Full Report
He believed his online date was trapped under Russian occupation. She may never have existed.
Analysis Summary
# Threat Actor: Unattributed romance-scam operators impersonating occupied-Ukraine residents
*Note: The article does not identify a named threat actor, group, or cluster. The "actor" here is a loose set of scammers operating fake dating personas. The summary below reflects only what the article reports, and it flags gaps where the template expects technical detail the article does not contain. The article was also truncated, so some details may be missing.*
## Attribution & Identity
- **Named actor:** None identified. The article does not attribute the operations to a specific group, country, or criminal network.
- **Persona aliases observed:** "Alona Panchenko" (claimed to be from Enerhodar, Zaporizhzhia Oblast) and "Viktoriia Kremenchutska" (claimed to be trapped in Russian-occupied territory). These are almost certainly fabricated identities.
- **Associated groups:** None named. The article describes a pattern across at least 58 referred cases, which suggests a repeatable playbook, possibly run by multiple operators.
- **Confidence:** The article describes the activity as scams. It does not say whether the operators are Russian, Ukrainian, or otherwise. Any state or group attribution would be speculation.
## Activity Summary
- Since 2022, the non-profit Helping to Leave has received about 200 requests over four years from foreign men asking for help evacuating Ukrainian women they met online. Requests now arrive up to four times a week.
- Victims reported romance relationships with personas claiming to live in Russian-occupied areas, followed by escalating crises and requests for money.
- A Kyiv Independent investigation of 58 referred cases found that many of the women were not under occupation. The scammers appeared to use stolen photos, fake identities, forged documents, and AI-manipulated images and video.
- The article profiles two victims. One, an Austrian man, was asked for money but did not send it. The other, a German man, did send money.
## Tactics, Techniques & Procedures
- **Initial contact and grooming:** Matching on a dating platform (Christian Cupid is named), then moving quickly to off-platform email.
- **Avoidance of live verification:** Repeated refusal of phone or video calls, with excuses such as having no mobile phone and using an old tablet on public Wi-Fi.
- **Manufactured hardship:** Stories of unemployment, lack of food, and hospitalization for "severe exhaustion" to build sympathy and urgency.
- **Fabricated evidence:**
- Stolen or repurposed portraits (traced to another real person).
- Photos attributed to a local media outlet.
- AI-edited images, including a basement "drone attack" photo whose Content Credentials showed generative AI editing in Photoshop.
- A forged Ukrainian ID card with an invalid document number and a digitally inserted portrait.
- **Payment collection:** Requests for money via Western Union. The operators told a victim to list Ukraine as the recipient's country, which contradicts the claimed location, since Western Union does not operate in occupied Enerhodar.
- **Pretext for money:** The "escape" from occupation is framed as the only way to meet the victim.
**MITRE ATT&CK:** The article contains no ATT&CK IDs. The closest conceptual fit is social engineering and fraud, but mapping it to specific IDs would be the analyst's inference, not the article's content.
## Targeting
- **Sectors:** Consumers, specifically individuals using online dating services. Non-profits that assist evacuation are a secondary target, since they receive the requests and pleas.
- **Geography:** Victims are foreign men, including Austrian and German nationals named in the article. The personas claim to be in Ukraine's occupied territories, particularly Enerhodar and Zaporizhzhia Oblast.
- **Victims:** Individual men. Helping to Leave is an incidental recipient of the scam requests, not a direct victim of compromise. No organizations were compromised.
## Tools & Infrastructure
- **Malware:** None mentioned.
- **Platforms and services abused:**
- Christian Cupid (international dating site)
- Email (used to move conversations off-platform)
- Western Union (payment collection)
- Public Wi-Fi (claimed by personas, not confirmed as attacker infrastructure)
- **Tools for fabrication:** Generative AI image and video editing, Photoshop, stolen photo libraries, forged document templates.
- **C2, domains, IPs:** None reported.
## Implications
- **Victim harm:** Financial losses and emotional harm. The scam also exploits sympathy for Ukrainians under occupation, which can erode trust in real evacuation requests.
- **Burden on civil society:** Helping to Leave and similar groups must spend time vetting requests, which could delay help for real people in occupied areas.
- **Scalability:** Generative AI lowers the cost of producing convincing images, documents, and video, which makes verification harder for victims.
- **Information integrity:** Fabricated claims about occupied areas could be reused for disinformation or propaganda.
- **Assessment:** High likelihood of continued activity given the volume growth (about 200 requests over four years, now several per week). Impact is primarily financial and psychological for individuals, with moderate reputational and operational impact on aid organizations.
## Mitigations
**For potential victims and the public**
- Never send money to someone you have not verified by live video, and treat refusal to video call as a major red flag.
- Run reverse image searches on profile and "evidence" photos to check for stolen or repurposed images.
- Check Content Credentials or other provenance metadata on images, and look for AI-editing signs.
- Verify government-issued ID documents with the issuing authority before trusting them.
- Be skeptical of money transfers listed to a country that does not match the stated location.
- Report suspicious profiles to the dating platform and to national fraud reporting channels.
**For dating platforms**
- Flag and move quickly on accounts that push off-platform contact early.
- Use reverse image and AI-generation detection on profile photos.
- Add friction or warnings for users who request money transfers or cite emergencies.
**For aid organizations (such as Helping to Leave)**
- Build a standard verification workflow for rescue requests, including requiring verifiable contact channels.
- Warn requesters about common romance-scam patterns and share red flags.
- Coordinate with journalists, platforms, and law enforcement to track recurring personas and photos.