Executive summary
Data posted to a darknet forum by an account named okenit_hackers in October 2025 reveals that Russian actors have potentially upgraded their disinformation methods through the automated creation and management of fake personae.The files leaked contained a specific program set, written in Python, that is named “Lemmings” (Лемминги). The program allows an organization or individual to generate and manage personae, as well as create online presences through account creation, online payment management, phone number and email acquisition.
The program was created in 2020 per the metadata from the leak and was found to be actively tested in 2022 as proof of concept. The organization tasked with its creation is Okenit, a company located in St. Petersburg, Russia. Interestingly enough, Okenit is about eleven miles from the Internet Research Agency (SDA) that ran the troll farm for Russia’s Prighozin active measures campaigns. Okenit markets itself to the military for AI, information-security systems, critical-infrastructure, and OSINT services which are backed by licenses for state-secret, cryptographic, and military-equipment work.
Lemmings appears to function as the identity and access layer within a larger ecosystem involving other components, including SOI (concealment and routed access) and SOS (tasking and collection management), which enable the campaigns to be obfuscated enough to bypass the security of the targeted social media sites. The whole system combines synthetic biographical data, generated avatars, rented telephone numbers, SMS verification, email accounts, proxies, CAPTCHA solving, and browser automation to manage as many accounts as the compute behind it all allows.
This program is potentially the next generation of “troll farming” for active measures campaigns after smaller units tied to state organs like the SVR and GRU were exposed and sanctioned by the USA. Using this program and the infrastructure it builds, a few operators could fairly easily carry out large scale campaigns online and spin up new ones when originals are burned.
Given the nature of misinformation, disinformation, and active measures still prosecuted today as doctrine for Russia, this program and its likely successors could be part of a new standard in operations cadence. In today’s AI-enhanced world, bots created and managed by a program like Lemmings could rapidly generate or augment large volumes of content, effectively flooding the zone of online discourse and creating chaos, as is the goal of Russia’s active measures campaigns.
The Okenit leak
On October 9th 2025, an account on darkforums created the single post above that describes how they hacked a server that allegedly belonged to the SVR (Служба внешней разведки Российской Федерации), Russia’s foreign intelligence service. What they in fact hacked was Okenit, which is connected to the Russian Ministry of Defense, the FSB, and other organs of state security, but not necessarily directly tied to the SVR like the post claimed.
The evidence from the leak supports a provenance assessment that centers on an internal development environment rather than a collection assembled solely from public repositories. The python code shows an internal GitLab infrastructure using the name schemes of filigree and Altar, and includes the path gitlab.lan/filigree/lemmings. The presence of these internal-only paths and project names is consistent with access to an internal working software-development environment.
The now public GitHub repositories from the dump appear to have been used as a synchronized or staged external mirror for selected code, which suggests that at least part of the public material was downstream of the internal GitLab workflow rather than its original source. All of the data then shows that this program was internally developed by Okenit for unknown Russian MoD clients as we have no documents showing who ordered its creation.
The network indicators recovered from the Lemmings material further support attribution of the development environment to Okenit. The leaked configuration and infrastructure references expose several internal RFC1918 networks. These addresses are private and therefore cannot independently identify an external operator. However, when considered alongside the gitlab.lan/filigree/lemmings repository paths and the lemmings-okenit package naming – “okenit developers” – and other authorship metadata, it does provide a coherent view of an Okenit-controlled development network.
Email metadata from the leak provides one of the most direct attribution points to Okenit. The Lemmings package metadata identifies the authors as “okenit developers info@okenit[.]ru”, embedding Okenit’s legitimate corporate email address directly into the project definition. The same address, info@okenit[.]ru, is independently associated with Okenit’s public corporate presence online, which makes it materially stronger than the numerous online email services (Mail.ru, Gmail, Proton, Yandex) found elsewhere in the codebase, many of which are clearly test or synthetic-account artifacts.
The Lemmings Platform: Bot Farm Management At Scale
Lemmings is an Okenit-linked project described internally as a “Botfarm project for filigree” and authored by “okenit developers.” The code references an internal Filigree repository, while the Russian README describes the system in terms that translate approximately to an “account farm.” That label is useful but an incomplete picture. Lemmings is better characterized as a modular synthetic-identity provisioning and authenticated-access framework. It is designed to manufacture, verify, maintain, and hand off online accounts to others to run their content creation activities. Its functionality extends beyond automated posting or simple bot operation by managing the underlying identity lifecycle of accounts. This includes account creation, verification processes, session persistence, and credential handling for later use by operators.
Lemmings implements a staged account-farming workflow that begins by generating or importing synthetic identity data, then uses that identity package to register accounts across target services. The framework coordinates verification steps, stores credentials and session material, and tracks account state, so successfully created identities can be maintained rather than discarded after registration.
Once an account is active, Lemmings preserves authenticated access through cookies, tokens, or other session artifacts. It then monitors whether the accounts remain usable, and supports subsequent handoff for exploitation by operators or possibly other programs created to maintain or generate content. This type of system has potential for augmentation by AI programs that could generate content as well as potentially handle responses through artificial intelligence to augment Lemmings in a future instance.
Lemmings Account Creation and Management Lifecycle
Lemmings manages the full lifecycle of synthetic online accounts. It combines identity data, verification services, CAPTCHA handling, and proxies. It then uses platform-specific browser or API workflows to manage and maintain accounts across different services.
Lemmings produces reusable authenticated identities, not just newly created accounts. It preserves credentials, cookies, tokens, and session data so accounts can be maintained and handed off for later use. The lmgs_mock python testing framework indicates the system was built and tested as a production-grade account provisioning platform for later operations at scale to be deployed anywhere the MoD desired.
The Manufacturing Synthetic Identities Process
Lemmings builds synthetic identities as consistent personas rather than random collections of profile data. It uses Faker-generated names and aligns sex, age, and date of birth with avatar selection including AVAGEN-sourced photographs matched by age and gender. The system also tracks avatar inventory with controls such as is_used=True which supports alternate image sources and reduces obvious photograph reuse across accounts.
This process improves personae credibility and platform survivability by limiting duplicate identities and otherwise reducing signals that could trigger automated or manual review. It also produces more coherent profiles that can support longer-term or professionally managed cover identities.
Phone and Email Identity-support infrastructure
Telephone and SMS infrastructure
Lemmings centralizes telephone and SMS verification as part of the account-provisioning process. The framework can obtain rented phone numbers, select countries and mobile operators, retrieve verification codes, and reject unusable numbers. It can also handle bans, replace failed numbers, and switch between providers when one service is unavailable. This brokered approach automates phone verification away from individuals, allowing the same SMS infrastructure to support account creation across multiple services while improving reliability and reducing dependence on any single provider or individual to manage the process.
Email infrastructure Management
Lemmings uses multiple email providers as part of its account-provisioning infrastructure. These mailboxes support initial registration and verification, provide recovery channels if accounts are challenged or locked, and preserve persistent access to the email identity associated with each persona. By maintaining mailbox access across different providers, Lemmings can keep a synthetic identity consistent across multiple platforms at scale.
Proxying, geography, and concealment
Lemmings uses the SOI anon_app (concealment-of-interest system) component to manage network anonymity, geographic presentation, and proxy selection across the account workflows. The framework supports multiple HTTP(S), SOCKS4, and SOCKS5 proxies and includes chained and authenticated proxies for further obfuscation. This allows for switching proxy settings in both Selenium browser sessions and direct requests sessions.
It also uses IP geolocation and attempts to keep the proxy location consistent with the persona’s claimed geography and assigned telephone number, with platform-specific geographic profiles applied where needed. This improves plausibility and reduces obvious location mismatch problems during registration and authentication. However, the design is not perfect because provider outages, rejected resources, or failover to replacement proxies can break that geographic consistency of the accounts. Thus, it is not a foolproof system yet.
Anti-detection and account survivability
Lemmings incorporates several layers of anti-abuse handling designed to keep synthetic accounts usable over time. At the browser level it varies user agents, browser dimensions, cadence timing, and character-by-character input while using persistent profiles. Meanwhile, Selenium Wire, cookie seeding, and website pre-visiting with removal of obvious Selenium artifacts are used to reduce automation signals and the potential for detection.
Lemmings handles CAPTCHAs and other platform challenges as part of the normal account workflow. It can also recover from bans, blocked proxies, rejected phone numbers, and login failures. It handles mailbox errors and password problems by retrying with replacement resources. These capabilities indicate that Lemmings was built to keep accounts working over time, not just create them to manage campaigns with minimal human interaction.
Social Media Account Creation and Management
Telegram provides the clearest evidence that Lemmings was designed to create accounts for later authenticated collections. The framework uses Telethon, persistent StringSession data, and API credentials for scraping groups and bots, while additional preparation routines appear to hand those accounts into SOI for downstream use.
LinkedIn shows a different but related capability; Lemmings can build foreign-facing professional personas with synthetic occupations and employer identities. It creates complete email and telephone verifications, handles Arkose challenges, and preserves cookies. This applies a geographic cover that excludes Russia.
Together, these modules show that Lemmings was not limited to account creation, but could provision durable identities for collection, outreach, and social engineering as well as other operator-driven activity.
Lemmings, SOI, and SOS
The working ecosystem model places Lemmings, SOI (proxy, anonymity, concealment, and authenticated-collection subsystems) and SOS (manages collection tasks, resources, and outputs) in complementary roles. Lemmings creates and maintains synthetic personas at scale and automates the process as a whole. SOI appears to provide the concealment and collection layer. SOS sits above or alongside that workflow as a tasking, information-management, or orchestration component. Taken together, this modular system allows for larger workflows to manage whole campaigns with very few individuals necessary to manage the program. The evidence supports this functional relationship, but the exact production sequencing and direction of control between the three systems remain under investigation.
Known Testing Of Lemmings
The Lemmings python files contain identifiers that map directly to real accounts still visible on public platforms today, providing strong evidence that the framework was tested against live services rather than only internally at Okenit. Online searches produced basic pages on the social media services matching those in the python code for accounts that were created within the timeline of Lemmings’ creation and potential testing. The accounts are minimal and have zero to single posts that are equivalent to an introduction of the persona; the accounts do not show signs of activity since creation.
Three VK accounts correspond to identities preserved in the code and test data:
- Michael Schmidt at VK user ID 599946564
- Jennifer Watkins at 661627902
- Amanda Frazier at 661630153
Jennifer Watkins and Amanda Frazier match names and account identifiers embedded in the Lemmings material, while the Michael Schmidt account corresponds to a VK identifier used in an active authentication test.
Two Reddit accounts, CompetitiveRope5669 and Academic-Wolverine35, also appear in the Lemmings mock OAuth file and profile-image workflow. While they remain accessible online with a verified email, the accounts have almost no public activity. The Jennifer Watkins account was created on August 19, 2021, placing its creation inside the same period in which Lemmings was undergoing active development and account-integration testing.
The timing of these accounts is consistent with the broader development history found in the leak. Lemmings-related test artifacts date back to 2020. These include X and Facebook session material, with additional account, email, and authentication testing continuing through 2021 and 2022. These accounts also had continued package maintenance into 2024 before the public exposure of the code in 2025.
The existence of live VK and Reddit accounts matching names in the code of the framework supports the assessment that Lemmings was tested against real online services during development. These accounts demonstrate live account creation, authentication, session handling, and persistence testing of the Lemmings program. However, their existence alone does not prove that they were later used in operational influence, collection, or intelligence activities after the creation of the overall program by Okenit.
Lemmings Functions Compared with known Russian persona and influence infrastructure
At the architectural level, Lemmings overlaps with several documented Russian influence systems in the way it industrializes the creation and maintenance of credible foreign-facing identities. Project Lakhta and the IRA used large numbers of personas, proxy servers, and social-media accounts to carry out active measures campaigns. Later IRA-linked networks added AI-generated profile images and cross-platform identitiesl to enhance the speed and the notion of organic identities used in the program. Doppelganger similarly relied on fake Western personas, controlled infrastructure, impersonated media properties, and coordinated social-media distribution. The RT-linked bot-farm disrupted by U.S. authorities in 2024 went further toward software-driven persona production, using an integrated system to create fictitious identities and operate social-media accounts at scale.
Lemmings fits within this broader architectural lineage but appears more specialized at the identity and access layer. Its code supports a more holistic approach to creation and management of the persona process. These functions resemble the account-production requirements visible across earlier Russian operations, but Lemmings consolidates them into a reusable software framework rather than relying primarily on manually managed personas.
The comparison is weaker after the account-creation stage. Storm-1516, Doppelganger, Matryoshka, and RT-linked networks also include systems for producing content, seeding narratives, amplifying material, using influencers, and measuring audience reach. Lemmings shows strong evidence for building and maintaining personas but as it was never deployed that we can ascertain, it is difficult to conclude more. The main overlap is therefore the production of durable, geographically credible, and replaceable online identities which would make all of the other campaigns’ programs more easily managed were they to be using a system like Lemmings. That similarity makes Lemmings relevant as a possible enabling infrastructure, but it does not tie the platform to any specific Russian influence network.
Final Assessment
Lemmings demonstrates that Okenit developed a program for industrialized infrastructure to manufacture and maintain synthetic identities and provide persistent authenticated access to online platforms. This functionality seems to be the aegis for creation of the program given the other campaigns by Russia that have been detected and dissected. Previously, creation and maintenance of all the personae and management was, for the most part, human intensive. If a program or infrastructure like Lemmings were available, it would make their programs run more smoothly with fewer operators needed. When combined with SOI and SOS, the architecture could support a broader covert dissemination environment and could provide important infrastructure for influence, social engineering, or persona-enabled intelligence operations.
Future attempts at trying to discern whether or not this system has been put into production by Russia would be useful in creating hunt packages to ferret out these campaigns at scale and diffuse their effectiveness. Perhaps with AI, future hunters will be able to find the telltale signs and hone in on these persona created and managed by Lemmings at the same speed and scale as the program itself.
