

Read more:

You could close this page. Or you could join our community and help us produce more materials like this.  We keep our reporting open and accessible to everyone because we believe in the power of free information. This is why our small, cost-effective team depends on the support of readers like you to bring deliver timely news, quality analysis, and on-the-ground reports about Russia's war against Ukraine and Ukraine's struggle to build a democratic society. A little bit goes a long way: for as little as the cost of one cup of coffee a month, you can help build bridges between Ukraine and the rest of the world, plus become a co-creator and vote for topics we should cover next. Become a patron or see other ways to support. Become a Patron!

To suggest a correction or clarification, write to us here

You can also highlight the text and press Ctrl + Enter

Please leave your suggestions or corrections here

    Will the West continue to support Ukraine?
    • Know what moves the world.
    • Premium journalism from across Europe.
    • Tailored to your needs, translated into English.
    Special discount
    for Euromaidan Press readers
    Euromaidan Press

    We are an independent media outlet that relies solely on advertising revenue to sustain itself. We do not endorse or promote any products or services for financial gain. Therefore, we kindly ask for your support by disabling your ad blocker. Your assistance helps us continue providing quality content. Thank you!