# Pro-Kremlin actors amplify hack-and-leak narratives against Ukraine aid

Published: 2025-11-28 · Severity: routine · Sectors: government-national, defense
Canonical: https://vorant.io/reports/416ba94b-b71c-5984-b94f-95feee991ff8/pro-kremlin-actors-amplify-hack-and-leak-narratives-against-ukraine-aid

> Pro-Kremlin hacktivist groups seed disinformation about Ukrainian casualties and Western territorial division plans to undermine military support.

Pro-Kremlin actors, primarily Killnet and associated hacktivist groups, conducted alleged hack-and-leak operations in August-September 2025 to amplify narratives seeking to weaken Ukraine's relationship with Western allies. Two principal campaigns emerged: the first claimed access to Ukrainian Armed Forces general command systems containing casualty data (alleging 1.7 million dead), and the second alleged Western allies were planning to partition Ukrainian territory. Both narratives originated on Telegram before amplification by Russian state media (RIA Novosti, RT, Sputnik) and fringe outlets (L'Antidiplomatico), lending false credibility. The campaigns accumulated millions of views across Telegram, TikTok, and Facebook within a week, though lacked sustained momentum. Hungarian PM Viktor Orbán later repeated the territorial division claim, providing further perceived legitimacy.

The operation exploited verifiable gaps in publicly available Ukrainian casualty figures and the unverifiable nature of alleged classified data to seed doubt about Ukrainian military viability and Western commitment. Killnet, identified as operating in Kremlin interests since 2022, reemerged in spring 2025 with new leadership and has been credited with multiple intrusions including against Ukrainian drone developers. While no direct financial ties to the Russian government have been confirmed, the group's activities consistently align with Kremlin strategic messaging objectives.

Defenders should recognize this as information warfare targeting Ukraine's Western alliances rather than a direct cyber threat, though the underlying claimed intrusions (if authentic) represent significant targeting of Ukrainian defense infrastructure. The campaign demonstrates coordinated use of Telegram's comment amplification mechanisms, small distributed accounts, and state-media laundering to reach millions with unverified claims.

## Mentioned in this report

- Threat actors: Killnet

2 detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://dfrlab.org/2025/11/28/pro-kremlin-actors-seed-narratives-to-undermine-western-military-aid-to-ukraine

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/416ba94b-b71c-5984-b94f-95feee991ff8/pro-kremlin-actors-amplify-hack-and-leak-narratives-against-ukraine-aid.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup