When Disinformation Reaches the President's Desk: How a Coordinated Smear Campaign Captured Ukraine's National Security Apparatus

On May 2, 2026, President Volodymyr Zelensky signed a decree imposing personal sanctions on Bohdan Pukish, the director of an Ivano-Frankivsk plant called Presmash. The stated grounds: alleged ties to Viktor Medvedchuk, the pro-Russian oligarch — godfather to Vladimir Putin's daughter — stripped of Ukrainian citizenship and exchanged to Moscow in 2022.

The evidentiary basis behind the decree, as far as anyone outside Ukraine's National Security and Defense Council has been able to determine, consists of a series of Telegram posts and articles on websites with documented reputations for paid placement. No criminal case for obstructing the Armed Forces or collaborating with Russia. No indictment. No hearing. No documented evidence of wrongdoing: no serial numbers of the allegedly defective munitions that anchor the public narrative against him. No batch numbers. No adverse findings from military quality-control representatives, no claims, no complaints. No witness statements. Pukish, who has never met Medvedchuk, never belonged to his party, was not summoned, questioned, or notified of any alleged offense before the decree was signed.

Presmash, meanwhile, is a real factory making real things for a real war. In 2024, it delivered more than 95,000 mortar shell bodies — 120mm and 82mm — to the Ukrainian armed forces. For context: that same year, NATO countries combined supplied Ukraine with roughly 300,000 mortar rounds. A single Ukrainian plant in Ivano-Frankivsk produced almost a third of that volume.

That plant is now sitting idle. Bank financing frozen. International defense contracts suspended. Its director under sanctions for the unevidenced charge of "supporting an accomplice of the aggressor state" — a designation that, in Ukraine's legal architecture, exists primarily to freeze Russian assets and Kremlin proxies.

I have been investigating the information campaign against Pukish since October 2025, when he first approached our newsroom with stacks of anonymous publications targeting him. What I found then — and what has only sharpened since — is not a story about institutional malice. It is a story about something more troubling and, in some ways, more dangerous: how a sufficiently disciplined disinformation campaign can reach all the way up to a presidential signature, supplying its own pretext, its own appearance of evidence, and its own implicit policy recommendation.

This is the story of a manipulated decree. And it deserves attention not because Ukraine's institutions failed by design, but because they were designed for a different threat than the one they are now absorbing.

A System Built for Foreign Actors, Now Absorbing Domestic Inputs

Ukraine's sanctions mechanism was built in 2014 and refined after 2022 to do one thing well: act quickly against Russian state actors, Kremlin-aligned oligarchs, and the financial networks of an aggressor state. The mechanism is, by design, fast. It is, by design, based on classified intelligence inputs that the target has no opportunity to see or contest. It is, by design, executed by presidential decree on the recommendation of the National Security and Defense Council.

All of this is appropriate when the target is a Russian general, a Kremlin financier, or a sanctions-evasion network. The classified-information shortcut exists because, in those cases, intelligence sources cannot be exposed and ordinary judicial process cannot reach the target.

The vulnerability emerges when the inputs to that mechanism are not the products of intelligence work but the products of a domestic information operation. The procedure does not change. The signature on the decree does not change. But the underlying evidence — what the institution is actually acting upon — has been substituted. What looks like a national security determination is, in such cases, a repackaged Telegram post.

This is not an indictment of the National Security Council. It is a description of an attack surface. Any institution that acts quickly on classified inputs has, by definition, limited capacity to verify the provenance of those inputs in real time. If a coordinated campaign can produce dozens of mutually reinforcing publications across the Ukrainian information space, can secure mainstream pickup through "user forum" laundering on respected platforms, can generate the appearance of a journalistic consensus — then the institutional process is consuming poisoned data.

The question Pukish's case raises is not whether Ukrainian institutions are corrupt. It is whether they are equipped to detect when their own decision-making is being weaponized against them.

The Pukish File as Diagnostic

The Pukish file is unusually instructive because the seams show.

The information campaign against him began in October 2024. The first wave: anonymous Telegram channels and a cluster of sites accusing him without basis of ties to Medvedchuk. Earlier that year, a broader scandal had been roiling Ukrainian media about defective mines allegedly supplied to the front. Despite the fact that every mine carries a series, batch number, and color identifying its manufacturer, the accusations remained address-less. Pukish was folded into that scandal as a supposed producer of defective mortar shells. Evidence offered? None. Then a pause. Then another wave in spring 2025. Then a summer wave. Then another in autumn. By the time of the sanctions decree, we had documented at least seven discrete cycles, each pushing through approximately the same network of sites, with text variations and the involvement of supposedly serving Ukrainian military voices — who turned out, on examination, to be PR operatives — that point unmistakably to central coordination.

The substantive allegations have one consistent feature: they contain no document, no checkable detail. No serial numbers. No batch identifiers. No dates of delivery. No names of military units that received the allegedly defective rounds. No quality-control documentation. When Pukish contacted Yurii Butusov, editor of Censor.net, asking on what basis his publication had circulated the "200,000 defective mines" claim, Butusov reportedly replied that the source was "a forum user" on his site. A forum user, on a major Ukrainian publication, generating allegations against a defense manufacturer during wartime, with no editorial verification — and when Pukish subsequently asked for the defamatory material to be removed, no response at all.

Pukish then obtained written responses from every relevant military quality-control representation — Ivano-Frankivsk, Dnipro, Pavlohrad, and central in Kyiv. All confirmed: no record of substandard production. The Fifth Channel, which had run an investigative segment based on the toxic source material, initially published the piece, then deleted it, and eventually issued a retraction. The production company behind the segment — Eurasia Media Group — apologized. None of this seems to have figured into the National Security Council's deliberations.

In February 2025, Pukish was physically attacked outside his home. Two men in balaclavas sprayed him with a chemical agent and broke his cervical vertebrae. He has since had two titanium discs implanted in his neck. The attackers were caught and gave testimony naming a third accomplice — reportedly a serviceman who had driven a Ministry of Defense vehicle to the scene — who has yet to be arrested. Eleven hearings later, the case has not progressed to substantive review.

In summer 2025, a criminal case was opened against Pukish. The plaintiff, a lawyer acting on behalf of a former serviceman, filed for criminal proceedings in thirteen different cities. Twelve refused. The thirteenth — a specialized investigating judge in Vyshhorod — accepted the case based, in the lawyer's own filing, on a Fifth Channel broadcast. No documents. No physical evidence. Just the same broadcast that the channel itself had since deleted and apologized for airing.

This is what the operational picture looks like before sanctions are added on top: a multi-year campaign combining media saturation, financial strangulation, physical intimidation, and procedurally opaque criminal-process manipulation. The sanctions decree was not the beginning of the story. It was the culmination — the point at which a campaign that had failed to produce a single piece of usable evidence in eighteen months nonetheless succeeded in placing its conclusion on the desk of the President of Ukraine.

Between the anonymous Telegram channels and the presidential desk lies a chain of intermediate steps: republications on platforms with paid-placement reputations, mainstream pickup through "user forum" attribution, a criminal case filed in thirteen cities until a willing judge was found, analytical briefs prepared somewhere along the way for the Council. Somewhere in that chain, an unverified accusation was repackaged as an evidence base. Identifying where, by whom, and to whose benefit is the work that needs doing. The institutions that signed the decree are best positioned to do it.

Why This Matters Beyond Ukraine

It would be easy to dismiss this as an idiosyncratic Ukrainian case. The structural problem it points to, however, is not Ukrainian. It is what happens to sanctions regimes in every democracy that builds them in haste.

The United States expanded its own sanctions toolkit dramatically after September 2001, then again after Crimea in 2014, then again after February 2022. The European Union now maintains sanctions regimes that overlap, conflict, and operate with procedural standards far below ordinary administrative law. The United Kingdom's Unexplained Wealth Orders, intended as a tool against Russian and Central Asian kleptocracy, have been used domestically in ways that British courts have found procedurally problematic.

Each of these regimes was built around the same assumption: that the targets would be foreign actors against whom ordinary legal process was either impossible or insufficient. Each has, to varying degrees, drifted inward — not because the institutions were captured, but because domestic actors learned to feed them inputs the institutions were not designed to filter.

What is happening to Pukish is an early version of a process that all of these jurisdictions are now navigating. The Ukrainian variant is sharper because of the war, because of the legitimate threat environment, and because the National Security Council mechanism was designed to act on classified intelligence about Russian operations — precisely the conditions that maximize speed and minimize the time available for input verification.

It matters specifically for Western policymakers who care about Ukraine's long-term institutional resilience. The country's defense-industrial base is the foundation of any sustainable post-war settlement. If individual producers can be removed from the field by anonymous Telegram campaigns escalated through presidential decree, then the defense-industrial base is not a base. It is a list of permitted suppliers, subject to administrative review. That is not the same thing.

It also matters for the credibility of the sanctions instrument itself. Western governments have spent fifteen years building sanctions as a primary tool of geopolitical coercion. The legitimacy of that tool depends on its being seen as fact-based, evidence-driven, and procedurally serious. Every visible case in which the sanctions process appears to have been hijacked by a coordinated disinformation operation — in any partner country — erodes that legitimacy. Russia and China have already begun citing Western and Western-adjacent cases to argue that sanctions are inherently arbitrary. They are not, yet. But the more often the input layer is corrupted while the output layer continues to operate normally, the harder that argument becomes to refute.

What Comes Next

I do not know whether Pukish will get his factory back. I know that the people who orchestrated the campaign against him have, for now, succeeded — not because the system endorsed them, but because the system was not configured to detect what they were doing.

I know that the procedural questions raised by his case — what verification standards govern the inputs to Ukrainian presidential sanctions, what role independent assessment plays before a National Security Council recommendation, whether targets have any meaningful right of review when the underlying material turns out to be fabricated — are questions that Ukraine's allies should be asking, publicly, now, while there is still time to influence the answer.

I know also that the Pukish case is not unique. It is the most documented version of a pattern I have been tracking across Ukrainian defense procurement for two years. The other cases are quieter because the targets are smaller, or more isolated, or more easily intimidated. Pukish made it onto the record because he refused to disappear quietly.

There is a constructive path here. The decree can be reviewed in light of the evidentiary record that has now become available — the quality-control letters, the Fifth Channel retraction, the Eurasia Media Group apology, the documented absence of any concrete claim that survives examination. The investigation that should follow is not into Pukish. It is into the chain that delivered his name onto a sanctions list. Who prepared the materials. Who circulated them. Whose interests they served. Whether the Ukrainian commercial dispute around Presmash — which has been running since 2008 and involves an already-sanctioned figure who is not Medvedchuk — has any bearing on the timing.

These are answerable questions. The institutions that signed the decree are the same institutions best positioned to answer them. The work that needs doing now is not the assignment of blame to the signers, but the identification of the route by which a coordinated disinformation operation reached their desk. That route is the real vulnerability. Pukish is one symptom of it. There will be others.