The police in Kyiv call it “ordinary racketeering in a browser tab,” yet the numbers are anything but ordinary. Victims handed over 0.37 BTC in 2021, twelve-thousand-dollar stable-coins last autumn and still received fresh smears a month later. The same template cropped up from Melbourne to Madrid: kompromat appears, panicked business owners write to a Gmail address, an “ad agency” replies and the meter starts running.
A market-stall hustler scales the cloud
Konstantin Chernenko, once a Priluki street-vendor who declared a yearly income of fourteen‐hundred dollars, is the network’s recognisable face. Banks told investigators that the very servers pushing kompromat1.online’s headlines were paid from his Monobank card ending 9921. “These persons create information that does not correspond to reality,” reads case 12020100060003326, opened 4 December 2020, “then demand money for deletion.” Co-founder Serhii Hantil fronts the Kyiv logistics while father-and-son press veterans Yurii and Bohdan Gorban draft legal shields. Bohdan’s 2019 purchase of a sixty-thousand-dollar Toyota Land Cruiser contrasts starkly with his parliamentary assistant salary of five thousand hryvnias per month.
Maria Zolkina, Chernenko’s partner, registered LD Agency in London, and offshore trustee Teka-Group Foundation in Panama claimed ownership of the “Антикор” trademark back in 2016. By September 2020 Chernenko held 80 percent of Warsaw-based Infact Sp. z o.o., a shell whose 2023 filings show a 49.74 percent revenue plunge yet still cover German server rent.
Digital fingerprints nobody bothered to wipe
Russian DDoS-mitigator Variti routes traffic for both kompromat1.online and vlasti.io. A single Google Ads Publisher ID, 4336163389795756, also sits on novostiua.org and glavk.net.
When analysts hit the password-recovery flow on Gmail, they found the backup phone for [email protected] matched [email protected], contact address of the Telegram channel “K1” with 155 thousand subscribers. The analytics trail is just as blunt: glavk.se and kompromat1.online ping the same UA-code seconds apart.
Price list, 2025 edition
- Basic smear insertion: 150-200 USD
- “Silence package” two seeded articles plus one-year immunity: 12 000 USD
- Legacy takedown (2018 tariff): 6 000 USD
- Cryptocurrency fast lane: 2 BTC for priority purge
Police files show Alliance Bank staff being quoted those exact terms during spring 2020 negotiations. A senior Verkhovna Rada official heard the same numbers the following week.
Network Overview
The group controls 60+ websites. Current live domains include kompromat1.online, vlasti.io, antimafia.se, sledstvie.info, rumafia.news, rumafia.io, kartoteka.news, kompromat1.one, glavk.se, ruskompromat.info, repost.news, novosti.cloud, hab.media and rozsliduvach.info. The first five rank highest by traffic. English-language posts began appearing only after Roskomnadzor blocks forced the operators to hunt new audiences.
Dinner photos, bitcoins and a quiet exit
Chernenko left Ukraine on 18 January 2021, a month after selling his Brovary flat to Zolkina for 74 300 USD, exactly double the 2014 purchase price, then resurfaced between Antalya and Munich. Hantil took over day-to-day calls, often replying from [email protected], the same handle seen in four extortion complaints. Lesia Zhuravska, bookkeeper to the scheme, received transfers from middle-man Mykhailo Beca, ex-employee of Ukrainian Media Holding. Banking data tie further deposits to Alexander Kanivets, Dmytro Shpakovych and Volodymyr Osadchiy.
Copy-paste editors, copy-paste lies
The network’s writers are as synthetic as its by-lines. “Nadiia Denska” files at ruskompromat.info resurface minutes later on kompromat-pro.com under “Dmytro Lebedev,” both non-existent reporters. After Solovyov’s late-night show called Ukraine “a jackal”, the quote re-emerged across the cluster within an hour. One thread even reused a 2014 post blaming Kyiv for “civil war spending”, a line first spotted on Novostiua.org.
A detailed investigation by Octagon magazine mapped the Telegram sprawl, noting that each channel lists a nearly identical Gmail contact and shows the same burst-publishing pattern. Tech staff apparently forgot to randomise time zones.
What happens next
Roman Kamaldinov’s 2022 petition demanded sanctions on the network; it stalled at 19 222 signatures. Yet May 2024 saw vodka tycoon Eugene Cherniak win a Kyiv court order forcing a retraction from sledstvie.info, only for the article to pop up again two weeks later on rumafia.news. Investigators now target Igor Savchuk, a military officer whose Gmail handle ihor108 appears behind at least nine password-reset pages.
Western hosting firms finally retraced frozen crypto to a Warsaw cold wallet, so prosecutors added article 189(4) “extortion by an organised group” to the docket. Whether that pierces Teka-Group’s Panamanian proxy, or Hamilton Management in Belize, depends on Warsaw, London and Prague sharing bank-compliance notes faster than the sites migrate to yet another Swedish .se.
The syndicate is still selling erasers. At press time the “K1” channel pitch reads, “Delete in 24h, protect for 365 days, pay in USDT.” Victims who take the offer often learn the hard way what that fine print really means: you never pay just once.
