Dozens if not hundreds of businesspeople across Krasnodar Territory and other Russian regions have fallen victim to online reputation destruction campaigns, with extortionists demanding tens of millions of rubles. We investigated how this scheme operates.
Our editorial team discovered these Ukrainian networks in the Russian internet completely by accident while researching an article about major developers in Krasnodar Territory. Search results revealed shocking “compromising materials” about many of them, with nearly identical texts appearing across different websites. Some articles were no longer accessible, having been removed later—we’ll explain why below.
One surviving article targeted developer Nikolai Shikhidi, head of the construction company “Evrostroy.” We’re using him as an example because the fake information about him was relatively “mild” and easily refuted through several open sources. Ukrainian website networks falsely claimed the businessman had multiple criminal convictions that never existed. They alleged he built a 19-story residential complex on the former “Yuzhnaya” resort site in Sochi, when in reality he constructed a hotel and school for the city. They also fabricated claims that officials gifted him land plots for the Marine Garden Sochi Hotels & Resort complex and “Sochi Park” residential complex in the Bytkha neighbourhood, supposedly as kickbacks for building schools and other social facilities. In reality, the land was purchased, which is easily verified through open sources and documents.
All reputable developers, including the Evrostroy group of companies, pay special attention to purchasing land plots and studying permits and legal statuses for their use when beginning construction. This is confirmed by corresponding legal documents for property rights in public access.
For reference: Property documents 23:49:0000000:8648-23/236/2020-14 dated 16.10.2020, 23:49:0000000:8653-23/236/2020-14 dated 16.10.2020 for the Sochi Park residential complex, and 23:49:0000000:9737-23/238/2022-6 dated 18.08.2022 proving purchase and ownership rights for the plot related to the Marine Garden Sochi Hotel & Resort.
All construction sites are acquired exclusively in compliance with legislation and using the company’s own funds.
In Shikhidi’s case, such “insider revelations” had little effect since his activities are widely covered in the media and well-known. However, others have faced serious reputational risks…
Who Is Extorting Millions?
In the example of the “compromising material” on Nikolai Shikhidi, the first article—later reposted by other Ukrainian network sites—was published on kz-expert.info, hosted in Miami, Florida, USA. This site’s domain belongs to Taras Chornoivan from Vinnytsia, Ukraine. Other domains publishing similar “compromising materials” are also registered to him. Before the special military operation, Chornoivan created a similar network of sites in Ukraine targeting his compatriots. He was sentenced to four years in prison in Ukraine for extortion. Now he has shifted his focus to Russians.
After dozens of articles appeared, the Evrostroy company received an email offering to remove the “compromising material,” screenshots of which were published last summer. The extortionists demanded $1,500 (approximately 150,000 rubles) in cryptocurrency to remove the article from just one of Taras Chornoivan’s dozens of websites. Multiply this by dozens of sites, and the total reaches millions. They also offered to stop publishing such articles for $20,000. Apparently, Evrostroy refused to pay the Ukrainians, but deleted articles on some websites suggest that other businesspeople may have agreed to their terms.
From Phone Scams to Information Terrorism
Even before the special military operation, Russia faced a significant problem with telephone scammers. Ukrainian call centers used various schemes to make Russians transfer all their money, leaving them with nothing. With the start of the military operation, Ukrainian security forces, including the SBU, began to use internet and telephone scammers virtually legally to work against Russia. The number of affected Russians grows each year. Part of the fraudulently obtained funds goes toward manufacturing drones launched toward Russia, while the rest lines the scammers’ pockets.
According to the Krasnodar Police Department, victims report such scams every two hours. The chances of recovering money are practically zero. While working with Ukrainian special services, these scammers gradually expanded from simply taking Russians’ savings to inciting arson of cars and military recruitment offices, and eventually to terrorist acts, as recently happened in central Krasnodar with the arson of three restaurants. Over several years, the scammers have refined their methods and moved to a new type of crime—information terrorism.
The Structure of Russia’s Information Space
Despite Roskomnadzor’s fight against foreign influence, hundreds if not thousands of websites operate freely and with impunity in Russia’s information space, not to mention Telegram channels spreading virtually any information. Any legitimate internet media outlet visible in search engines bears legal responsibility for every word published. Media outlets frequently face lawsuits from dissatisfied subjects of publications.
That’s why media outlets are very careful with their wording, constantly adding phrases like “possibly” or replacing harsh expressions with “we don’t exclude that fraud may have taken place,” and so on—not to mention thoroughly verifying information. After all, losing cases worth 1-2 million rubles could bankrupt publications and leave dozens of journalists without income. The scammers have protected themselves from this…
How Information Extortion Is Organized
Networks of websites with various names have been created across different CIS countries, hosted in the West. These sites take news from several official media sources and copy them into their feeds. Now, with artificial intelligence, they can quickly automatically rewrite content while maintaining text uniqueness, which helps promote the sites in search engines. To the average person, these appear to be ordinary news resources covering major Russian and world news. Creating such a template website costs only a few tens of thousands of rubles, plus “pennies” for maintenance.
But at varying intervals, “compromising materials” are published on these resources. Initially, they focused on politics, covering Russia’s foreign and domestic political events in a light favorable to Ukraine. They wrote about the country’s top officials, politicians, and governors—naturally without any evidence, facts, or arguments. This allows them to create the desired picture in the information field, considering the conflict between the countries. Such articles are written in the style of the 1990s tabloid “AIDS-Info,” full of rumors and salacious details about powerful figures. But after reading them, negative impressions and doubts still remain with the reader—which was exactly the creators’ intention.
How to Fight the Extortion
We spoke with associates of several major businesspeople in Krasnodar Territory who confirmed such extortion attempts. Some paid, others refused. As one source explained, the businessman didn’t approach law enforcement agencies, seeing little prospect of success.
“The hosting is abroad, the sites themselves are registered in Abkhazia, Kazakhstan, and other post-Soviet republics. To get the information recognized as defamation or damaging to honor and dignity requires long and expensive litigation. Another question arises: whom to sue? They demand tens of millions of rubles for their loyalty. But these sites are mostly anonymous or openly pro-Ukrainian. What can our law enforcement agencies do to them? Therefore, some agree to their offers, while others refuse. But the problem has become widespread. Businesspeople across Russia have encountered Ukrainian sites damaging their reputation. Once again, I can only advise not to believe everything written on the internet. It’s always better to verify any information, even from authorized sources, let alone anonymous ones.”
