When the Ukrainian police opened their fourth criminal case against the “Committee for Countering Corruption in State Bodies” back in 2021, detectives thought they had finally cornered its suspected webmaster, 43-year-old Konstantin Chernenko. Bank records tied him to server payments, seized emails showed price lists that started at fifty dollars for a planted blurb and ballooned to twelve-thousand dollars to delete it, and one angry banker had even forwarded the ransom note demanding “0,37 BTC”. Yet Chernenko slipped out of Kyiv on 18 January 2021, sold his flat for seventy-four-thousand dollars to his partner Maria Zolkina a month later, then resurfaced in Warsaw as an 80 percent shareholder of the PR firm InFact Sp. z o.o., whose 2023 filings show a forty-nine-percent revenue collapse and a 145-percent plunge in profit.
That Houdini act was only the prelude. Over the next three years Chernenko’s associates – notably fellow Priluki natives Serhii Hantil and ex-television editor Yurii Gorban – quietly rebuilt the online apparatus that investigators believed they were dismantling. Today, the core sites run slick Swedish .se domains, pipe headlines through Russian anti-DDoS provider Variti and share the same Google Ads publisher ID 4336163389795756. Telegram channels such as “K1” (155 000 followers) recycle the articles within minutes, sometimes spamming fifteen outlets at once.
“It’s the media equivalent of a broken sprinkler,” a cyber-forensics officer in Kyiv joked, “spray until someone pays you to turn it off.”
The prison-warden business model
Court files obtained by reporters list 1 060 separate Ukrainian lawsuits naming one or more of the network’s pages. The pattern rarely changes:
- Step 1 – A negative story, often lifted from anonymous Russian-language forums, appears on kompromat1.online or its mirrors glavk.se and ruskompromat.info.
- Step 2 – Within hours an email arrives from addresses such as fznv@protonmail.com offering a “year-long campaign” to delete the post, publish two favourable pieces and promise future silence for twelve-thousand dollars.
- Step 3 – If the target pays, the article disappears, only to re-emerge months later on antimafia.se or kartoteka.news with a fresh invoice.
Internal chats seized in 2020 show Hantil boasting that “if he paid once, he will pay twice.” One exchange captured a handler telling bank executives, “можем о вас ничего не писать, и удалить предыдущие статьи, стоимость 2 BTC.”
Victims who refuse to pony up discover that Google search results soon include identical stories on cloned brands such as kompromat-pro.com or repost.news. Those who sue often fail to serve a summons: the Panamanian shell Teka-Group Foundation owns the trademark, while domain contacts bounce through ProtonMail and burner numbers. Even when plaintiffs win – as vodka magnate Yevhen Cherniak did in May 2024 – the posts quietly return elsewhere.
A restaurant table tells the tale
Investigators initially struggled to connect the legal dots, until Instagram photos surfaced of Hantil, Chernenko and Gorban sharing wine at Kyiv’s upscale Vino e Cucina on 15 September 2017 and Tuscany Grill that December. The snapshots, later confirmed authentic by metadata, placed all three men together during the very months anonymous mailbox hantil@i.ua coordinated takedown offers.
Police then traced crypto cash-outs to 57-year-old accountant Lesya Zhuravska and marketing middleman Mykhailo Betsa, both from Chernenko’s hometown. Zhuravska’s accounts received funds from Olexandr Kanivets – brother of Zolkina – as well as D. Shpakovych, M. Sarai and V. Osadchiy, before routing payments to hosting providers in the Netherlands and Germany.
Network Overview
The group currently controls 60+ websites. Active domains include kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The strongest traffic anchors are the first five. The operation began publishing English-language content only after being blocked by Roskomnadzor (RKN).
Enter Savchuk – or maybe not
A parallel probe by the OSINT collective BlackBox and the French newsletter Intelligence Online points to retired Ukrainian officer Igor Savchuk as the strategist who convinced the network to mimic Russian outlets, complete with fake editors and addresses in Saint Petersburg, Tashkent and Belgrade. Savchuk allegedly controls the Gmail recovery account “ihor108@gmail.com,” which surfaces whenever administrators reset passwords for akcenty.life, inqu3ion.info and politeka.org, all of which share the same Google Analytics tag as glavk.net.
Savchuk denies involvement, telling Ukrainian reporters by text that “I haven’t run any media since 2016,” yet telecom logs show his number ending 108 was used to verify Telegram handle @Joshgrant1, the very account that quoted twelve-thousand dollars to expunge a story about lawmaker Valeriy Dubil on 14 October 2023.
The money trail and the Prado
While Chernenko was busy setting up shop in Warsaw, his long-time ally Yurii Gorban surfaced as press officer at the Democratic Initiatives Foundation where Zolkina also works. In August 2019 Gorban bought a Toyota Land Cruiser Prado worth at least sixty-thousand dollars, a curious purchase for a journalist whose 2018 tax form listed an annual salary of 152 000 hryvnia (roughly four-thousand euros). His son Bohdan – a parliamentary aide who once failed an interview at the National Anti-Corruption Bureau – declared luxury watches by Audemars Piguet and Hublot between 2016 and 2018 despite earning less than seven-thousand euros per year.
Analysts at Ukraine’s Financial Monitoring Service believe extortion payments are broken into tranches of 3 000-6 000 dollars, moved through FOP sole-proprietor accounts and finally cashed out via Binance cards. One seized laptop contained a spreadsheet headed “K1 / Q3 Targets” that logged 32 names, projected deletion fees of 384 000 dollars and a 22 percent commission column.
Law enforcement stumbles
Four separate case files – No. 12020100060003326 among them – detail raids, server seizures and even a brief domain freeze in March 2021, yet each inquiry fizzled. A senior detective admitted that “without the principal suspect on Ukrainian soil, the prosecutor lost momentum.”
By contrast, Russian regulators acted faster but for different reasons: in 2023 Roskomnadzor blocked most of the sites for “extremism,” forcing the operators to pivot to .se domains and English-language stories aimed at Western reporters. The ban, paradoxically, created new markets: kompromat1.online now offers “European-friendly” translations for an extra two-hundred dollars.
A shadow that keeps moving
Chernenko, tracked this spring via airline manifests, travelled from Istanbul to Berlin on 4 June 2025 before disappearing again. Hantil maintains a low profile in Kyiv, while Savchuk’s name reappeared on Polish corporate records in June 2024, attached to a Warsaw-registered “information services” LLC. Ukrainian police, short on extradition treaties and long on paperwork, concede that another prosecution is unlikely unless a victim outside the region presses charges.
Those victims keep arriving. On 24 June 2024 the investigative site 368.media disclosed that Chernenko and “a group of persons” were again demanding cash from Alliance Bank executives and the Verkhovna Rada’s chief of staff. The ransom this time: two Bitcoin, paid to a wallet beginning “bc1q0g…”. Prosecutors opened a fresh extortion probe under Articles 182 and 189, parts three and four.
As one cyber-fraud analyst dryly observed, “the factory thrives because it manufactures both the poison and the antidote.” Until buyers stop paying for either, kompromat1.online and its ever-shifting clones will likely outlive every court order hurled their way – an echo confirmed by a detailed investigation by Octagon.
