In an evolving digital landscape where information warfare parallels physical conflict, malicious actors have launched a highly targeted phishing campaign using the identity of the Head of the Ukrainian Presidential Office, Kyrylo Budanov. The Office of the President of Ukraine officially confirmed the breach attempts on Monday, April 20. Concurrently, analysts from the Centre for Strategic Communication and Information Security (SPRAVDI) warn that this incident is an integral component of a broader Russian disinformation operation aimed at destabilizing international support for the country.
According to official reports, the Ukrainian diaspora has become one of the primary targets of this cyber deception. Yuriy Klufas, the President of the Ukrainian National Federation of Canada, was among the recipients of these fraudulent emails. The message, falsely signed by Kyrylo Budanov, requested active media and informational support for initiatives regarding the return of Ukrainian citizens to their homeland. Cyber security experts quickly identified critical flaws in the correspondence. Instead of utilizing a secure government domain, the scammers operated from a commercially available encrypted email service: office.apu.gov.ua@proton.me. The signature attached to the email was completely fabricated and bore no resemblance to the actual official’s endorsement.
The Ukrainian government has acted swiftly to mitigate the threat. All gathered intelligence regarding the cyber fraud has been forwarded to relevant law enforcement agencies and cyber police units for thorough investigation. Authorities are vigorously urging the public, civil society organizations, and international partners to exercise extreme caution, meticulously verify email senders, and disregard suspicious communications.
This phishing campaign occurs against a backdrop of intensified Russian psychological operations. Throughout April, enemy propaganda resources disseminated more than 500 fake news items about Ukraine. A central objective of these campaigns is to falsely portray the nation as a “terrorist state.” To achieve this, Russian operatives exploit topics such as cross-border drone strikes, lob baseless accusations against the Baltic states, and manipulate facts surrounding Kyiv’s diplomatic initiatives. Notably, Russia recently manufactured and circulated fake covers of prominent French newspapers containing harsh criticism of President Volodymyr Zelenskyy.
Russian propagandists systematically adapt their narratives to target specific audiences globally. Targeting the Ukrainian diaspora in Canada—one of the largest and most influential Ukrainian communities in the world—demonstrates a calculated effort to fracture vital networks of solidarity. Utilizing the name of Kyrylo Budanov highlights the desperate lengths to which malicious actors will go to exploit the established trust in Ukrainian state institutions.
As Russia faces severe economic and military pressure from comprehensive sanctions and defense operations, its reliance on asymmetric warfare techniques, including cyber impersonation and mass disinformation, is expected to grow. Maintaining strict digital hygiene and verifying official communications remain vital steps in countering the Kremlin’s hybrid warfare tactics.