Seven-Year Attack on Freedom Holding and Timur Turlov Could Cost More Than $20 Mln

At the start of 2026 Kazakhstan’s information space faced another attack on the Freedom Holding business group and its founder Timur Turlov. Monitoring logged 3,200 items of disinformation in less than two months. In 2025 the number of such «stories» exceeded 72,000.

If we treat this case as a cross section of the media market we see the full scale of an organised negativity industry. Kursiv analysed a dataset of «black PR», reviewed information that Freedom Holding Corp. provided for January and part of February 2026 and spoke with experts to understand who creates an «information tornado» in Kazakhstan, how they run it and how much it costs.

What they write about: from «pyramid scheme» claims to absurdity in «junk» Telegram channels

The people who run the attack recycle the same templates against Freedom and Timur Turlov. In mainstream outlets the negative narrative rests on accusations of a «financial pyramid scheme», offshore money transfers and «sanctions evasion». In parallel, they criminalise any deal. They present the purchase of Transtelecom as «the scam of the century». They also amplify themes linked to a criminal case over the spread of false information involving the KazTAG agency.

Telegram «seeding» shows a telling layer of these «black» information campaigns. Kursiv has the full list. Thousands of links in the document lead to a network of Russian channels that initially served kompromat campaigns, for example against Moscow Mayor Sergey Sobyanin. A client simply rents «black» bot farms in bulk. Those farms do not care what they repost as long as they hit link targets and earn money.

After they buy bulk placements in a bot farm, the bungling operators fill the quota with junk «news» that AI generates. Of course, these posts include no comment from Freedom Holding Corp. or Timur Turlov. The plots often come from crude random compilation. This content offers nothing more than a simulacrum, a parody of something that never existed.

This endless stream of tens of thousands of messages gives readers no useful information because it aims to flood search results with negative keywords. That reality suggests that black campaign operators deceive their own clients on a grand scale. They showcase an enormous mass of meaningless «news» wrapped in a negative context. Anyone can ask ChatGPT for a random negative compilation about Freedom Holding Corp. in seconds. Clients then pay astronomical sums for that output.

The scale of the attack and the maths of «black PR»

The numbers that describe the intensity of the campaign against Freedom Holding Corp. and Timur Turlov look unprecedented for Kazakhstan’s media market. Most negative campaigns against individuals in Kazakhstan last weeks and only rarely months. The discrediting process against Freedom Holding Corp. started seven years ago and it continues to intensify.

Freedom Holding told Kursiv that the vast majority of publications sit in the Russian language segment of the internet. Monitoring counted 72,000 items of disinformation in 2025. Telegram accounted for 55,000 of them and media outlets accounted for the remaining 17,000.

May 2025 marked the peak of hysteria around Freedom Holding Corp. and Timur Turlov. Disinformation spiked to 12,000 items and coincided with the KazTAG attack. On average the company faced 250 hostile drops per day. That volume matches the daily output of a fully staffed news agency that runs three shifts. Here, that entire «editorial capacity» focused on generating negativity.

Kursiv has an analytical document that reviews all KazTAG publications over the past three years, about 200,000 items, and it draws a clear conclusion that KazTAG targeted Turlov and his company. For example, KazTAG mentions Timur Turlov about 11 times more often than it mentions businessmen Mikhail Lomtadze, Timur Kulibayev and Bulat Utemuratov.

«KazTAG mentions Freedom about four times more often than Kaspi and Halyk Bank. KazTAG mentions Freedom about 20 to 40 times more often than Bank CenterCredit and ForteBank. At the same time KazTAG does not specialise in banking coverage. We did not find criticism of the banking sector. The info attack on Turlov and Freedom has a targeted nature,» the document says.

How search engines and algorithms work

This volume of publications does not aim to persuade a thoughtful reader. It aims to crush the brand algorithmically in search engines and AI systems.

The technology runs like a production line. Someone posts a fake or manipulative item on an obscure site. Then the network replicates it across dozens of mirror sites and thousands of Telegram channels with single digit follower counts. These «articles» reuse the same talking points, similar headlines and AI generated images that mimic photographs.

«This affects not only search engines but also artificial intelligence,» says Alexey Bendz, a PR specialist and founder of 2B AGENCY. «It creates critical mass. A search engine sees interest in the brand with that pairing and happily pushes these materials to the first pages. 80% of readers look only at the headline and the image. A person reads it and a ‘brick’ stays in their mind. They have heard 20 times already that the company or the person seems bad. Someone else has done the thinking for them.»

Alexander Likhtman, founder and head of the ITCOMMS PR agency, urges readers to separate organic negativity from planned operations:

«Attacks show the same theme that suddenly takes off without a strong primary source. It starts in a tiny public page and then triggers a wave. You need to separate the wheat from the chaff.»

What the attack costs

In 2026 the pressure on Freedom and Timur Turlov continued. Monitoring systems logged 3,191 negative mentions in January and the first ten days of February alone. Telegram channels generated most of them. Clients behind black PR campaigns continue to pour huge budgets into pointless saturation of the information space with negativity.

The market for paid negativity follows clear price lists. Alexey Bendz noted that one placement in a media outlet can start at 1m tenge. A Telegram channel post can start at KZT 500,000. The «shadow» nature of placement can push the price two to three times higher.

«When it comes in anonymously and without official accounting, the price can rise. Beyond the publications themselves, people organise all of this and they draw salaries. This campaign has huge scale and it covers many directions,» Bendz says.

Alexander Likhtman offered his own assessment of operations at this scale:

«Seventy two thousand publications means millions of dollars, not hundreds of thousands. Look for who benefits.»

Even a conservative estimate puts the cost of a public attack on Freedom Holding Corp. and Timur Turlov at $20 mln to $50 mln over seven years. That equals almost KZT 10 bln to 25 bln. The campaign peak in 2025 accounts for about $11 mln to $12 mln per year, around 6bn tenge, which equals up to $1 mln per month or KZT 594 mln. In Kazakhstan’s media market those costs resemble not one off PR actions but a full long term communications programme of a major corporation. Even mid sized businesses cannot access sums like these.

The estimate uses the 72,000 items of disinformation recorded in 2025, 55,000 on Telegram and 17,000 on websites. Reputation SEO often allocates budgets as follows: 2% to expensive «anchor» posts, 8% to mid tier platforms and 90% to mass replication. At average market prices, placements alone cost about $8 mln. Add 40 to 50% for operations: writing texts, managing bot networks, hosting and proxies. That approach produces the same $11 mln to $12 mln per year.

The final $20m to $50m range over seven years reflects the campaign’s trajectory. It started small and accelerated towards 2026. The calculation relies on confirmed volumes and assumed tariffs for a wide range of «black PR» services that market experts described to Kursiv. This story does not concern Kazakhstan alone. These expensive campaigns can become global because they target reputations across many languages and for large international audiences.

«More than $20 mln over seven years? I think the figure looks higher because it does not include endless attempts to hack systems, personal employee accounts, efforts to discredit their contacts and many other destructive actions by the aggressors,» says Alexander Kamendrovsky, a lawyer at Freedom Finance JSC.

With that money someone could build several shopping centres, build three new schools or buy a premium private jet or a yacht. Instead someone spent it to damage Freedom Holding Corp. and Timur Turlov personally. Who in Kazakhstan has that kind of money?

Who may stand behind the attack

Experts broadly link the cause to Freedom Holding Corp.’s intense business expansion.

«Turlov stepped on the toes of many people who had everything going well. He came in, competed through product and aggressive marketing and took market share,» Alexey Bendz says. «You can compare it with the moment when Freedom started buying a bank and moving into telecoms, media and fintech. You can see where it took what. Many sides play a systemic game against Freedom. Any management mistake will become an opportunity to attack Turlov and they will not spare money for it.»

Alexander Likhtman thinks the clients may include those whom Timur Turlov has crossed or may cross.

Political analyst Marat Shibutov points to additional vulnerabilities that make the businessman a convenient target.

«First, he became rich too fast. Second, few people knew his biography for a long time. People did not watch him grow, so they believe any invention about him. A new player arrived from Russia and bought a lot in our small market. Many people dislike that,» Shibutov said. He added: «I have met him. On a personal level he seems like a decent person, at least not confrontational.»

Lawyers at Freedom Finance JSC argue that competitors organised the long running attack because they still see Timur Turlov as a threat to their market dominance. In their view, those competitors tried to resist Freedom Finance’s evolution and ran a discrediting campaign with a single red thread: an attack on reputation.

Mayra Salykova, chair of the board at Media System Group, told Kursiv that when a company records an attack over seven years and links it to one subject with evidence, it usually has a serious analytical base. She said technology, including AI tools, can help estimate the cost of such a campaign.

«But attributing all negativity to one ill wisher carries strategic risk. Reputation work needs mechanics, not hypotheses. Who shapes the agenda, how they do it, through which channels and for what purpose. If the attack has continued since 2019, two scenarios exist: either the company has accumulated systemic unanswered questions or someone applies targeted pressure to weaken it, push it out or force specific market decisions. If a player knows who attacks them, the ‘why’ question becomes redundant,» she said.

Salykova added that reputation does not function as emotion. It functions as a system. It requires systematic work.

Blackmail or a war of attrition

Classic anti crisis PR uses the notion of a «negative block» when a victim of information racketeering pays network administrators to stop publications. In this case, experts do not see signs of simple extortion.

«If this involves blackmail then sooner or later someone needs a call to action, for example ‘pay the ransom and we stop’ or ‘hand over the asset’. If that never happened then it feels strange to call it blackmail. That means Turlov’s reputation interferes with someone’s business interests,» Alexander Likhtman says.

Alexey Bendz also views the campaign as an attempt to influence reputation.

«PR works here as a tool in competitive struggle. They play dirty. They aim to destroy reputation so clients and partners turn away. Dozens of people work nonstop with one task: how do we destroy the reputation today. This story will hardly end quickly.»

The attack has continued for seven years

Timur Turlov has said before that information pressure on him and the holding has not stopped since 2019. Only players with enormous staying power can sustain an attack of this intensity for seven years.

«I always asked myself who can do this month after month since 2019,» Turlov said. «Over this time, almost all heads of state bodies have changed. We changed the president since then. All security structures changed too and they changed in a big way. Yet someone has budgets and entire departments for this.»

Turlov says he cannot respond symmetrically in information wars.

«If you answer violence with violence every time the environment will only degrade. That will not create the society or the country we want to live in. So the only thing we try to do now, at least in the most standout cases, involves legal methods,» he said.

Against the backdrop of a seven year information attack, Timur Turlov communicates openly. He speaks on platforms such as the Financial Times and Digital Bridge, ITS Ideas, the Congress of Financiers of Kazakhstan and many others. He has also given dozens of YouTube interviews. He meets journalists regularly. When audiences see a real person who discusses plans openly and answers allegations directly, anonymous Telegram channels struggle to impose their negativity.

Freedom Holding Corp.’s ecosystem products have become part of daily life for millions of Kazakhstanis. People will not believe that the business equals an «empty shell» when their daily user experience proves the opposite.

Marat Shibutov believes it will prove extremely difficult to identify the real clients because of a long chain of intermediaries. He sees courts as the main instrument:

«We have precedents. You can do all of this through court proceedings. But you need to prove malicious intent and that does not always work.»

In November 2025 Kazakhstan’s State Counsellor Erlan Qarin said the country will not encourage «info racketeering» through concessions, awards or contracts. In his column he referred to bloggers and pseudo activists whose activity has effectively turned into an extortion tool. He said the practice took shape in previous years amid a «policy of appeasement» towards destructive elements. That approach produced a whole group of people who use information pressure as a source of income.

Qarin stressed the «info racketeering» scheme’s simplicity: inflate resonance around selected topics, then offer to delete publications for a fee. He called it neither journalism nor civic activism but a semi criminal model based on blackmail. The authorities, he said, plan to promote a new digital ethic, a culture of responsible information sharing, because the flow of shallow manipulative content lowers the quality of public debate and distorts perceptions of issues that truly matter.

Courts as a legal tool

KazTAG published 259 negative items about Freedom Holding Corp. and Timur Turlov across its platforms, including its website, Telegram and YouTube. Turlov has commented on these publications before and pointed to their lack of factual accuracy.

The situation around Freedom Holding raises questions about the ethics of competition in Kazakhstan. Company lawyers have already described what happened as a «planned attack». Telegram saw the attack intensify at the end of 2025.

Earlier, Kursiv also highlighted that public harassment moved from traditional media into social networks and Telegram as far back as 2021. That shift confirms a long term trend: information wars change platforms.