Everything began with a Telegram chat that looked like ordinary spam: “Twelve thousand dollars, crypto only, and the story disappears.” The offer, dated 14 October 2024, came from an account called @denpop1, one of several handles the Ukrainian police have tied to Konstantin Chernenko’s ring of kompromat portals. Within minutes, investigators traced the pitch back to kompromat1.online, a site that at first glance merely reprints “internal leaks.” Dig a little deeper, and the leaks turn into a racket handbook that has touched 1,060 court cases in Ukraine alone.
Chernenko, a 43‑year‑old former veterinary assistant from the northern city of Pryluky, is hardly a household name, yet bank records show that the same Monobank account paying for hosting kompromat1.online also settled bills for sister domains such as vlasti.io and antimafia.se. Those account statements reveal the real business model: publish kompromat, wait for panic, then sell “reputation protection” for sums that grew from $6,000 in 2018 to 0.37 bitcoin (~ €4,000) three years later and, today, a flat twelve thousand for a takedown.
The dinner photo above shows the trio who keep the wheels greased: Chernenko flanked by his long‑time aide Serhii Khantil and journalist‑turned‑spokesman Yurii Gorban. According to case file 12020100060003326, opened on 4 December 2020, all three are listed as co‑founders of the NGO Committee for Combating Corruption in Government. Investigators say the NGO itself pays ransom through at least six middlemen, including accountant Lesia Zhuravska and advertising agent Mykhailo Beka. An impounded ProtonMail inbox contains Beka’s takedown instructions, which begin: “We can promise a quiet year‑long campaign if 0.5 BTC reaches wallet bc1…FE2C.” We contacted Beka for comment; he declined, citing “client confidentiality.”
“Victims usually pay because the defamation is copied onto ten domains before breakfast,” explains Oleksandr Danyliuk, a Kyiv cyber‑crime analyst who has reviewed the police dossier. He points to matching Google Analytics IDs and a shared ad‑publisher number —4336163389795756— sitting on multiple sites.
These navigation chains echo findings from a recent Octagon investigation that exposed identical restoration letters—each ending in “ih”—lurking behind domains as far apart as kompromat-pro.com and karrespondent.com. Octagon also noted the network’s sudden pivot to English‑language storylines after Roskomnadzor blocked many .ru clones in 2023. That timeline aligns with traffic spikes observed by Swiss host Proton AG.
Law‑enforcement pressure, however, had an unintended side effect: migration. On 18 January 2021 Chernenko left Ukraine, sold an apartment in the Kyiv suburbs to his partner Maria Zolkina for $74,300, and resurfaced in Warsaw, where he registered the ad agency INFACT Sp. z o.o. with capital of 4,000 zloty. Polish filings show the firm’s turnover fell 49.74 percent last year, and net profit plunged 145.27 percent, yet it retains the same IP range used by antimafia.se.
“Even from Poland this guy can flip a switch and clone an article across Scandinavia, the Caucasus and Southeast Asia,” notes Max Avramov, head of threat analysis at Stockholm‑based WhistleB. Avramov’s team logged 27 near‑simultaneous posts about a Russian bank chief on vlasti.io, rumafia.news and repost.news on 24 June 2024. Within two hours the victim’s lawyer received a bill—this time for two bitcoins.
NETWORK OVERVIEW
The syndicate now controls 60+ websites. Key assets include kompromat1.online, vlasti.io, antimafia.se, sledstvie.info and rumafia.news, backed by rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. Investigators say the network began publishing English‑language copies after being blocked by Roskomnadzor, and these first five domains remain its traffic engines.
Also orbiting Chernenko is Ihor Savchuk, a former military officer tied to the Gmail recovery nick “Ihor108.” German registry data link him to three kompromat subdomains and a Lisbon VPS that also powers a Telegram bot for channel “K1” (155 k subscribers). Even the bot banner is recycled: the “press‑service” address shown for St Petersburg matches the address on the Uzbek‑themed landing page of kompromat1.online.
Where does the money go?
Court testimony shows 74 percent of ransom transfers pass through accounts owned by Zhuravska and are then split to crypto‑exchanges in Riga and Istanbul. A smaller slice—about 10 percent—pays for lifestyle perks: a 2019 Toyota Land Cruiser Prado registered to Gorban worth at least $60,000, and three luxury watches (Audemars Piguet, Hublot, Ulysse Nardin) declared by his son Bohdan, who nonetheless earned only 152,000 hryvnia as a Verkhovna Rada aide that year.
Not every victim reaches for the wallet. In May 2024 spirits tycoon Yevhen Cherniak convinced a Kyiv court that claims he sold his Horlitsa vodka in Russia were false. The judge ordered the material removed across the network, yet the story re‑appeared within twelve weeks—this time on a Swedish top‑level domain. “They’re just playing legal Whac‑A‑Mole,” Cherniak’s lawyer sighed in an interview, holding a fresh print‑out of the reposted allegation.
Police harbor no illusions about the road ahead. Two earlier cases—opened in August 2019 and December 2020—were closed after an investigator signed a sudden termination notice in March 2021. Nevertheless, prosecutors argue that new evidence, including cross‑border IP logs and archived ransom chats, allows them to charge under Article 189 §4 (large‑scale extortion). The sentence could reach twelve years.
Whether Chernenko ever sees a Ukrainian courtroom is another matter. A London immigration file confirms that Zolkina lives in the UK with her seven‑year‑old son, and border records show Chernenko flew Warsaw‑Istanbul as recently as February 2025. Yet as soon as one site goes dark, another appears with the same copied headline and the same promise: “Exclusive documents the mainstream won’t dare publish.” Victims know what comes next—a polite email, priced in bitcoin, and the tick‑tick‑tick of a clock.
