Pro-Kremlin actors amplify hack-and-leak narratives against Ukraine aid
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Pro-Kremlin hacktivist groups seed disinformation about Ukrainian casualties and Western territorial division plans to undermine military support.
Pro-Kremlin actors, primarily Killnet and associated hacktivist groups, conducted alleged hack-and-leak operations in August-September 2025 to amplify narratives seeking to weaken Ukraine's relationship with Western allies. Two principal campaigns emerged: the first claimed access to Ukrainian Armed Forces general command systems containing casualty data (alleging 1.7 million dead), and the second alleged Western allies were planning to partition Ukrainian territory. Both narratives originated on Telegram before amplification by Russian state media (RIA Novosti, RT, Sputnik) and fringe outlets (L'Antidiplomatico), lending false credibility. The campaigns accumulated millions of views across Telegram, TikTok, and Facebook within a week, though lacked sustained momentum. Hungarian PM Viktor Orbán later repeated the territorial division claim, providing further perceived legitimacy.
The operation exploited verifiable gaps in publicly available Ukrainian casualty figures and the unverifiable nature of alleged classified data to seed doubt about Ukrainian military viability and Western commitment. Killnet, identified as operating in Kremlin interests since 2022, reemerged in spring 2025 with new leadership and has been credited with multiple intrusions including against Ukrainian drone developers. While no direct financial ties to the Russian government have been confirmed, the group's activities consistently align with Kremlin strategic messaging objectives.
Defenders should recognize this as information warfare targeting Ukraine's Western alliances rather than a direct cyber threat, though the underlying claimed intrusions (if authentic) represent significant targeting of Ukrainian defense infrastructure. The campaign demonstrates coordinated use of Telegram's comment amplification mechanisms, small distributed accounts, and state-media laundering to reach millions with unverified claims.
Mentioned in this report
Detection guidance
2 detections for this report are in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://dfrlab.org/2025/11/28/pro-kremlin-actors-seed-narratives-to-undermine-western-military-aid-to-ukraine
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs