Cyber scammers impersonate Presidential Office Head Kyrylo Budanov in fraudulent diplomatic outreach

Scammers are using fake letters from Presidential Office Head Kyrylo Budanov to solicit support from the Canada-Ukraine diaspora. Learn how to spot the fraud.

By: AXL Media

Published: Apr 20, 2026, 8:27 AM EDT

Source: Information for this report was sourced from the Office of the President of Ukraine

Exploitation of Official Presidential Branding

A new wave of cyber fraud has emerged targeting prominent Ukrainian figures and international supporters through the distribution of falsified official letters. The Office of the President’s press service reported on Monday, April 20, 2026, that scammers have begun impersonating Lieutenant General Kyrylo Budanov, who recently assumed the role of Head of the Office of the President. The fraudulent activity appears designed to exploit the transition in leadership to manipulate high-profile stakeholders under the guise of state-authorized strategic initiatives.

Targeting the Ukrainian National Federation of Canada

One primary target of the campaign was Yuri Klufas, the President of the Ukrainian National Federation of Canada. Klufas received a document appearing to be an official request from the Head of the Presidential Office, urging him to mobilize "active media and information support" for the repatriation of Ukrainian citizens. This specific narrative mirrors ongoing government efforts, making the forgery particularly deceptive for those accustomed to receiving high-level communications from Kyiv regarding the diaspora and wartime social policies.

Technical Analysis of the Phishing Mechanism

The Office of the President’s technical team identified that the fraudulent emails originated from a mailbox registered on the Proton.me commercial resource. The address, formatted as [email protected], was designed to mimic the syntax of legitimate government domains while operating outside of the secure state-controlled servers. Despite the visual similarity to official branding, the Presidential Office confirmed that the digital signature accompanying the letter was a complete fabrication and did not correspond to any cryptographic keys used by Kyrylo Budanov.