In spring 2025, Ukraine’s Security Service (SBU) detained two professional PR consultants in Kyiv region. According to the investigation, the Ukrainian nationals had been working for Russian interests—supporting the information operations of the war and providing PR services to individuals close to Vladimir Putin.
They are charged with high treason under martial law (Part 2, Article 111 of the Criminal Code of Ukraine).
The Center for Strategic Communications and Information Security (CSCIS) reveals exclusive details on how civilian PR professionals, media experts, and political consultants have been carrying out the assignments of Russian intelligence and Kremlin officials during wartime.
Spreading Propaganda and Supporting Russian Aggression in the Information Space
According to the SBU, the detainees were “creating and distributing materials that discredited Ukraine and justified Russian aggression.” They launched more than 200 websites to disseminate pro-Kremlin narratives, with plans to expand the network to 1,300.
These sites acted as aggregators, republishing content from Russian media blocked in Ukraine such as Gazeta.ru, Argumenty i Fakty, Komsomolskaya Pravda, and others.
An example of a publication on an aggregator website and the original article from a resource blocked in Ukraine.
The published materials justified the invasion, glorified the Russian military and Putin’s regime, promoted narratives about “Ukrainian Nazism” and the “illegitimacy” of the Ukrainian government, and included fake stories about alleged war crimes committed by the Ukrainian Armed Forces. These publications were part of the Kremlin’s broader war propaganda campaign.
Image Laundering for Sanctioned Russian Officials
In addition to propaganda dissemination, the suspects also provided PR services to top Kremlin officials, including individuals and entities under international sanctions.
The investigation confirmed that these consultants had been working with Russian clients prior to 2022. After the full-scale invasion, a former Russian employer reestablished contact and offered them to continue cooperation.
Among their clients, according to the SBU, were Andrey Kostin (Chairman of the Board of VTB Bank) and Igor Shuvalov (Chairman of the state corporation VEB.RF).
The services provided were classified as “reputation management”—developing positive public images and suppressing negative publicity about clients under sanctions in Ukraine, the EU, the US, Canada, the UK, Japan, and others.
In February 2022, they also pitched a service package to Ramzan Kadyrov, head of the Russian occupation administration in Chechnya.
Results of media monitoring related to Ramzan Kadyrov.
The offer included:
monitoring the media field of Russia and other states for publications about Kostin, Shuvalov, Kadyrov, VTB Bank, analyzing the tone of identified publications, audience engagement, etc.;
developing a strategy for forming and consolidating a positive public image of the mentioned persons.
Cost of individual services (per month).
The monthly cost of such a service package could amount to tens of thousands of dollars.
Smartphones seized from the PR specialists were used to coordinate the operation of bot farms.
Source: Security Service of Ukraine
Tools of the Trade: Bot Farms, SEO, and Legal Manipulation
Tools used by the PR agents included:
bot farms;
creating networks of information sites and placing complimentary publications about the client on them;
creating content for placement on social networks and video hosting platforms.
Bots were used both for synchronous placement of positive comments and publications on social networks, and for generating search queries to distort statistics and influence recommendations and search results on Google, YouTube, Yandex, and other resources.
Recommendations for using bot farms for media promotion of Ramzan Kadyrov.
Clients were also offered SEO de-optimization (measures to worsen the “visibility” of publications, including their removal from search results), blocking and deletion of unwanted content. Specifically, by making legal claims to providers and owners of internet resources, appealing to Google with complaints about copyright violations (appealing to DMCA – Digital Millennium Copyright Act norms), etc.
The consequences of such actions could be:
blocking sites with unwanted publications.
removal of unwanted publications from a specific site;
“hiding” unwanted publications in Google search results.
An example of legal activity in the interests of influential Russian clients is the temporary blocking of access to the UKR.NET domain in March 2024 according to an American court ruling. The lawsuit to the California Superior Court was filed in the interests of oligarch Stanislav Kondrashov: the plaintiff insisted on a “complete prohibition on publishing any information” about him.
Source: ukr.net
Strategic PR Interventions in the Information Environment
The PR consultants employed a coordinated multi-pronged approach:
filling the information field of various countries through their own sites and coordinated content placement on social networks with complimentary materials about the client;
using bot farms to create the illusion of high audience interest in PR materials, influencing social network algorithms and search engines to obtain organic audience reach;
limiting audience access to other materials about the client through combining bot farm actions, SEO tools, and legal spam.
Results of monitoring mentions of Andrey Kostin.
The result of these actions was supposed to be the dominance of publications about Russian clients not as persons involved in aggression against Ukraine and under international sanctions, but as respectable businessmen, investors, politicians, philanthropists, etc. For this purpose, not only was relevant content placed and distributed, but bot attacks and legal pressure on internet resources were also carried out.
Recommendations regarding the media strategy of Andrey Kostin and VTB Bank.
Therefore, such activity has signs of interference in the information field of various states with the goal of “correction” in the interests of sanctioned persons, accomplices of aggressive war. Actions were conducted in the information space of the EU, Great Britain, USA, Ukraine, Russia, Kazakhstan, Uzbekistan, and other countries.
PR Agents as Kremlin Tools
The Kyiv-based agents exposed by the SBU are not isolated actors. The Kremlin actively uses private contractors in its information warfare.
The most notorious example is the Russian PR agency “Agency for Social Engineering” (ASP), led by Kyiv-born Ilya Gambashidze. ASP and its affiliate “Structure Group” were central to Operation Doppelganger, which involved creating fake clones of major media outlets to spread disinformation aimed at destabilizing the U.S., Europe, and others, while undermining support for Ukraine.
Source: Main Directorate of Intelligence of Ukraine
ASP staff were not just technical executors—they also developed narrative strategy, created memes, video fakes, and visual content.
Due to their role in spreading disinformation, both ASP and Gambashidze are under U.S. and EU sanctions. According to the U.S. Department of Justice, their activities are supervised by Sergei Kiriyenko, First Deputy Chief of Staff to Putin.
Investigative journalists from “Schemes” have linked ASP to the promotion of the “Other Ukraine” project launched by Viktor Medvedchuk—a pro-Russian figure charged with treason—after his 2023 release in a POW exchange.
Outsourced War: The Role of Private Contractors
In today’s total information war, the Kremlin outsources significant operations to private actors. These contractors work alongside Russian military and intelligence cyber divisions, increasing operational scale, flexibility, and reach across global media environments.
As such, these PR firms are not just service providers—they are full-fledged collaborators in Russia’s war against Ukraine.
Understanding and countering their role is essential to defending the information space.
If you have found a spelling error, please, notify us by selecting that text and pressing Ctrl+Enter.
