Ukraine’s security service, the SBU, detained two people who reportedly helped Russian intelligence spread pro-Kremlin propaganda and hack the phones of Ukrainian soldiers.

The two suspects operated so-called bot farms, which involve using special servers and SIM cards to create and manage fake social media accounts.

One bot farm was located in the western city of Zhytomyr in the apartment of an unidentified Ukrainian woman. According to the SBU’s statement, she registered more than 600 virtual mobile numbers, as well as an unspecified number of fake Telegram accounts, and then sold or rented them for cryptocurrency on specialized Russian criminal websites.

Russian intelligence used these accounts and phone numbers to hack the devices of the Ukrainian military by sending them phishing emails, the SBU said. The emails contained malicious files that, once opened, installed spyware on the targeted phones to collect confidential data.

Russia also used these accounts to spread pro-Kremlin narratives allegedly on behalf of ordinary Ukrainian citizens, the SBU said.

Another suspect, a 30-year-old man from the east-central city of Dnipro, registered almost 15,000 fake accounts on various social networks and messengers using SIM cards of Ukrainian mobile operators. He then sold these accounts to Russian intelligence on darknet forums, the SBU said.

If found guilty, both suspects could face up to three years in prison or a fine. The investigation is still ongoing.

Russia has previously used bot farms to spread propaganda and create panic during the war. Those involved in running bot farms usually receive payments in Russian rubles, a prohibited currency in Ukraine.

Earlier in April, the SBU detained two hackers in Kyiv suspected of spreading Russian propaganda through social media accounts impersonating Ukrainian state officials. The same month, a Ukrainian man was sentenced to 15 years in prison for creating and spreading Russian propaganda.

In January, the SBU detained a pro-Russian hacker suspected of launching cyberattacks against Ukrainian state websites and leaking strategic information. If found guilty, he could face up to 12 years in prison.