TOP FINDINGS:
- An apparent Russian state-aligned group is targeting Ukraine’s International Legion in a disinformation campaign
- The Kyiv Independent obtained and analyzed exclusive video that shows the group used doctored footage to pose as the Ukrainian ex-president on a Zoom call that took place in early January
- Legion members are being tricked into agreeing with incendiary statements against Zelensky
- Lack of cultural context, morale issues and low pay in some units have made the International Legion more susceptible to such attacks
- The attack appears linked to the Russian government-aligned provocateurs Vladimir Kuznetsov and Alexey Stolyarov, known as Vovan and Lexus
- The effort highlights ongoing disinformation threats in the Ukraine-Russia war as well as possible information security vulnerabilities of Ukraine’s foreign fighters
Editor’s Note: Names of the International Legion members have been changed for their safety. These changed names are marked with * on first mention. The Kyiv Independent did not speak with anyone named John, Daniel, or Sam for this story.
John*, a former International Legion member, was nearing the end of a Zoom call with former president Petro Poroshenko, and things were off. The connection was poor, and the video of Poroshenko kept glitching. His lips didn’t line up with his words. Some of his gestures seemed to repeat.
John was suspicious before the call, but for the past 24 minutes, John's doubts had grown as “Poroshenko” asked him and two other former Legion members about battle line weaknesses, Legion recruiting, military pay, and troop morale. The three former International Legion fighters believed that Poroshenko was building a personal security battalion and wanted to hire them as officers. The pay would be up to 12,000 euros per month – several times their salary in the Legion.
Then, the tone of the conversation shifted: In broken English, their host called President Volodymyr Zelensky a “dictator” and asked, “Are you ready to stay with me when we will fight against Zelensky administration?”
John said nothing, while the other two agreed.
The glitchy image that purported to be the former president next said something more shocking: “We will kill this bastard in future.”
“I don’t think this is for me. I’m not in this to get into a fight with anybody in Ukraine, I have a fight with Russia,” John interrupted, realizing the call had gone off the rails. “My loyalty is with the f***ing soldiers in the front.”
“That is your decision …Go f*** yourself,” the host said, and John hung up.
As John looked at his phone screen, he was certain that he and the two other men on the call had been duped – their host was clearly not Poroshenko. So, who had they just been talking with? And what was the real reason for the call?
Warning signs
After the meeting, the International Legion soldiers discussed the four months leading up to their January Zoom call, reviewing red flags and looking for clues about the caller’s true identity.
The Kyiv Independent reviewed more than two dozen emails and recordings of two Zoom meetings that confirm their account. All three agreed to speak with the Kyiv Independent in order to warn others about Russian disinformation operations. The Kyiv Independent has agreed to not use their real names to protect the fighters, who are still in Ukraine.
A representative for Poroshenko’s party, European Solidarity, said in a written statement that they had no knowledge about the calls, but that “it is obvious the purpose is a provocation to harm Ukraine.”
“The aggressor country, the Russian Federation, has repeatedly used and continues to use the spread of fakes against Petro Poroshenko – during his presidency, as well as today,” the representative stated.
The Kyiv Independent found no evidence that Poroshenko was hiring a private security force with plans to overthrow Zelensky.
The Kyiv Independent approached the International Legion for comment, as well as the two entities that supervise it – the Armed Forces and Military Intelligence (HUR). Their representatives did not respond by publication time. Zelensky’s spokesperson said his office had no comment.
John had served in the military in his home country and arrived in Ukraine almost immediately after the 2022 invasion, along with other men and women who answered Zelensky’s call for foreigners to join a new military formation for international troops fighting for Ukraine. John served nearly continuously with Legion ground forces up until late 2023.
That’s when he heard of the job offer that would lead him to the Zoom call with the fake Poroshenko.
John and two other former Legion members who joined the call had initially pushed past their skepticism about the lucrative private contractor job because the invitation came through a trustworthy channel. Two of the men, Daniel* and Sam*, were referred for the position in September by a well-connected European private military company with which they had trained. Daniel had carried out missions with John in the International Legion and recommended he apply as well.
Daniel and Sam both served in the military in their home countries for many years before they joined the military intelligence-run wing of the International Legion in 2022.
The first red flag came in an Oct. 5 email that referenced a payscale for “Stormtroopers” in the alleged battalion, a term used by Russians to refer to frontline soldiers. Then, initial one-on-one Zoom interviews in November with “Poroshenko” also glitched and froze, which the meeting host blamed on a poor connection.
A supposed contract date was pushed back by months, and emails went unanswered for weeks in December. Finally, they heard back, and another group Zoom call was set up in the new year. When the three soldiers joined the call on Jan. 9, “Poroshenko” was wearing the same outfit and in the same location as the November interviews. “Poroshenko” also claimed to be in Donetsk Oblast. They were told multiple times not to speak to Ukraine’s main intelligence directorate.
All three men admitted that they had suspicions, but issues within the International Legion had also made them more hopeful about the potential new opportunity and willing to overlook red flags.
They listed problems previously investigated by the Kyiv Independent, including reckless missions, abusive commanders, and corruption.
“I’m not trying to be used as a meat shield,” Daniel explained.
Anna Myroniuk
While the video comments about “killing” Zelensky sounded “unprofessional,” maybe the host posing as Poroshenko was just “venting” and speaking metaphorically, Daniel told the Kyiv Independent he thought at the time.
In 2019, Poroshenko lost his re-election bid to Zelensky during a bitter campaign that included personal attacks. The rivalry has continued, and last month, Ukraine’s Security Service (SBU) requested parliament to block Poroshenko from leaving the country due to a planned meeting with Hungary’s Prime Minister Viktor Orban, which SBU said would be used for propaganda purposes.
“When he mentioned killing, we stayed silent. None of that was ever going to happen -- we weren’t going to do any kind of political revolution. We just wanted to see the contract. If there was anything risky, we would have turned it down immediately,” Daniel said.
After John quit the call, “Poroshenko” offered a deal to the other two: to meet in person at his office in Kyiv.
“This is where we freaking squash it right now, to figure out if this is completely, 100% fake,” Daniel told the Kyiv Independent he said to Sam at the time, as he prepared to drive several hours to the capital where the former president has his office.
But the three soldiers had missed another red flag. A Google search of the email address they’d been communicating with – [email protected] – would have turned up an April tweet from the U.S.-based security firm Proofpoint, stating that the email address they had been communicating with was linked to “Russia aligned TA499 and its malicious social engineering attacks.”
In other words, the emails most likely came from the Russian provocateur duo known as Vovan and Lexus.
Pranksters or state propagandists?
Vovan and Lexus, whose real names are Vladimir Kuznetsov and Alexey Stolyarov, are a Russian duo who have made a career by fooling prominent public and political figures into embarrassing video and phone calls. The self-described “pranksters” use impersonations to reach their targets, then try to persuade them to make damaging statements they record and release.
“Their purpose is to undermine, to subvert, to destroy the morale, so it’s very serious,” said Anthony Glees, a security and intelligence expert at the University of Buckingham. “Where that political intent to subvert is in line with the high policy of a particular government, the assumption must be that the people who are doing this are the agents of that government -- either the direct agents or the indirect work.”
The Kyiv Independent reached out to Kuznetsov and Stolyarov shortly before publication and did not receive a response by publication time.
The two have been operating together for a decade, tricking scores of famous people over the years, including former U.K. Prime Minister Boris Johnson, former German Chancellor Angela Merkel, Polish President Andrzej Duda, and other politicians, CEOs, and celebrities such as J.K. Rowling and Elton John.
They made headlines in November, when they released a conversation with Italian Prime Minister Giorgia Meloni where she admitted to “a lot of fatigue” around Russia’s war on Ukraine from “all the sides.” A statement from her office expressed regret and said she believed she was speaking with the head of the African Union Commission.
Last year, Bill Browder tweeted an email he received from the same email address used to contact the international fighters, and said he had been tricked into a fake Zoom call as well. Browder, an anti-corruption campaigner, heads the Global Magnitsky Justice campaign and is a vocal critic of Putin and the Kremlin.
Part of the usefulness of Lexus and Vovan’s calls for Russian propaganda efforts is that they appear to reveal secret, true thoughts, says Stanislav Budnitsky, a visiting scholar at Columbia and New York Universities who has researched the duo’s work for years.
But that’s often not the case, he adds. “People are caught off-guard, they’re trying to be nice and polite. It’s basic diplomatic courtesy to nod and smile, and not try to embarrass your interlocutor.”
Vovan and Lexus have long denied that they are directed by the Russian intelligence services. But they nonetheless receive valuable support and amplification from the Kremlin in the form of invitations to high-profile events, promotion by government officials, and regular airtime on state TV, Budnitsky noted.
Since 2022, their attacks have become increasingly politically focused and aligned with Kremlin goals, centering almost exclusively on the Russia-Ukraine war, according to a March report by Proofpoint.
“The calls are almost certainly a pro-Russia propaganda effort designed to create negative political content” about those who oppose Russia, wrote Proofpoint. They are “not a threat to take lightly due to the damage such propaganda could have.”
‘It was all fake’
As Daniel drove to Poroshenko’s office to meet Sam and try to get in together, a part of him still hoped the job was on the table. They were told to give the security guard a password: “Supreme commander.” But both men told the Kyiv Independent that they never made it past the guard station at the former president’s office.
“They knew nothing about us arriving,” Daniel said. When he tried to tell the office about the impersonator, he said, “they didn’t even care.”
“They told us that it was all fake. And that was about it. They didn’t want to know anything else from us,” Sam said.
A press representative for Poroshenko’s party said in a written statement they did not have information about this event.
An ongoing threat
With disinformation being wielded as a powerful weapon in Russia’s war in Ukraine, this latest attack highlights possible vulnerabilities within Ukraine’s International Legion. In addition to being tricked into making statements that can be used as propaganda, front-line troops might be deceived into sharing sensitive battlefield information. The Kyiv Independent could not determine whether any of the information discussed on this call was sensitive.
Ukraine’s military intelligence released a video in 2022 highlighting the threat of deep fakes. The faux Zoom calls with Poroshenko, however, were a far less sophisticated attack.
An analysis of the Zoom footage by the Kyiv Independent shows that the video feed in the Jan. 9 call between the false Poroshenko and the former members of the International Legion, as well as one November one-on-one interview that the Kyiv Independent obtained, were both taken from an unrelated 2022 video of Poroshenko -- which itself was another prank call orchestrated by Vovan and Lexus.
This hall of mirrors explains the glitches that appeared in the interview with the ex-International Legion members: the interruptions were the product of switching between different clips, and several clips were repeated multiple times during the calls.
The calls with International Legion members also preyed on the foreign fighters’ lack of knowledge of the local context. Ukrainians would be more likely to recognize that the voice on the call did not belong to their former president.
The Kyiv Independent was unable to verify how many other international fighters took fake video calls, though emails show that Lexus and Vovan received contact information that would have allowed them to reach other fighters.
After Daniel realized the deception, he said, he texted several other Legion members who he knew were interested in the advertised fake position, warning them to cut contact.
All three former Legion members who spoke to the Kyiv Independent hoped that raising awareness about the deception they experienced could protect their peers.
At the moment, the three are still waiting to see if their faces appear on Russian state TV as propaganda. If that happens, they aren’t sure if they’ll be able to stay in Ukraine. During the call, both Daniel and Sam had agreed to defend their host — the fake Poroshenko — if he started a revolution in Ukraine, and admit how poorly that could look in propaganda clips.
Daniel said that, during the call, he felt pressure not to anger a person whom he believed could have been an ex-president venting or referring to a metaphorical or political revolution. And if the call was fake, as he soon suspected, “we were just saying yes, because we wanted to see what he had to say.”
Sam said had continued to play along, but when a revolution came up, that was the moment when panic set in: “I would never get involved in a revolution.”
“I’ve had issues with the International Legion since the beginning, but the Legion is all people that came because they want to fight. Ukraine is running out of dudes that want to fight. They need people to fill the trenches,” said John. “We will all look like a bunch of idiots, and that’s my main concern.
