Operating from a virtual office in Bratislava, the Russian-owned technology firm StormWall has emerged as a central enabler of Kremlin-aligned doxing and disinformation campaigns targeting Ukrainian civilians and their international supporters, according to a cross-border investigation by Slovak and international media outlets. Although the company presents itself as a global cybersecurity provider, investigators have linked its Slovak-registered servers to platforms such as WarTears and ForeignCombatants, which harvest and publish personal data of Ukrainian soldiers, missing persons, and foreign volunteers under false humanitarian pretences. These platforms, which the United States Department of Defense classified in 2023 as components of Russia’s psychological warfare infrastructure, have been used to intimidate families, solicit extortion, and undermine foreign engagement with Ukraine’s defence.
StormWall and its affiliated Russian entities have also provided digital infrastructure for NewsFront, a pro-Kremlin propaganda outlet sanctioned by the European Union, the United States, and Canada. Despite these connections, and the firm’s continued operation from EU territory, no regulatory response from Slovak authorities has been confirmed. The case highlights how legal loopholes and minimal oversight within Slovakia’s corporate registration system have allowed Russian information warfare assets to establish a digital foothold inside the European Union, raising broader questions about the bloc’s resilience to foreign interference and its capacity to enforce existing sanctions.
An investigation conducted by a consortium of media outlets—Investigative Centre of Ján Kuciak (ICJK) in Slovakia, FRONTSTORY.PL in Poland, VSquare, and the International Centre for Counter-Terrorism (ICCT) in The Hague—identified several Russian doxing platforms that publish sensitive personal information about Ukrainian soldiers, their families, and foreign supporters of Ukraine. These platforms encourage harassment campaigns through a method known as doxing, which involves publishing private data to incite online abuse.
Among the targeted victims is Kateryna, whose husband, Oleksii (both names altered for security reasons), voluntarily joined the Ukrainian military in the early days of the Russian invasion. After he went missing in combat, Kateryna began receiving threatening messages in Russian addressed to her and her six-year-old son. According to Kateryna, these threats began shortly after a suspicious Facebook post featuring her husband’s photo appeared and was quickly deleted. She believes their personal information was subsequently disseminated through doxing networks.
The investigators identified two major Russian-operated websites involved in this activity: WarTears and ForeignCombatants. These platforms claim to collect data on Ukrainian veterans and foreign fighters but have been used to intimidate families and supporters. WarTears, launched in May 2022 in Ukrainian, Russian, and English, solicits detailed information under the guise of helping to locate missing persons. Victims have reported that after submitting such data, they were never contacted again, while private photos and personal details began to appear online. The authenticity of the operators behind these sites remains unclear. One domain was initially registered under the name of a Russian national, Oleg Makarov, who is publicly associated with cybersecurity and Russian military-themed initiatives.
Technical support for these platforms is linked to StormWall, a cybersecurity company with registered operations in Bratislava since 2017. Although StormWall presents itself as an international provider of digital protection solutions, the company maintains dual online identities. Its Russian-language website lists Moscow as its headquarters, while the English version lists only Bratislava and omits any Russian affiliations. The firm’s official Slovak address leads to a residential street in the Podunajské Biskupice district, where it shares space with dozens of other foreign entities operating via virtual office registration—a legal but loosely regulated practice in Slovakia.
StormWall and its affiliated entities, such as Storm Networks LLC and Storm Systems, have reportedly provided hosting and DDoS protection services not only for doxing websites but also for Kremlin-aligned propaganda platforms. According to DNS analytics and multiple cyber investigations, the pro-Kremlin disinformation outlet NewsFront—which operates versions in several European languages, including Slovak—has also relied on StormWall’s services. NewsFront and its founder Konstantin Knyrik have been placed under sanctions by the United States, Canada, and the European Union for actions that destabilise Ukraine’s sovereignty.
In 2023, the U.S. Department of Defense identified WarTears and ForeignCombatants as elements of Russia’s psychological warfare infrastructure. The platforms collect and weaponise data to apply pressure on Ukrainian families and deter international volunteers. The site ForeignCombatants, styled to resemble Wikipedia, publishes detailed profiles of individuals from across the world who have expressed support for Ukraine. This includes citizens of Poland, Hungary, the Czech Republic, and Slovakia. Individuals have been listed for actions as minor as delivering humanitarian aid.
Among those featured was Matúš Vallo, the mayor of Bratislava, who stated that the information published about him was already publicly available and that no security breach had occurred. However, in January 2024, his social media accounts experienced a coordinated attack involving tens of thousands of fake followers and foreign-language comments. The origin of the attack remains undetermined.
The ForeignCombatants project has been linked to two prominent pro-Kremlin Telegram channels, Rybar and Vatfor. Rybar is a widely followed Russian-language military analysis channel known for publishing maps and battlefield updates. According to Russian investigative media, Rybar was initially financed by Yevgeny Prigozhin, founder of the Wagner Group and the Internet Research Agency, both known for Russian influence operations. The channel is reportedly associated with former employees of Russia’s Ministry of Defence and has ties to state-aligned information warfare networks.
Ukrainian officials warn that the personal data collected through these channels is not only used for intimidation but also for intelligence purposes. Mykola Balaban, deputy head of Ukraine’s Centre for Strategic Communications (Stratcom), and Maria Pavena, a government specialist on missing persons, both confirm that Russian actors exploit voluntary data submissions to manipulate and extort victims. One woman was reportedly blackmailed for $15,000 under the threat that her relative, a prisoner of war, would be subjected to torture.
The scope of these operations extends beyond Ukraine. International volunteers serving in Ukraine’s armed forces or supporting humanitarian efforts are often specifically targeted. The psychological impact of being doxed, combined with fear for the safety of family members, can have a deterrent effect on foreign support for Ukraine. According to Stratcom, Russian forces have also used mass text messaging to threaten soldiers and their relatives as they approach front-line zones. These automated threats are often delivered through systems that identify the proximity of Ukrainian mobile devices to combat areas.
While the full extent of the Slovak government’s awareness or response remains Unknown, the continued operation of Russian-controlled digital infrastructure from Slovak territory raises concerns about regulatory gaps within the European Union. Firms such as StormWall continue to generate significant revenue while offering services that, according to investigators, enable intimidation campaigns and information warfare that violate human rights and undermine Ukraine’s security.
Source:
Tomáš Madleňák, Karin Kőváry Sólymos (ICJK),
Anastasiia Morozova, Alicja Pawłowska, Anna Gielewska, Daniel Flis (FRONTSTORY),
Tamara Kanuchova (VSquare)
