On September 28, the Security Service of Ukraine (SBU) issued a stark and urgent warning about a significant escalation in Russian intelligence activities directed against Ukraine’s information space. According to the SBU, Russian operatives have intensified their efforts to create fraudulent websites and social media pages that clone official Ukrainian government institutions and domestic media outlets. These counterfeit platforms are being deployed in coordinated information-psychological operations designed to destabilize Ukraine’s domestic socio-political situation and erode its standing on the international stage. The warning reflects a growing recognition in Kyiv that Russian aggression is no longer confined to the physical battlefield. Alongside missiles and drones, Moscow is waging a sophisticated hybrid war in which fake news, cloned domains, and compromised social media accounts are treated as weapons no less important than conventional arms. The SBU’s alert is intended to make both Ukrainian citizens and the international community aware that Russia is seeking to exploit digital trust in official institutions in order to spread chaos, manipulate public opinion, and gather intelligence. While the SBU did not release a complete list of the fraudulent resources, the warning emphasized that the clones are designed to be highly convincing, using official logos, government seals, and web addresses that closely resemble the real domains of Ukrainian ministries, military commands, and news organizations. The goal is to make users believe they are interacting with legitimate state channels, when in fact they are providing information to Russian intelligence services or consuming carefully engineered disinformation.
According to the SBU, these counterfeit platforms are not random acts of internet trolling but systematic, well-resourced operations driven by Russian state intelligence. The cloned pages can be used to push false statements attributed to Ukrainian officials, announce fabricated military defeats or withdrawals, create panic around mobilization, and distort operational reality in ways that could directly threaten the lives of soldiers and civilians. They can also publish stories intended to discredit Kyiv in the eyes of Western allies and international institutions, undermining confidence in Ukraine’s resilience and governance. This is what the SBU describes as an information-psychological operation: an effort to manipulate how people think and feel, rather than simply to hack or disable technical systems. By eroding public trust in official communications, Moscow hopes to complicate the Ukrainian government’s ability to communicate clear instructions, maintain morale, and coordinate its international partnerships. In a country at war, where presidential addresses, military briefings, and alerts from the Ministry of Defense carry life-or-death weight, the presence of convincing fakes means that even genuine announcements can be met with suspicion. That uncertainty is itself a strategic victory for Russian planners. The SBU’s warning is therefore not only about identifying malicious websites; it is about preparing citizens to think critically about every digital interaction they have with state institutions and to verify information through trusted channels at all times.
Beyond its destabilizing disinformation goals, the SBU warned that Russian intelligence is using the fake channels for a much more concrete and dangerous purpose: harvesting personal data from Ukrainian citizens. When a user follows, clicks on, or interacts with these malicious pages, the hackers can deploy phishing techniques to compromise the user’s account. In many cases, infected pages prompt visitors to log into a fake version of a government portal or enter personal details, which are then captured by the attackers. The SBU reported that Russian operatives frequently compromise the accounts of users who interact with these pages and subsequently use the stolen credentials for recruitment operations and the gathering of sensitive intelligence. This intelligence gathering has a very specific focus: the combat activities of Ukraine’s Defense and Security Forces. That means the target is not only the general public, but also military personnel, defense contractors, volunteers, and their families. With access to someone’s personal accounts, a hostile intelligence service can map their contacts, understand their loyalties, track their movements, and identify vulnerabilities that could be exploited either digitally or in person. Stolen personal data can be used for blackmail, to create psychological pressure on soldiers and their relatives, or to build detailed profiles for future espionage. The SBU’s warning makes clear that social media interactions once considered harmless—joining a group, following a page, clicking a link—can now place Ukrainian citizens in direct contact with Russian intelligence operations designed to exploit them for operational benefits.
In response to this threat, the SBU’s Cyber Security Department revealed that it has already identified and blocked more than 50 fraudulent online resources that specifically imitated the official branding and positioning of the SBU itself. The fact that Russian operatives sought to impersonate Ukraine’s main security service is telling: it shows the attackers understand how much authority and trust these official institutions carry in Ukrainian society. By creating clones of the SBU’s channels, Russian intelligence aimed both to trick people seeking information about security threats and to compromise those who accessed the fake pages. The SBU’s public disclosure of the activity is itself a defensive measure, designed to deny the attackers credibility and to warn other potential victims. The SBU urged citizens to exercise heightened vigilance and rely exclusively on official state channels. It advised people to avoid clicking on suspicious links and to report any fraudulent communications that claim to originate from security personnel to official hotlines. This type of public guidance is essential in a war environment because no security service can protect every citizen individually; soldiers and ordinary civilians must be trained to identify and report malicious digital behavior. Every report gives the SBU’s cybersecurity analysts another data point, allowing them to identify new attack clusters, map Russian infrastructure, and block future operations before they reach their intended targets.
The SBU’s warning also gains broader significance in the context of a major escalation in Russian cyberespionage involving artificial intelligence. According to a recent threat intelligence report from Anthropic, Russian state-linked hackers known as Midnight Blizzard—also tracked by the cybersecurity community under the identifier GTG-20006—have weaponized Anthropic’s Claude AI model to automate cyberespionage operations targeting more than 20 Ukrainian and European government, military, and defense organizations. The group reportedly used customized AI workflows to develop evasive malware, process bulk stolen communications, and reverse-engineer proprietary military drone software. This represents a major escalation in AI-driven state espionage operations and demonstrates how quickly Russian intelligence agencies are adopting advanced technologies to amplify their attacks. The combination of classic information-psychological operations, such as the cloned websites described by the SBU, and new generative AI tools creates a dangerous ecosystem. AI can help Russian hackers draft more persuasive phishing messages, generate code that is more difficult for antivirus tools to detect, sort through massive volumes of intercepted data with speeds no human analyst could match, and identify sensitive military information within compromised networks. The fact that an AI model intended for beneficial use can be repurposed for offensive state operations is a sobering indication of the emerging threat landscape. It also helps explain why the SBU is so concerned about the scale and sophistication of the current wave of disinformation: Russia is not just using more resources; it is integrating them into a coordinated hybrid-war machine that combines technical hacking with cognitive warfare.
For ordinary Ukrainians, the message from the SBU is both simple and vital. In a crisis, information is a weapon, and the first line of defense is public awareness. Citizens should verify web addresses before entering personal information, check official social media accounts through trusted search paths rather than links sent by email or messenger, enable multi-factor authentication wherever possible, and never disclose passwords or account details in response to unsolicited requests. The SBU’s warning that no legitimate security official will ever ask for credentials through social media should be treated as a hard rule. At the same time, the international community should see these disclosures as evidence that Russia’s war against Ukraine is not solely a land war but also a global cyber and information campaign. The same infrastructure used to attack Ukrainian public morale can be redirected against European institutions, defense contractors, and government agencies. The Midnight Blizzard case, with its use of AI to automate espionage, underscores the need for a coordinated Western response: stronger public-private information sharing, investment in cybersecurity defenses, and more rigorous oversight of transformative technologies. The SBU’s willingness to publicly expose these operations is a valuable contribution to collective security, but the agency cannot shoulder the burden alone. As the global conversation about artificial intelligence and cyberwarfare intensifies, Ukraine’s experience on the digital frontline offers urgent lessons. The fight against Russian hybrid aggression will be won not only by missiles and artillery, but also by the vigilance of citizens, the resilience of public trust in official institutions, and the speed with which democratic societies adapt to the new age of AI-powered espionage.