---
title: "The Market of Reputational Extortion: How Coordinated Telegram Attacks Hit Ukrainian Business"
description: "A market for commissioned media attacks on business has formed in the Ukrainian segment of Telegram: the audience of 14 channels reaches 12 million. Philip Morris, Uklon, Ajax Systems and other companies face coordinated discrediting campaigns and payment demands."
date: 2026-08-26T09:34:04.000Z
lang: en
url: https://xab.info/en/posts/reputational-extortion-market-coordinated-telegram-attacks-on-ukrainian-business
tags: [ukraine-business, telegram, reputation-attacks, media-manipulation, ajax-systems, uklon, philip-morris]
publisher: "XAB.info"
---

# The Market of Reputational Extortion: How Coordinated Telegram Attacks Hit Ukrainian Business

![Reputational extortion infographic: coordinated Telegram attacks and anonymous channels targeting Ukrainian businesses — Ajax Systems, Philip Morris Ukraine, uklon](https://xab.info/media/2026/08/26/rynok-reputatsionnogo-reketka-telegram-ataki-na-biznes/rynok-reputatsionnogo-reketka-telegram-ataki-na-biznes-1.webp)

## 🎯 Key Points

- A market for commissioned media attacks has formed in Ukrainian Telegram: 14 channels with a combined audience of about 12 million readers systematically publish discrediting content
- Philip Morris recorded more than 200 negative publications in 66 channels (2024), Uklon — more than 300 publications over two months with an offer to pay 200,000 dollars
- In recent months, a similar campaign has been directed against Ajax Systems and its founder, Oleksandr Konotopskyi
- Media experts call such practices "digital terrorism" and reputational extortion, threatening the country's investment image

Ukrainian business, amid the war, remains one of the key elements of the state's economic resilience. However, according to an RBK-Ukraine investigation, a full-fledged "market" for the distribution of commissioned discrediting content targeting major companies has emerged in the Ukrainian segment of Telegram. Through anonymous channels and manipulative websites, Philip Morris, Meest China, Uklon and other structures have previously been targeted. In recent months, a similar campaign has continued against Ajax Systems and its founder, Oleksandr Konotopskyi. The combined audience of the 14 largest Telegram channels that regularly and systematically publish commissioned materials approaches 12 million readers.

### The Mechanics of a Coordinated Campaign

According to observations by media market researchers, the mechanics of the attacks look similar in most cases. First, an initial publication appears — often on an obscure resource or in a small Telegram channel. After that, dozens of other channels pick it up almost simultaneously, repeating the same theses, and then individual formulations begin to be cited by websites or even major media outlets. Media expert Oksana Moroz notes that Telegram has become the main environment for launching such campaigns: "You only need to check a key phrase through search or a monitoring system — and you will see that the messages appeared almost synchronously. This is one of the clearest markers of a coordinated campaign." According to her, just a few years ago such campaigns often began on dubious websites before moving to social networks. Today, in most cases, Telegram itself becomes the primary platform, after which the information spreads through other resources.

### Philip Morris, Uklon, Meest China: Who Is in the Crosshairs

Philip Morris Ukraine said it has repeatedly faced waves of discrediting campaigns. In 2024, according to the company, more than 200 negative publications were recorded in 66 Telegram channels with a combined audience of about six million users, and the scale of the campaign was estimated at over 100,000 dollars. PMU links such attacks to its consistent stance in the fight against the illegal tobacco market. In March 2024, Uklon CEO Serhiy Hryshkov publicly accused a notoriously scandalous Telegram channel of a "disinformation attack" that, in his words, escalated into "genuine digital terrorism." Hryshkov reported more than 300 negative publications over two months and claimed that the company was offered the chance to stop the campaign for 200,000 dollars. After that, Uklon turned to law enforcement agencies. A similar scenario was also described by Meest China co-owner Vyacheslav Lysenko: in 2024, a number of channels spread information about his alleged involvement in organizing an underground casino uncovered by the BEB. The businessman himself was not a subject of the criminal case and filed lawsuits in court to protect his honor, dignity and business reputation. In April 2025, a wave of publications affected the "Tekstil-Kontakt" group of companies. According to RBK-Ukraine, Ajax Systems employees also received offers from "intermediaries" to settle the matter for a financial reward.

### "Digital Terrorism": A Threat to the Investment Image

In some of the cases that business has publicly disclosed, the information pressure was accompanied by demands to stop the campaign in exchange for a reward. This is why some business representatives call such practices "digital terrorism" or reputational extortion. Philip Morris Communications Head in Ukraine, Viktoriia Ilinska, notes: "In fact, the mechanics of most information attacks is very similar to the work of propaganda. It uses manipulative or knowingly false information, which primarily appeals to emotions." Coordinated information attacks on companies undermine not only the reputation of specific structures, but also trust in business as a whole, as well as the country's investment image in a situation where economic resilience is a matter of national security.

### Contradictory Data

It is important to note that most of the quantitative indicators cited in the investigation — the number of publications, the size of audiences, the estimated cost of campaigns — are based on the statements of the companies themselves and expert assessments, rather than on an independent audit. Thus, the estimate of the campaign against Philip Morris of "more than 100,000 dollars" and the offer to Uklon of "for 200,000 dollars" are quoted from company representatives. RBK-Ukraine does not have independent confirmation of the exact amount of financial demands in each case. Moreover, the exact attribution of channels and their connection to specific clients has not been disclosed in the public domain: this concerns monitoring data and business statements, rather than court verdicts or investigation results. This means that the actual scale of the "market" may either match or differ from the figures cited.

## 🔍 Fact-Check Verification

- [Business as a Target: How Media Attacks Hit Ukraine's Economic Resilience](https://www.rbc.ua/ukr/news/biznes-k-mishen-k-mediyni-ataki-b-yut-ekonomichniy-1787733168.html) - Единственный источник. Содержит заявления Philip Morris, Uklon, Meest China, Ajax Systems и экспертные оценки Оксаны Мороз. Количественные данные (200+/300+ публикаций, $100K/$200K) основаны на словах компаний, не подтверждены независимым следствием или судом. Механика кампаний описана последовательно и непротиворечиво.

## ❓ FAQ

### Q: What is the "market of media attacks" in Ukrainian Telegram?
**A:** It is a network of anonymous Telegram channels that systematically and coordinately publish discrediting content against specific companies. According to researchers, the 14 largest such channels have a combined audience of about 12 million readers. Campaigns are often accompanied by demands to stop the publications in exchange for a financial reward.

### Q: Which companies have become victims of such campaigns?
**A:** The RBK-Ukraine investigation names Philip Morris Ukraine (more than 200 publications in 66 channels in 2024), Uklon (more than 300 publications over two months, March 2024), Meest China (false accusations of involvement in an underground casino, 2024), the "Tekstil-Kontakt" group (April 2025) and Ajax Systems (recent months).

### Q: How do you distinguish a coordinated campaign from ordinary criticism?
**A:** According to media expert Oksana Moroz, the key marker is synchronicity: the same text or identical theses appear almost simultaneously across an entire network of Telegram channels. Checking a key phrase through search or a monitoring system shows that the messages were published virtually at the same time.

### Q: What do companies do in response to such attacks?
**A:** Companies turn to law enforcement agencies and courts with lawsuits to protect their honor, dignity and business reputation. Uklon, after a public statement by CEO Serhiy Hryshkov, filed a report with the police. Meest China filed lawsuits in court. However, according to RBK-Ukraine, some companies also received offers from "intermediaries" to settle the matter for a reward.