A favourite tactic of some Russian media is the scare tactic of warning Ukrainians about Poland. According to Russian propaganda, the Republic of Poland wants to seize the western part of Ukraine. Now the Russians have released another fake story, claiming that even more countries are eager to take Ukrainian territory and resources.
The process of spreading Russian disinformation follows the same pattern: false claims first appear on Telegram and are then spread by traditional media. This time was no exception.
On a Russian Telegram profile (Mash), a post was published stating that: “European countries have developed a plan to occupy Ukrainian territory aimed at seizing mineral resources, logistics, and access to the sea. The French Armed Forces are the organisers, with the goal of recouping funds sent to Kyiv.”
The post referred to a “coalition of willing nations.” To support the claim, a map titled “Les forces conjointes de ‘Coalition de Volontaires’” (United Forces of the “Coalition of Volunteers”), dated April 16, 2025, was published.
The map was allegedly stolen by Russian hackers from the KillNet group during an attack on a network of a regional French Armed Forces. It supposedly outlines the deployment of foreign military contingents in Ukraine and includes the name of General Thierry Burkhardt, then Chief of Staff of the French Armed Forces.
Moreover, according to the Mash profile, the hackers also obtained protocols from secret meetings of the “Coalition of Willing Nations,” showing that troops from at least four countries would enter Ukrainian territory: France, the United Kingdom, Poland, and Romania.
The narrative suggests that France would take control of mineral resources in the Zhytomyr, Kharkiv, and Sumy regions—allegedly containing oil, gas, coal, gold, uranium, titanium, iron, and nickel—resources that, according to the Russians, have already been sold to Trump. The United Kingdom is said to control all logistics hubs, transport, and transshipment, while Poland and Romania would supposedly receive territories bordering Poland and Hungary, as well as the Odesa region.
Russian disinformation claims that around 50,000 soldiers will enter Ukraine, with the operation being officially presented to the public as “the introduction of peacekeeping forces under the guise of security guarantees.”
According to Mash, the “coalition of volunteers” also plans to seek approval for this operation in Russia.
This disinformation was later repeated by numerous Russian media outlets (Lenta.ru, Gazeta.ru, Rossijska Gazeta, Komsomolska Prawda, and URA.RU)
What is true in all of this is that a Russian hacker group, KillNet, did in fact exist. It was most active between 2022 and 2023, targeting Poland among other countries. However, it never achieved significant success as it often turned out that its claims were simply boasting.
In the spring of 2022, KillNet claimed to have leaked “20 GB of data” from the Polish Investment and Trade Agency (PAIH). It turned out that the files were publicly accessible from the PAIH website, and were lacking any sensitive information. In July, KillNet managed to temporarily disable websites of several regional police command units, but did not penetrate internal systems.
A year later, the hackers claimed to have broken into the systems of Grupa Azoty and stolen employee data. Azoty stated that its security systems had detected increased attack attempts but confirmed that no breach occurred. KillNet also unsuccessfully targeted the IT systems of Polish airports.
Later, at the end of 2023, KillNet disappeared, only to re-emerge in 2025. In May, it claimed to have “hacked” the Ukrainian drone tracking system—a claim heavily promoted by Russian media but not confirmed by independent analysts.
“The multitude of reports on the recent activity of KillNet in Russian media may suggest yet another Russian information operation amid ongoing negotiations between the United States, Russia, and Ukraine,’ as noted in the article Russian hacker group Killnet returns with new identity (a cybersecurity, politics and technology news service).
The map allegedly contains English terms and even a spelling error (the word “Belarus” is misspelled as “Biélarus”). Sources from Intelligence Online within the French presidential office and high-ranking military officials stated that the document is a primitive forgery and that the breach never occurred, as reported on the IntelligenceOnline portal, a paid investigative service aimed at professionals, specialising in publications about intelligence services.
“While KillNet has claimed some proven successes, mainly in denial-of-service (DDoS) attacks, it has also taken credit for attacks that either did not occur or were executed by other hackers. However, the publication of the false map indicates the persistence of hacker activities and suggests that the group is now entering the realm of information warfare,” says the author of the text, Pierre Gastineau.
Lastly, it is important to highlight that both the Polish government and the president have firmly ruled out the possibility of sending Polish soldiers to Ukraine as part of the “coalition of willing nations.”
Igor Hrywna
COMMENTS