Russian intelligence services have sharply stepped up building websites and social media pages that impersonate Ukrainian state bodies and media, the Security Service of Ukraine (SBU) warned. Moscow uses the fakes to spread disinformation and to steal personal data it can turn into spy recruitment. The SBU says it has already blocked dozens of clones of its own brand.

Counterfeit pages built for propaganda and data theft

The fake sources serve Russian psychological operations and disinformation campaigns, the SBU said on 28 September. Their aim is to destabilize the situation inside Ukraine and damage its position abroad. Russian intelligence also uses them to extract Ukrainians' personal data, the agency said.

Alongside its full-scale invasion, Russia wages war on Ukraine in the cyber domain and through espionage and sabotage. Every agent Russia recruits inside Ukraine can help steer missiles and drones onto targets, and the SBU keeps catching such recruits.

Hacked accounts become recruitment leads

Russians often hack the accounts of users who subscribe to the fake pages and messenger channels, the SBU found. They then use the stolen information for recruitment operations and to collect confidential data.

Moscow is most interested in the combat and operational work of Ukraine's defense and security forces, the agency said. The SBU's cybersecurity department found and blocked more than 50 resources that copied the agency's own branding and positioning.

The fake pages are not Russia's only digital tool. Earlier in September, Anthropic said it had caught Russian spies running a campaign against Kyiv on its Claude AI chatbot.

Explore further

Poland and the Baltics risk Russian sabotage for backing Ukraine, Bloomberg says

How Ukrainians can protect themselves

The SBU urged citizens not to follow suspicious links and to rely only on official sources. Anyone who sees a dubious web address, or gets a message from someone posing as an SBU officer, should call the 1516 hotline, the agency said.

What Russia's recruits are sent to do

The SBU's own reports from the past week show what Russia's recruits are tasked with. A mobilized soldier allegedly recruited by the FSB, Russia's Federal Security Service, tried to direct a Russian missile strike on his own unit in Kharkiv Oblast, the SBU said. His repair battalion restores Ukrainian drones.

A Lviv Oblast resident who worked at a drone production site in western Ukraine was allegedly recruited to guide a missile strike on it, the agency reported. The strike was meant to disrupt the steady supply of strike and reconnaissance drones to Ukrainian troops, the SBU said.

A court also sentenced a 17-year-old agent of Russia's military intelligence (GRU), exposed in November 2024, to 10 years in prison, the SBU announced. She tracked Ukrainian air defenses in Chernihiv Oblast under the cover of taxi rides. She talked to her GRU handler through an anonymous messenger chat.

Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.