Leaked Okenit Tool Could Automate Russian Ministry Persona Operations

A leaked cache posted to a darknet forum on 9 October 2025 appears to show “Lemmings”, a Python-based system developed by St Petersburg company Okenit to create and manage synthetic online identities. DomainTools says the material contains internal GitLab paths, Okenit package metadata and the company’s corporate email address, supporting the assessment that the project was developed within an Okenit-controlled environment. The leak’s metadata dates the software to 2020, with testing evident from 2021 and 2022.

The researchers could not establish which Russian Ministry of Defence client commissioned it, or confirm that it was deployed operationally.

Lemmings is described as an identity and access platform rather than simply a posting bot. It generates consistent personas using synthetic biographical details and age- and gender-matched photographs, then automates account registration, SMS and email verification, CAPTCHA handling, proxy selection and browser workflows. It stores passwords, cookies, tokens and other session data so accounts can remain active and be handed to operators.

Modules for Telegram, LinkedIn, VK and Reddit indicate testing against live services; several accounts matched identifiers found in the leaked code, although their existence does not prove involvement in influence, intelligence or social-engineering operations. The system appears designed to work alongside related Okenit components called SOI and SOS for concealment, collection and task management.

DomainTools warns that this could reduce the number of people needed to run large persona-based campaigns, but says the evidence currently supports potential capability rather than confirmed production use or attribution to a specific influence operation.