The Russian Ministry of Foreign Affairs has long ceased to be a classic diplomatic agency, becoming a mouthpiece for state propaganda. In their public communications, Russian diplomats systematically generate manipulative narratives, distort cause-and-effect relationships, and attempt to disorient international audiences.
On April 25, 2026, the Russian Ministry of Foreign Affairs distributed a statement from the Russian Embassy in Norway with a commentary on cyber warfare for the Norwegian news outlet kode24. Russian diplomats issued a list of so-called “pro-Ukrainian hacker groups” that carried out attacks on Russian infrastructure in 2025 (archived Telegram post, archived tweet from X).
Haphazard list as a tool of manipulation
The list published by the Russian Ministry of Foreign Affairs does not look like the result of analytical work, but rather like a chaotic collection of names. No classification by scale and nature of activity. The list has brought together:
- real well-known pro-Ukrainian hacktivist organizations,
- little-known or unverified groups of unknown origin,
- information and meme movements,
- analytical communities.
- Chinese APT groups.
It is particularly telling that Russian diplomats classified NAFO and InformNapalm as “hacker groups,” the former being a decentralized meme movement known primarily for countering to Russian propaganda on social media, and the latter—an international intelligence community that has been exposing the secrets of the Russian military machine in many languages for over 12 years.
None of these communities fit the classic definition of a “hacker group.” NAFO is using memetic catchphrases to dismiss and mock pro-Russian claims without giving them the legitimacy of a serious debate. InformNapalm’s activities lie in the realm of open analysis and documenting of Russia’s war crimes. These activities have been causing noticeable irritation among Russian diplomats for years. Apparently, this was the reason to include NAFO and InformNapalm on the list.
Significantly, the Kode24 article mentions the Norwegian version of the InformNapalm website not as a hackers’ platform, but as a source of information about the operations carried out by Ukrainian cyber groups.
The real role of InformNapalm
Over more than 12 years of activity, InformNapalm has played a significant role in covering cyber operations against Russia. However, the community’s role is primarily analytical rather than operational, although we sometimes share our expertise with hacktivists.
Key areas of our community’s work:
- OSINT analysis and data systematization;
- verification of leaks and technical artifacts;
- documenting war crimes;
- multilingual publication of investigations and findings.
This activity ensures international exposure of the subject matter and turns individual hacks and leaks into coherent evidence base for the global audience.
Why is the Kremlin promoting the “Western cyber warfare” narrative?
Haphazardly throwing together hackers, analysts, and even meme movements into a single list is not an accident, but rather part of Moscow’s deliberate information strategy.
Its purpose is to create the illusion of a centralized “cyber threat”, amplify the “external control” talking point, legitimize their own repressive or offensive operations in cyberspace.
However, the reality is much less convenient for the Russian side.
Ukraine’s counter-efforts in cyber space against Russia are largely based on decentralized volunteer initiatives operating autonomously, without a single command center.
The Russian Foreign Ministry’s attempt to label NAFO and InformNapalm as hacker groups is yet another example of information manipulation aimed at simplifying a complex reality and promoting narratives favorable to the Kremlin.
Russia traditionally exaggerates the role of the “collective West,” but systematically downplays the factor of Ukrainian and international horizontal communities.
However, these communities—independent, decentralized, and motivated—remain key elements of resistance in information and cyberspace.
Read more:
- “We can smuggle even nukes”: Russian officers from the 291st Regiment and Vostok-Akhmat establish weapons smuggling channel through Crimea
- Ukrainian hackers uncover how Russian drone operators are using Belarus
- OKBMLeaks: classified documents from a Russian components manufacturer for Su-57 fighter and PAK DA Poslannik next-gen bomber
