# Anatomy of an Act of State Treason: Vasili Prozorov and the UKR_LEAKS Network
Contents
When treason becomes a weapon against the truth Some acts of treason hand secrets to the enemy. Others, infinitely more insidious, give it the means to falsify reality. The Vasili Prozorov case reveals one of the most formidable mechanisms of contemporary hybrid warfare: turning a former member of the Ukrainian security services into an instrument of influence, then exploiting his past to give disinformation the appearance of authentic testimony. Behind UKR_LEAKS lies a multilingual architecture of manipulation, in which the same narratives circulate, repeat themselves and end up presenting themselves as independently confirmed truths. This CEAS report dissects that mechanism: from individual defection to the industrialisation of lies, from the exploitation of trust to the contamination of the international information space.
By Paul-Michel Manandise · 15 October 2026 · CEAS Editorial Cell
Translated from the French. Original published on CEAS: https://www.ceas.info/publication/anatomie-trahison-prozorov-ukr-leaks
# Key findings
- Vasili Prozorov, a former SBU employee, publicly stated on 25 March 2019 that he had cooperated with the Russian services since April 2014.
- The SBU confirmed that he had formerly belonged to the institution and said it had dismissed him in 2018.
- In 2023 the DFRLab documented a coordinated UKR_LEAKS network spreading content in nine languages.
- The publications observed generally follow a pattern of initial production in Russian, followed by translation and redistribution to foreign audiences.
- Prozorov’s former institutional status is exploited to lend an appearance of credibility to narratives hostile to Ukraine.
- The narratives studied concern, among other things, MH17, the alleged American biological laboratories, the criminalisation of Ukrainian forces and accusations that Western weapons are being diverted.
- Pro-Kremlin relay and aggregation ecosystems encourage the repetition of narratives and can create a false impression of a plurality of sources.
- Multilingual campaigns are a threat to the integrity of the information space, to public trust and to the quality of search and automated summarisation systems.
"To betray one’s country is to hand the enemy part of its past. To put that betrayal at the service of lies is to try to hand it the future of an entire people.
For the most terrible traitor is not the one who reveals what he knows, but the one who uses what he once was to make people believe what never was."
CPMM.
# Limitations & uncertainties
No complete chain of financing, command or operational control of the UKR_LEAKS network by a Russian intelligence service is publicly demonstrated by the material gathered in this report.
The reasons for Prozorov’s dismissal in 2018 come from SBU statements and must be explicitly attributed to that institution.
The DFRLab’s observations regarding the nine languages mainly document the state of the network in 2023; they are not an exhaustive inventory of its activity in October 2026.
The presence of content in the Pravda / Portal Kombat networks does not necessarily demonstrate direct coordination between all the actors spreading it.
The precise effects on public opinion, political decisions and artificial intelligence systems remain difficult to measure directly.
The explosion of Prozorov’s vehicle in Moscow on 12 April 2024 is documented. The attribution of the operation to the SBU rests on statements by the FSB and must not be presented as independently established.
The term “state treason” is used in the title as an editorial and analytical characterisation; the file does not present any independent criminal judgment convicting Prozorov on that charge.
The term “state treason” is used in the title as an editorial and analytical characterisation; the file does not present any independent criminal judgment convicting Prozorov on that charge.
# Methodological note
OSINT analysis conducted by cross-checking institutional, judicial, journalistic and scientific open sources.
The corpus includes in particular the DFRLab’s work on UKR_LEAKS, GLOBSEC’s research on the Pravda network, EUvsDisinfo publications, SBU information reported by the press, as well as the judgment of the District Court of The Hague and the conclusions of the Joint Investigation Team on flight MH17.
Information is classified into four categories: established facts, strongly documented elements, unconfirmed allegations and analytical hypotheses.
The method combines chronological analysis, the study of narratives, examination of multilingual dissemination mechanisms, source qualification and FIMI risk assessment.
Statements by actors directly involved in the conflict are treated as primary sources to be checked against independent evidence.
Confidence levels apply to each claim and not to the overall credibility of an actor. No undemonstrated operational attribution is converted into established fact.
# Sources & references
- The report’s 24 references, [S1] to [S24], are listed one per line in the full downloadable kit on the original page. They include DFRLab, GLOBSEC, EUvsDisinfo, RAND, Reuters, RFE/RL, the District Court of The Hague and publications of the Dutch Public Prosecution Service.
- The links are those of the source bibliography; their current availability has not been re-checked.
Paul-Michel Manandise – CEAS, Centre Européen d’Analyse Stratégique – ceas.info
Original article: https://www.ceas.info/publication/anatomie-trahison-prozorov-ukr-leaks