In our previous article, we exposed Yuriy Gudilin, a Russian FSB agent and ‘electrician’ who has been secretly shaping Moldova’s political landscape. Now, we delve deeper into Gudilin’s connections to key Moldovan politicians, revealing a complex web of influence that threatens the country’s democratic processes. As Moldova approaches its September elections, we examine the extent of Russia’s interference and the individuals involved.

Figure 1: Gudilin’s expanding circuits

Plugged In: Gudilin’s Moldovan Network

Gudilin frequently appears with politicians from across Moldova, both those openly supportive of the Kremlin and those hiding their true allegiance behind a banner of independence. Gudilin is known to maintain ties with various Moldovan political figures including Party of Socialists MPs Bogdat Tireda and Adrian Albu as well as former President Dodon.
A key connection we have uncovered is Gudilin’s relationship with Ion Ceban, the Mayor of Chisinau and a member of Alternativa. FSB Officer Gudilin brokered an agreement for Roscongress subsidiary RK-Invest to work on projects in Chisinau, a fact that has received little attention. RK-Invest is a subsidiary of Roscongress, widely seen as a Russian soft power tool used to exert influence and channel funding in regions of interest to Russian intelligence Services. According to reporting from 2022, Roscongress Foundation Deputy Director Colonel Grigory Velikikh, a former FSB officer and member of the Operational Information Department, was responsible for supervising Ceban. Gudilin played a crucial role in facilitating this access.

Gudilin is also linked to Elena Panus, a close associate of Ceban. Gudilin advised Panus on Russian investment in real estate in Chisinau. Panus openly expresses her pro-Russian and eurosceptic views as Vice President of ‘Our Party.’ The party’s founder and leader, Renato Usatii, is also a eurosceptic who has claimed that the EU is disintegrating and “wants to drown the country in debts so that it has to volunteer to reunite with its better-off neighbor Romania.”

Ceban’s frequent travels to Russia and his pro-Moscow stance have raised eyebrows, particularly given Alternativa’s purported pro-European stance. Ceban’s ongoing contact with Gudilin, an FSB agent with connections to various Moldovan politicians, raises concerns about Alternativa’s true loyalties and whether it is being used as a Kremlin Trojan Horse to attract pro-European voters.

Photo: Gudilin (top), Tsirdea & Dodon (bottom)

Alternativa: The Kremlin’s Trojan Horse

Other prominent Alternativa members also have connections to Moscow. Mark Tkaciuk, a co-founder of Alternativa and leader of the ‘Civic Congress’ party, has faced criticism for advocating greater autonomy for the Gagauz region, a Moldovan territory with a pro-Russian majority. Tkaciuk has also maintained friendly ties with Moscow, including a personal relationship with Vasily Kashirin, an individual tied to the Kremlin.

Kashirin is a Deputy Director at the Russian Institute for Strategic Services, a Kremlin-linked agency that was formerly part of the SVR. According to the Warsaw Institute, the agency continues to operate as an intelligence entity involved in hybrid operations. Kashirin has been involved with Moldova throughout the last decade, making provocative claims about Russian citizens in Transnistria facing a transport, logistics, and economic blockade, as well as alleging cooperation between Kiev and Chisinau. In 2014, Kashirin was detained at Chisinau airport by border police and denied entry to Moldova for his subversive activities.

The ties between Russian operatives and Moldovan politicians extend beyond Alternativa. In June 2025, several pro-Russian Moldovan politicians, many with ties to Gudilin, attended the St Petersburg International Economic Forum (SPIEF).

SPIEF attendees included:
• Igor Dodon (formerly associated with the Socialist Party)
• Marina Tauber (Victory party)
• Regina Apostolova (Victory party)
• Irina Vlah (Heart of Moldova party)
• Vasile Tarlev (Future of Moldova party)
• Diana Caraman (Communist party)
• Alexei Lungu (Chance party)
• Tatiana Cociu (Mayor of the city of Orhei).

Ilan Shor, a sanctioned oligarch and political meddler, was also among the attendees. Shor, convicted of fraud and money laundering, is subject to US sanctions for undermining Moldova’s democratic processes. His Shor party was banned in 2022. Despite this, Shor backed the Victory Bloc ahead of the upcoming elections, which has recently landed itself with election bans. His continued involvement has raised concerns among some pro-Russia politicians, who question his value to their cause given his dwindling influence over the Moldovan electorate.

Who funded SPIEF? Roscongress of course. The SPIEF provided a platform for pro-Russian Moldovan politicians to connect with their Russian counterparts and potentially meet with FSB handlers, such as Gudilin. This highlights the FSB’s pervasive presence in Moldovan politics and their involvement in business deals.

A Web of Deceit: Russia’s Influence in Moldova

Yuriy Gudilin’s activities and ties to Moldovan politicians expose a sophisticated Russian influence operation aimed at shaping the country’s politics. Gudilin is an example of how FSB operatives facilitate business deals in Moldova with politicians who claim to be independent of Kremlin influence, while maintaining links to the pro-Russian camp. There is a clear connection between pro-Russian figures like Dodon, Gudilin, and Ceban, with Ilan Shor’s influence looming large over them all.

As Moldova approaches its September elections, the implications of Russia’s ongoing interference are clear. The potential coalition between pro-Russian parties, facilitated by figures like Gudilin and Shor, poses a significant threat to Moldova’s democratic processes. In our final article in this series, we will return to SPIEF and examine the potential consequences of a pro-Russian government in Moldova and the role of key players like Ilan Shor and Yuriy Gudilin in shaping the country’s future.

In our previous article, we examined the Kremlin’s efforts to undermine Moldova’s pro-European trajectory, highlighting the influence of Ilan Shor and his allies involvement during the October 2024 presidential elections and the concurrent referendum on EU integration. This article continues our investigation, focusing on Yuriy Gudilin, a Russian FSB officer and political technologist, and Ion Ceban, a Moldovan politician with ties to Shor, as we explore their roles in shaping the Alternativa Bloc, a political alliance that is rebranding itself as a pro-European force despite its Kremlin-backed roots.

Figure 1: Gudilin’s circuits, new reveals coming soon.

Moscow’s Man in Chisinau: The Story of Yuriy Gudilin

Yuriy Gudilin may not be a household name, but his influence in Moldovan politics is significant. Born in Lviv, Ukraine, Gudilin is a Moscow resident who worked as a power grid engineer for MRSK Center, a Russian power grid company, in 2018-2019.

Gudilin’s activities, however, reveal a more complex picture. He has frequently travelled between Moscow and Chisinau around election periods, and is an active FSB officer and political technologist.

In 2020, Gudilin’s involvement in Moldovan politics became public when he was identified as part of a team of Russian consultants advising Socialist Party leader and then-President Igor Dodon during the presidential elections. A joint project released at the time by investigative journalism organizations RISE Moldova and the Dossier Center includes photographs of Gudilin and his Russian colleagues meeting with multiple high-ranking Socialist Party (PSRM) members. These meetings took place at the party’s headquarters and at other locations in Chisinau, including the presidential administration’s office.

As Gudilin’s activities became more public, it became clear that his influence extended far beyond his role as a consultant, and that he was a key player in Russia’s efforts to shape Moldova’s political landscape.

Short Circuiting Democracy

In 2022, the U.S. Treasury Department imposed sanctions on Gudilin and two other Russian nationals, Olga Grak and Leonid Gonin, for their attempts to influence the outcomes of the presidential elections in 2020 and the parliamentary elections in 2021.

According to a statement released by the Treasury, when Gudilin and Grak met with the Socialist Party politicians in 2020, they pressured them to follow their guidance, promising to encourage the Kremlin to favorably consider future requests for assistance from the Moldovan government. Gudilin also orchestrated the illicit transfer of funds from Russia to support Dodon’s campaign, using the cryptocurrency Tether. According to the Moldovan security service, he was recruiting new members for his espionage and influence networks, using cryptocurrency as payment. Gudilin is also known to have worked with the Kremlin’s infamous Internet Research Agency on a plan to spread propaganda online.

Gudilin’s involvement in Moldovan politics predates his 2020 media exposure. In 2019, Igor Dodon inadvertently revealed Gudilin’s presence at a PSRM headquarters celebration for Ion Ceban’s mayoral win, taking a video on his phone that showed Gudilin among the known Russian political consultants present at the gathering.

Gudilin remains active in Moldovan politics, reportedly continuing to work on behalf of the FSB in anticipation of the 2025 parliamentary election. In our next article we will look further into just how far the Kremlin electrician’s wirings have spread.

The Power Behind the Alternativa Bloc

Ion Ceban, the current Chisinau mayor and former Dodon spokesman, has previously been known for his left-wing, pro-Russia, and anti-EU views. In 2014, he participated in a Brussels protest against the EU Association Agreement and backed an illegally held referendum in Gagauzia, where the majority voted against closer EU ties. However, Ceban appears to have experienced a dramatic and unlikely shift in ideology, having since founded the center-left, pro-European National Alternative Movement (MAN) in December 2021.

Moldovans are right to be skeptical of Ceban’s rebranding. According to the US Treasury, Gudilin and his team, having failed to sway the 2020 and 2021 elections, recognized the declining support for overtly pro-Russia politicians. They adapted their strategy, offering to help Ceban establish the National Alternative Movement party as a more subtle means of advancing Moscow’s interests.

The Alternativa Bloc, a new political alliance, was announced in January 2025, comprising Ceban’s National Alternative Movement, the Party of Development and Consolidation of Moldova (PDCM), the Common Action Party – Civil Congress (PAC-CC), and former presidential candidate Alexandr Stoianoglo. This alliance has been gaining popularity among Moldovan voters.

While the Alternativa Bloc presents itself as a moderate, pro-European coalition, others have started to correctly recognize it as ‘the Kremlin’s alternative’.

The Investigation Continues

We have uncovered a complex network of connections between the Alternativa Bloc, Yuriy Gudilin, and Ion Ceban, further revealing ongoing efforts to influence Moldova’s political trajectory. In our next article, we will examine Ceban’s ties to Moscow and investigate the Russian connections of other key Alternativa Bloc members, including their dealings with Gudilin.

After months of intense research and investigation, we at nightingale are ready to shed light on the Kremlin’s meddling in Moldova’s recent elections. Our team has been working behind the scenes to uncover the truth about Russian influence in the region, and we’re now ready to share our findings. We’ve discovered that Ilan Shor, a fugitive oligarch with a history of manipulating Moldovan politics, is backing parties that present themselves as pro-EU but are, in fact, serving Russian interests. One such party is the Alternativa Bloc, which has been misleading Western-leaning Moldovans. In this series, we’ll expose the tactics being used to undermine Moldova’s pro-European trajectory and reveal the truth about the Kremlin’s influence in the region.

Moldova: The Prize in a Global Game

Often labelled the least visited country in Europe, it can be easy to overlook the small nation of Moldova, nestled between Ukraine and Romania in the east of the continent.

Since the full-scale invasion of Ukraine in 2022, many have wondered whether Moldova would be next in Moscow’s bit to regain control of the former Soviet republics. There have been concerns that Russian forces might attempt to join up with the roughly 1500 Russian soldiers stationed in Moldova’s breakaway region of Transnistria, thus simultaneously creating a new front against Ukraine and derailing Moldova from its pro-Western path.

Fortunately, this situation has not yet arisen, but the Kremlin is instead trying to secure Moldova’s alignment with Russia by waging a battle for influence in the political sphere.

Election Close Calls

On October 20th 2024, elections were held in Moldova to decide whether the country’s pro-European Union (EU) and reformist president Maia Sandy would remain in power for a second term. A referendum on whether to amend the nation’s constitution and make EU accession a constitutional goal took place at the same time. These two events were very significant because their outcomes would effectively determine whether Moldova would continue on its course towards the EU or veer away towards Russia.

Despite expectations of a landslide vote in favor of integration into the EU, the referendum only narrowly passed; and while Sandu won the presidential vote, her victory was not convincing enough to avoid a runoff, and she only defeated Russia-friendly opponent Aleksandr Stoianoglo in the second round of the presidential elections on November 3rd 2024.

Kremlin’s meddling Exposed

The close results of both votes raised questions about the factors at play. While the government’s performance was a feature, the close results were largely due to a sophisticated interference campaign orchestrated by the Russian State. The Russian State used a network of operatives to buy votes, transferring large sums of money to Moldovan citizens’ bank accounts. Moldova’s chief of police revealed a network aimed at paying citizens to vote against EU integration, allegedly funded by the Kremlin. He said that, in September 2024 alone, over $15 million in Russian funds had been transferred to more than 130,000 Moldovan citizens’ personal bank accounts.

Ilan Shor, a fugitive Moldovan-Israeli oligarch with a history of financial crimes, is currently residing in Russia and is believed to be behind the vote-buying scheme through his organization Evrazia. Investigators have found that Shor used a complex network of banks to launder the funds. These were then distributed through Telegram to recruit and pay local activists and officials to promote a pro-Russian agenda. Shor is wanted in Moldova for his role in a massive bank fraud that drained the country’s financial system of over $1 billion, leading to a 15-year prison sentence in absentia.

The Shor Effect

While Shor’s own political party was declared unconstitutional and banned in 2023, he remains influential in pro-Russian opposition circles. Indeed, a report by Moldova’s Security and Intelligence Service pinpointed him as the main actor in the criminal network that Russia used to implement its interference plan. We know that spreading disinformation is a key part of Moscow’s meddling strategy, and it is thought that Shor funded more than 40 websites, as well as social media advertisements, which undermined Moldova’s sense of EU integration and attacked President Sandu. While the advertisements were repeatedly reported and blocked on Meta, Evrazia used a Telegram chatbot called STOP EU/СТОП ЕС to recruit 20,000 users to vote against making EU accession part of Moldova’s constitution. These people were paid sums ranging from $50 to $2,500 per month for posting anti-EU material and comments. According to President Sandu, tens of millions of dollars were spent by Russia and its local allies, and the scale of information manipulated was unprecedented.

In the real world, Shor allegedly paid vandals to target official buildings in Chisinau, such as TeleRadio Moldova, the Ministry of Labor, the Government Building and the Central Election Commission. The arrested suspects were part of a larger group that had received training in Moscow on how to carry out coordinated acts of vandalism and violent protests, highlighting the extent to which Russia is willing to support extremist activities in Moldova.

The Kremlin’s influence operations also targeted Moldova’s clergy, with around 300 priests from the Moldovan Orthodox Church receiving ‘pilgrimages’ to Russia organized and paid for by Shor. The trips, ostensibly aimed at strengthening clergy relations, were actually used to bribe the priests. During their visits, they were wined and dines, and many received a payment card with the promise of 1000 euros per month for things like church repairs. In return, they were expected to exert political influence, and given that Moldova is a highly religious country, they were well placed to do so.

Diaspora Delivers for Moldovan Democracy

Something that Moscow had likely underestimated in planning this operation was the power of the Moldovan diaspora’s vote, although, false bomb alerts were called in to a number of Moldovan diplomatic missions in Europe in an effort to limit turnout. Approximately 1 million Moldovans live abroad (compared to the country’s population of 2.5 million), mainly in EU countries. Their votes had a profound impact on both the presidential elections and the referendum. The result of the referendum was actually negative within Moldova itself, with 54% voting against and 46% supporting the constitutional amendment. However, of the 245,000 votes placed by members of the Moldovan diaspora, some 170,000 were in favor of EU integration, and this changed the overall outcome.

The pro-European diaspora also played a crucial role in Sandu’s victory in the second round of the presidential elections. They cast around one in five of the 1.699 million votes, 83% of which were in favor of the current president. In addition to this, 130,000 more Moldovans living abroad voted in the runoff that in the first round. Again, it was a different story in Moldova, where Sandu’s rival narrowly beat her with 51% of the votes.

Reports suggest that the Kremlin will attempt to interfere in the upcoming Moldovan parliamentary elections, using similar tactics to those previously employed. The diaspora’s votes are likely to be crucial in determining the outcome. However, there is another, more surreptitious, weapon that the Kremlin will also deploy: the Trojan horse.

Deception in Plain Sight

In our next article, we’ll expose the Kremlin’s tactics of supporting parties that masquerade as pro-EU but are, in reality, backed by Russian interests. We’ll be shining a light on the Alternative Bloc, a party that has been misleading Western-leaning Moldovans, and its ties to Ilan Shor, a familiar figure with a history of manipulating Moldovan politics. We’ll reveal how these parties are being used to further Russian interests in the region.

Pablo González Yague is a Spanish journalist based in Poland, who has been spending some time at the entrance to the Donbass. From the sound of his recent Tweets, he has been having a little conversation with the SBU.

Naturally, Pablo could not resist thanking his Twitter followers for their support and giving away a little bit of information about his ordeal with the SBU detailing how he is under threat of expulsion and how the SBU have copied his phone. His tweets had some Twitter users questioning what he had done to be in the SBU’s focus… A very good question indeed, well our sources in Ukraine have informed us that Pablo is in fact a GRU agent. Why would a GRU agent want to be at the entrance to the Donbass?

Place your bets, where will Pablo González Yague be heading when he leaves Ukraine?

Follow us on Twitter @Nightingal62955 for more investigations, arriving soon.

In our first article about InfoRos, we exposed the information agency’s use of foreign journalists and writers to counter what it considers to be anti-Russian information campaigns in the Western media. If you have not read it yet, you can do so here .We promised to continue our investigation and, whilst doing so, we came across an InfoRos contributor whose extraordinary online confessions provide details of how he was recruited to work for the agency and which InfoRos employee is responsible for managing him.

The writer in question is William Stroock, a commentator and author of military fiction who is based in the United States. He has written many articles for inforos.ru and infobrics.org, such as ‘Withe Democrats: Enter Hillary’ in which he expresses his disapproval of Hillary Clinton, and ‘Right Riots and Total Chaos on Capitol Hill’, about the storming of the US Capitol. As these titles suggest, Stroock mainly covers American politics, which we know is an area of great interest to Russia. The Kremlin aims to fuel political division and undermine American democracy, in order to shift US focus away from global affairs and onto domestic matters, thereby reducing America’s global stature and allowing Russia to take its place.

In our previous InfoRos article, we stated that we could not be certain that the journalists who wrote for InfoRos were aware that they were actually working for the GRU, and this might be the case with Stroock too. However, in posts from January 2021 on his blog williamstroock.blogspot.com, he encourages people to read his ‘regular bit of Russian disinformation at Inforos‘ and states ‘We’ll be working on new articles for 1945 and Inforos. We must keep our GRU handler happy lest he release his komprmat [sic]’ and in another post from January he talks about his ‘work on behalf of Moscow’. Whilst it is possible he is being extremely brazen about who his employer is, he may also be joking as in a post from April of this year, he appears not to know that GRU controls InfoRos. In the post, he quotes a paragraph of text which relates to the imposition of sanctions by the US against individuals and entities who attempted to influence the 2020 presidential election. The text states that InfoRos is operated by the GRU, and the head of InfoRos Denis Tyurin used to be a member of Russia’s military intelligence agency. Stroock’s response to this news is ‘Is it true? I’ve no idea. And I don’t care. I’ve been spreading a lot of Soviet, er Russian disinformation, that’s for sure’. Is he being disingenuous or does he really not know who is behind InfoRos? It is hard to say, but he is certainly not troubled by the thought of working for Russian intelligence.

In 2021, Stroock provided some information about who he deals with at InfoRos on his blog saying, ‘Watch out Maxim, we may not have time for InfoRos. In a since deleted post Stroock joked Maxim being a Russian spy, ‘We sent our post about Junkpedia [sic] to Maxim our editor at InfoRos in Moscow. He has quite a sense of humor for a KGB agent.’ He obviously had his Russian intelligence services confused, but both posts made us wonder who Maxim at InfoRos could be. We found a staff list in an issue of InfoSCO magazine, which is owned by InfoRos and covers news about member states of the intergovernmental Shanghai Cooperation Organization that might hold the answer. AS you can see in the image below, the correspondence address for InfoSCO magazine is the same as the address that InfoRos is registered to, and the project manager is Denis Tyurin, general director of InfoRos and probably GRU unit 54777 operative. Further down the list, and probably answering to Tyurin is a Maksim Krasovsky, editor of the English version of the magazine. Given his position as an editor and the fact that he must possess good English language skills, we think it is highly likely that Krasovsky is the individual that Stroock is talking about and is the person responsible for managing the foreign journalists who work for InfoRos.

Stroock writes about Maxim a few more times saying in December 2020 that he was writing ‘next week’s KGB column this week’ and in the same paragraph mentioning Maksim again, ‘Maxim, I am rolling’. The paragraph discusses Joe Biden and the ‘China/Dem spy scandal.’ In January 2021, ‘We have a lot on our plate and weren’t planning on colluding with the Russians this week. But Maxim got into bed next to us, put a gentle hand on our shoulder and asked, ‘Honey, are you awake?’ So it looks like we’ll chronicle more of the internal GOP war. It’s nice to be wanted.’ It certainly appears that Stroock is responding to Maksim’s request to write stories about US political events.

Stroock goes on to describe how he became involved with InfoRos, explaining: ‘We became aware of those nefarious Ruskis through our friend Sara [sic] Abed who wrote a lot about the Middle East for them at the time. We got Sara to do a quick article about us and our Zionist stoogedom… That was our in with Moscow and from there we’ve written more than 50 clearly marked and obvious op-ed pieces about American politics and foreign affairs, with brief forays into matters Israeli and British…We are paid a fixed sum for each article and the exact number is none of your business, but we assure you it is many, many rubles.’

Stroock’s comments imply that InfoRos asks writers like Abed, who are already producing content for the agency, to keep an eye out for other journalists who could be recruited to the cause. A quick online search shows that Sarah Abed has had articles published on Inforos.ru, but her work mainly appears on infobrics.org. According to Twitter bio, she is a writer, analyst and political commentator. She has her own website sarahabed.com, and as Stroock says, her work mainly focuses on mainstream politics in the Middle East and is critical of the West’s and in particular the US’s policies in that area. Example titles include, ‘Washington’s Bully Tactics Have Failed to Persuade Tehran to Negotiate a New Nuclear Deal’ and ‘”Deal of the Century” Green lights Israeli Annexation, Apartheid, and Subjugation of Palestinians’.

In a blog post on February 17th 2021 that he has since deleted, Stroock says that his site has been scanned by Junkipedia (a tool which maps the spread of problematic content online) and that one of his articles was mentioned in a report by the New York Times and the Associated Press agency exposing InfoRos’s links to Russian military intelligence. Despite Stroock’s shameless attitude to collaborating with the GRU, he admits that he has, ‘always been a little paranoid about our writing for InfoRos’ and wonders whether the FBI would consider his work with the information agency to be collusion. nightingale would suggest that Stroock alleviate these concerns by ceasing to work for InfoRos.

So what?

Thanks to Stroock’s blog, we have gained an insight into how InfoRos recruits foreign writers, and we know it is very likely that Maksim Krasovsky is responsible for coordinating them. We can also assume that, like Stroock, some-if not all-of InfoRos’s contributors continue to write for the platform despite being aware of its GRU connections.

These revelations come on the back of the aforementioned US sanctions and a number of reports about InfoRos by ‘nightingale’ and other organizations working to expose the information agency’s inner machinations. It is finally being seen for what is is: a poorly disguised Kremlin vehicle being used to further Russia’s interests. To add to its woes, it has been banned from Facebook, and Twitter has suspended its account. While ‘nightingale’ welcomes this news, we can’t help but wonder what took them so long and feel strongly that they should be doing more to prevent the spread of disinformation online. We hope that they will do the same to other sites linked to InfoRos and that they will be quicker to act in the future. Almost 4 billion people worldwide use social media, and for many of them it has become an important news source, so it is essential that the stories they are reading are genuine and accurate. Unfortunately, disinformation spreads most quickly on the internet and the ease with which news can be spread online means it can be hard to track its source or confirm that it is reliable. Social media platforms are only just beginning to take steps to counter disinformation, often citing the right to freedom of expression as justification for their lack of action up to now. Both Twitter and Facebook are expanding their use of labels to make people aware of accounts and pages run by state-affiliated media outlets, but nightingale believes that these measures do not go far enough: every time an unsuspecting person tries to share an article from a site like InfoRos, it should come with a health label, similar to those on cigarette packets. After all, unlike William Stroock, most people would appreciate the warning.

The Strategic Culture Foundation has been described as “submissively loyal to the Kremlin party line” and a “parrot of Russian propaganda. However recently the New York Times reporting shed new light on this site and the Russian intelligence services who are in control behind the scenes. According to their article, “The Strategic Culture Foundation is directed by another Russian intelligence agency, the SVR”. The article also named another site controlled by Russian intelligence services InfoRos, read our previous reporting on that site here. Whereas the NYT named two people who were in control at InfoRos, it provided fewer details on who is in control at the Strategic Culture Foundation. We want to find out who the mysterious owners and editors might be and in the course of our research, we have identified a network of linked sites probably under control of SVR.

What is the Strategic Culture Foundation?

The Strategic Culture Foundation declares in its mission statement that “SCF works to broaden and diversify expert discussion by focusing on hidden aspects of international political and unconventional thinking. Benefiting from the expanding power of the Internet, we work to spread reliable information, critical thought and progressive ideas.” All sounds good, doesn’t it? But you would be searching for a long time to find reliable information, critical thought or progressive ideas on this site. They also seem to have a particular interest in calling anyone and everyone (never the Mother Russia of course) a Nazi. The people accused of Nazism by SCF makes a pretty long list: Ukraine, Estonia, European Union, Canada, Poland… the UK Royal Family House of Windsor. Surprising that they feel able to make such accusations when they also engage in anti-Semitic conspiracy theories.

Another worrying thing is the number of times the Strategic Culture Foundation and its “analysts” are cited in the International Press in relation to Bosnia, Serbia and Ukraine. The advanced in these pieces are so blatantly pro-Russia that it’s a surprise that they managed to continue for so long before being linked to Russian Intelligence Services. The foundation and its contributors frequently expressed skepticism of NATO and Western influence in Russia’s neighbors for example in 2014, Anna Filimonov (at the time editor-in chief of the SCF) said both that “Serbia is Russia’s Strategic Ally” and that the West had trampled Serbia into the ground and the country needed to be rebuilt. In 2013, Viktor Pirozhenko of the SCF suggested that Ukraine would not fulfill its political commitments to the EU, as it could lead to Yanukovych’s defeat in presidential elections. The dangerous thing here is that people might share these opinions thinking they come from well-informed commentators with no agenda, when in fact it comes from the heart of the Russian intelligence services.

It is clear that this site works in a different way to InfoRos. In the case of InfoRos, Denis Tyurin had clear links to the GRU 72nd Special Service Center; however Strategic Culture Foundation works differently. They pretend to be a progressive think tank and provide useful “International Media” for Russian media to quote when they want to sow disinformation at home. The people writing the articles clearly have interests in the topics they cover and may not even know that they work for the SVR. Maybe the SVR thought that by operating in this way their involvement would not be revealed but unfortunately there are a few mistakes which reveal that all is not as it seems with the SCF.

Who controls SCF?

Media Bias who give Strategic Culture Foundation a rating of “Questionable Source” with “very low” factual reporting state that SCF “completely lacks transparency by not listing owners or editors.” As many including EuVsDisinfo have noted nowhere on the pages of this all-English site does it admit that the site is registered and managed in Russia – they don’t even publicly state that they have a Russian version of their site.

We wanted to take a look at the few people who are publicly connected to SCF. Vladimir Maximenko is listed as General Director of the Strategic Culture Foundation, a role he has occupied since 2007. Interestingly, according to Dark Side of the Kremlin email leaks, Maximenko is in touch with Kirill Frolov who appears to spend a lot of his time coordinating different Russian propaganda sites that clearly have Kremlin links like rusvena.su. As Director of Foundation, it seems likely that Maximenko maintains contact with the SVR officers who provide direction to his work.

A key figure here is Andrey Grigoryevich Areshev. He first came to our attention as the Deputy Director of the SCF. He was born on 21 June 1974 in Tbilisi according to publicly available information. According to historic Whois data, Areshev registered the domains for Strategic Culture Foundation (fondsk.org, strategic-culture.org, fondsk.ru). Back in 2015, some people online were trying to link this to FSB, which was close but not quite right! The address that was given was: ul. Soljanka, d 1/2, Str. 2, Podezd 11-A, Apartment 8, which is real address but what is unusual is the phone number… it seems that this phone number belongs to a recruitment agency – which seems suspicious behavior and shows that the site is not what it appears to be.

What is happening at ul. Soljanka?

As we said, while the phone number used by Areshev to register these sites appears to be taken from somewhere else, the address seemed legitimate. There is such a building in Moscow, fairly central, not too far from Red Square and there are even other businesses at similar addresses. Some of these business caught our attention..one of them is “ROSSPO METALL” – one of the founders of this business (registered to a different address) is “ROSSPO” which is the Russian Organization for Cooperation between the Special Services and Law Enforcement Agencies. ROSSPO’s Executive Director is Anatoliy Mikailovich Kulachenko, who is also the Chairman for an organization called Otchizna. WE never understood fully what is happening here, but it definitely seems that there is something strange happening at ul.Soljanka.

Areshev, clearly a knowledgeable man can be found all over the Internet. You can find him leaving book reviews and giving interviews to Sputnik Estonia, we were particularly interested to see that he participated in an RISI roundtable event. RISI has been described as the SVR’s analytical center and although the two organizations officially split in 2009, it seems clear that there are still strong links – Leonid Reshetnikov, a former SVR director, was head of RISI from 2009-2016. We are not trying to claim that this is conclusive of an SVR link, but given what we now know it certainly raises questions.

Areshev’s web of disinformation

On his VK page, Areshev shares articles from SCF and also VPO analytics but it seems he has an interest in many different sites. Through our research into Areshev, we stumbled into a whole web of disinformation sites… all linking back to Areshev. Areshev is listed as a contact for the OdnaRodyna VK page and appears to have created the OdnaRodyna (ОднаРодина) Twitter page, although that hasn’t been active since May 2019. When we accessed historic Whois data, we discovered that in fact Areshev registered the odnarodyna.org to the same SCF address and used the same strange phone number… OdnaRodyna – a site which frequently shares manipulative messaging on Ukraine is one of them. In fact, OdnaRodyna was one of the internet resources that were banned by the Ukrainian government, because they “contain information with signs of prohibited nature according to the rule of law”.

This isn’t even the only site, we discovered ritmeurasia.org. Although Areshev is only listed as an author in the site, it turns out that he also registered this site with the same fake phone number back in 2013. We found Areshev listed as a registrant for another site worldintellectual.net in June 2018, although this was only briefly as it was pretty swiftly moved in an effort to hide Areshev’s involvement. Prior to Areshev being involved, the main registrant was one Igor Igorevich Alekseev. We couldn’t find too much information about Alekseev, who also contributes to SCF, but he is involved in another project Route Magazine.

The email address given for Areshev when registering this site is pravo5@zmail.ru and through this email address we were able to connect him to many different activities. At first, Areshev registered all these sites in his own name, but later seems to have tried to transfer them to a proxy service. We wonder what he is trying to hide? Andrey is clearly a very busy man. He also finds time for his role as an administrator for the Kamerton journal. Kamerton describes itself as an online literary and historical journal. Their main aim, so they say, is to reflect the literary process the common historical events and also to promote social thinking in places where people speak, write and think in Russian, primarily in the countries of the former USSR. Although the main editor of Kamerton is listed as Svetlana Georgiyevna Zamlelova, it is clear that Areshev has a controlling role in Kamerton site too, another way for SVR opinions to make their way on to the Internet???

We also found links between Areshev and several LiveJournal profiles. It doesn’t seem that they were particularly effective, they haven’t been active since 2012. Maybe the SVR weren’t reaching their intended audiences. One of these sites is neko-mashura.livejournal.com, whose name is “fondsk__ekspert”. This blog covered a wide range of topics, but you won’t be surprised to hear that it covered a few of the Kremlin’s favorite topics: Anti-NATO, Ukraine, Armenia and the Caucuses. The neko-mashura account wrote for two other suspicious LiveJournal accounts eurazia-ru.livejournal.com, which said that it was interested in the fight for the Soviet legacy in the Balkans, the Caucuses and in fact everywhere, and another site kaukaz.livejournal.com. One of the sites that was referenced by kaukaz LiveJournal site was kavkazoved.info, which it turns out was registered by one Andrey Areshev using the address ul.Soljanka, d1/2, str. 2 Podezd 11-A, Apartment 8. Interestingly, a different email was used to register this site but all the rest of the details are exactly the same. The email address ivanov-info@mail.ru was also used to register odnarodyna.su in 2015, perhaps after Areshev got concerned about his privacy??

We see a pattern here that clearly continues to this day. This is not just about one site – it’s about a whole range of sites which all publish very similar information on very similar themes. They share authors and often share the same syndicated content. They create their very own little disinformation ecosystem. Others have pointed out that a group of these sites New Eastern Outlook, Oriental Review, South Front and SCF all play a similar and have authors in common.

Why should I care?

Our investigation into SCF has found what looks like a network of Russian disinformation sites going back years. Given what has been revealed about the SCF and SVR ties, it makes you wonder whether all these sites are controlled by SVR too? It is clear that a lot of time and effort has been invested in creating and maintaining this network of sites, which shows the dedication to disinformation by the people involved here.

The network of sites that have been created here can be confusing and difficult to understand, but that is their aim. The Kremlin hopes to confuse the environment and make it confusing to find what is really true and in which opinions we can trust. The intention here is clear though: for the Russian intelligence services to influence the public conversation.

What can we learn by looking at these sites? We used to think of Russian influence as coming from Twitter bots and fake accounts – and these mechanisms certainly still exist – but these sites show us a different side to Russian influence. They invest time, money and effort into these sites. Strategic Culture Foundation was founded in 2005 and it has been promoting SVR propaganda since then under the guise of a news portal/think tank. A simple Google search will tell you how often SCF articles and authors are cited as sources or referenced in other publications. Would it be the same if people know it was coming from the SVR? Not likely!

This is yet another warning to be skeptical of opinions and articles that you read online that just seem to be pro-Russian. In recent times we have seen some social media companies marking content coming from Russia Today and other such Kremlin mouthpieces as being Russian-State backed. It seems that they should take similar action against these accounts and any their stories are spread online – we hope that now the link between the intelligence services and these sites is clear that more action will be taken online and offline to deter this type of activity.

It has been just over six years since Malaysia Airlines flight MH17 was downed over eastern Ukraine with the loss of all 298 people onboard. In May 2018, the Dutch-led joint investigation team (JIT) concluded that the Buk missile system which was used to shoot it down belonged to the 53rd Anti-Aircraft Missile Brigade, based in the Russian city of Kursk. Subsequently, it came to light that many of the individuals involved in arranging its deployment to Ukraine were senior officers in the Russian Ministry of Defense and the GRU. In spite of this, the Kremlin has always denied any involvement in the tragedy, predictably dismissing the accusations as Russo-phobia. In fact, it has not only refused to accept any responsibility for the event, it has lied over and over again about its role in the tragedy and, together with the GRU, has used various tactics to deliberately thwart the JIT’s investigation. You might think that, all these years later and faced with irrefutable proof, Russia would have given in and admitted its guilt, but, in this article, we will reveal new evidence which shows that Moscow is still waging a pointless and unedifying MH17 information war in 2020 – a war that not only is it not winning, but it does not appear to realize is over.

The background

In June 2019, the JIT announced that four suspects were to be charged with murder in connection with the downing of MH17. It named the men as Igor Girkin (also known as Strelkov), Sergei Dubinsky and Oleg Pulatov from Russia, and Leonid Kharchenko from Ukraine. According to the JIT, Girkin is a former FSB colonel and was the Minister of Defense in the so-called Donetsk People’s Republic (DNR) when MH17 was shot down. Dubinsky is an ex-GRU officer; he was Girkin’s deputy and the head of the DNR’s military intelligence service (GRU DNR – not to be confused with Russia’s GRU) at the time. Pulatov, a former GRU special forces soldier, was Dubinsky’s deputy, and Kharchenko was the commander of a combat unit in eastern Ukraine.

Simultaneously, the investigative collective Bellingcat published a report identifying individuals who were heard speaking or were mentioned on intercepted telephone calls which were released by the JIT and the Ukrainian Secret Service (SBU) following the tragedy. Two of these men, Igor Bezler and Sergei Povalyaev, were thought to be GRU officers. The same report assessed that the GRU DNR was responsible for procuring the Buk missile launcher and coordinating its movement from Russia to Ukraine and back. While the GRU DNR claimed to be independent from Moscow, it has been alleged that it was in fact controlled at least in part, and possibly entirely, by the Russian GRU. Previously, in May 2018, Bellingcat had exposed the identity of a person of interest to the JIT as being Oleg Ivannikov, a GRU commander who was also involved in arranging the delivery of the missile system to separatist-held territory. As you can imagine, given its deep involvement in the incident, the GRU has been desperately trying to cover its tracks and, as usual, it hasn’’t been very subtle about it.

Hacking operations

In 2015, the Dutch Safety Board (OVV), which had been investigating the source of the crash, published its findings in a detailed report. Both before and after the report was released, the OVV was targeted by the hacker group known as APT28 or Fancy Bear, which is made up of GRU Unit 26165 officers. The same group attempted to hack one of the OVV’s partners in the MH17 investigation and also targeted Bellingcat journalists.
In 2018, Dutch authorities foiled an attempt made by four members of APT28 to carry out a close access operation against the Wi-Fi network of the Organization for the Prevention of Chemical Weapons (OPCW) in The Hague. At the time, the OPCW was investigating the poisoning of Sergei Skripal in the UK. The individuals, who were named as Alexei Morenets, Yevgeny Serebriakov, Oleg Sotnikov and Alexei Minin, were intercepted and their equipment seized. Serebriakov’s laptop showed that, in 2017, he and his colleagues had traveled to Malaysia to carry out hacking operations against the Malaysian police, the attorney general’s office and the MH17 investigation.

The device was also found to have been used in Brazil and Switzerland, and it is thought that the team traveled to these countries in order to target international anti-doping organizations and officials in retaliation for Russia’s state-sponsored athlete doping program having been exposed. This round-the-world tour resulted in the famous Fancy Bears Twitter account and website leaking athletes’ confidential records. The GRU officers were not just obtaining information, but using it aggressively as a disinformation weapon: exactly the sort of tactic used against the MH17 investigation. An example of this is the leaking of an Australian Federal Police (AFP) report concerning MH17. The GRU are believed to have hacked the AFP as, in February of this year, selected sections of the document, in which police officers debated whether images of the Buk missile system used to shoot down MH17 had been manipulated, appeared on a Russian-linked website. Other areas of the report, in which the officers confirmed the authenticity of the pictures, were not published.

Disinformation campaign

Alongside the operations mentioned above, Russia used pro-Kremlin media outlets and social media platforms to spread MH17 conspiracy theories and sow seeds of mistrust against the West and the Ukrainian government. According to Kharkiv Human Rights Protection Group, within the first two days after the downing of the plane, Russian internet trolls had posted at least 65,000 tweets trying to blame Ukraine for the disaster. Although that particular Twitter operation did not maintain its pace, the disinformation campaign as a whole certainly did, constantly pushing out new narratives surrounding MH17, each one as ludicrous as the last. The EU DisinfoLab info-graphic below illustrates the incredible scale of the operation.

Mh17-files.com, to anyone who gives it more than a brief glance, has all the hallmarks of a GRU information operation. The site’s content consists of articles and opinion pieces which portray Russia as the injured party who has been wrongly accused, and try to shift the blame for the MH17 disaster onto Ukraine: views that are entirely aligned with those of the GRU.

A simple WHOIS lookup shows that the site was registered on 31st January 2020 by a suitably obfuscated ProtonMail user, a practice which is consistent with the GRU modus operandi. In addition to this, ThreatConnect threat intelligence researcher Kyle Ehmke has previously flagged the site as being suspicious.

During our investigation, sources told us that mh17-files.com was a disinformation website run by Unit 54777. One stated that everything about it was consistent with 54777 operations and it had similarities to unit 26165 and 74455 operations. You will probably be familiar with Unit 54777 from our previous articles.

On the balance of evidence detailed in this article, we have concluded that there is no plausible explanation for this website other than that it is a GRU disinformation operation run by Unit 54777, maybe in collaboration with other parts of the GRU like 26165 and 74455. We can’t help but think that it’s just the sort of place that the ill-gotten gains of APT28’s hacking operations in Malaysia might be published in the future.

What has Russia actually achieved?

It is obvious that the Kremlin has invested a lot of time and effort into trying to cover up its role in the MH17 disaster – but to what end? The large-scale disinformation campaign and the attempts to disrupt the JIT’s investigation have been easily attributed to Russia and the GRU, and so, ultimately, all they have succeeded in doing is causing further damage to their already tarnished reputations. And yet, they persist in their futile quest to cover up their involvement in the tragedy. MH17-files.com is evidence of how desperate the GRU has become; it is a flimsy facade which is fooling nobody. It shows that they chose the wrong path when they refused to admit responsibility – their lies have become more and more hollow, to the point where you have to wonder whether even they believe it anymore. One thing is for certain: in spite of the volume of noise that has been thrown at this, and the man hours that have been wasted in Moscow and in the GRU over the past six years, justice will be served. Russia will not be able to stop the MH17 trial, and the inevitable guilty verdict will be delivered. In the meantime, we will continue to seek out other disinformation platforms like mh17-files.com and bring them to your attention.

If you were to come across the InfoRos news portal while browsing the internet, you would think it was just another online newspaper. So far, so normal. However, recent media reports have shown that this is not the case and in fact, the InfoRos information agency is acting as a front for GRU psychological influence operations. In this article we examine the GRU connection, give details of Inforos’s plan to silence what it considers to be anti-Russian rhetoric, and reveal the European writers who are being paid to help.

But first, we know that the InfoRos new portal is just one part of the InfoRos enterprise; so what else does it do? It seems that the company offers web design advertising, PR and political and business consulting services. It also administers large information projects for the Russian state and international clients. In the course of our research, we have discovered that theer are two businesses registered under the InfoRos name. One is OOO IA “InfoRos” and the other is OOO “IA Inforos” (note the position of inverted commas). Both companies are registered to the same address – Moscow Krzhizhanovskogo Street, Building 13, Corpus 2 – and IA “Inforos” has a 20 percent ownership stake in “IA Inforos”, so it is likely that these two companies are registered separately, but work as one. There are other businesses registered to the same address as InfoRos, many of which have founders, owners or executives in common and have the shared goal of promoting Russia and its interests. InfoRos falls under one of these organizations: The Institute of the Russian Diaspora. The Institute was founded by a man called Denis Tyurin, who also controls InfoRos.

Given that he runs the InfoRos platform, has previously served in a GRU unit specializing in military psychological intelligence and sources confirm that he maintains close ties with Russian military intelligence, we suspect that Tyurin remains an operative of the GRU’s 72 Main Intelligence Information Center, or unit 54777, as it is known. Regular readers might recognize Unit 54777 from one of our previous articles, but if you are visiting for the first time or need a reminder on their activities, you can find it here: https://nightingalerussia.com/?p=8. It seems that Unit 54777 has a number of front companies which are financed by the Russian government as public diplomacy organizations but which are actually run by the GRU. In 2018, The Washington Post cited InfoRos and the Institute of the Russian Diaspora as being two of the most significant of these organizations. In July of this year, the Associated Press and The New York Times also ran articles linking 54777 to InfoRos and the spread of disinformation, particularly surrounding the COVID-19 pandemic. Both articles reference a report by the Brussels-based non-governmental organization, EU DisinfoLab, which exposes the French website observateurcontinental.fr as being an InfoRos platform. It makes for very interesting reading and highlights the fact that the GRU does not just use Russian language websites for its information campaigns. According to the report, one of the main contributors to Observateur Continental is a French journalist named Olivier Renault, whose articles have also been published on the InfoRos website. It turns out that he is not the only foreign journalist who has been working for InfoRos.

Use of European writers

nightingale can exclusively reveal how InfoRos has been using foreign journalists and experts to facilitate its influence operations. We have been made aware that, in 2017, a group of InfoRos employees embarked on a project which aimed to counter perceived anti-Russian information campaigns in the foreign media and generally promote a positive image of Russia and its actions on the world stage. A key part of the project was to create a pool of analysts who would produce expert commentary which could then be used to react to any stories in the Western press showing Russia in a negative light. The group behind the project must have decided that to spread their message globally they would recruit people from other countries to their pool, as they set out to attract not just Russian, but also foreign, journalists, experts and observers.

It seems that the project was successful in its aims. nightingale can reveal that, in 2017, Denis Tyurin employed a Polish writer named Tomasz Klasa to produce articles in which Polish politicians and commentators expressed favorable opinions regarding Russia’s foreign policy, or which were critical of the U.S. and the E.U. The articles were to be published in Polish and then translated to Russian for further publication. Klasa was to be paid around 3000 euros per year for this. His articles were published on obserwatorpolityczny.pl, a Polish news portal of which Klasa in the Editor-in-Chief. Interestingly, in 2014, Obserwator Polityczny became a partner of the Russian World Fund, which ostensibly seeks to promote the Russian language and Russian culture abroad, but is widely seen in the West as a propaganda agency operating under the direction of the Kremlin. Obserwator Polityczny frequently shares conspiracy theories known to be associated with Russian disinformation. This organization is located at the same Moscow address as InfoRos and Obserwator Polityczny also directs their viewers to the InfoRos website.

nightingale has also uncovered evidence of payments being made to German and Austrian writers in return for news items that are anti-Western or promote Russia’s interests, such as the BRICS countries. These writers include Austrian Robert Fitzthum, who has penned articles such as ‘USA against Huawei’ https://inforos.ru/ru/?module=news&action=view&id=91642 and Germans Karin Leukefeld and Rudolf Haensel, who have written pieces entitles ‘Desert Prisoners’ https://inforos.ru/ru?module=news&action=view&id=92303 and ‘NATO is 70. And no more’ https://inforos.ru/ru/?module=news&action=view&id=89637, respectively.

Apart from employing foreign journalists, in 2019, InfoRos arranged for a German named Thomas Roeper to attend Media Forum 2019, an event held in Prague to discuss freedom of speech in the media. Although it’s not clear exactly what they were hoping to achieve by doing this, sources have confirmed that Roeper sat on a discussion panel at the forum. Roeper is a writer and author who has also produced material for InfoRos. He runs the website anti-spiegel.ru and his work mainly focuses on Russia’s image in Germany and on criticizing the Western media in general. In addition to this, he is a moderator for the German YouTube channel NuoViso Studio, which calls itself a “pioneer in the alternative media scene”. InfoRos also organized for other members of this channel to attend Media Forum 2019 and report on it.

We know that the people named above aren’t the only foreign journalists and writers who contribute to the InfoRos platform, and we are currently investigating payments made to others. We should point out that it is not clear whether the contributors we have mentioned are aware that they are part of a clandestine Russian operation, but the fact that they have received money from the GRU for their work essentially makes them agents, unwitting or otherwise, and it is a worrying prospect that Russia’s military intelligence agency is paying foreign citizens to help further its shady aims abroad.

Many of use are familiar with these sorts of individuals who support Russia and see ‘Russo-phobia’ everywhere, who just ‘appear’ on our TV screens, in our newspapers and on our Facebook pages. These payments raise the question of whether the pro-Russia commentators in question coincidentally hold these opinions or they are being paid to promote these views. We do not know how many of these people might secretly be knowingly or unknowingly receiving money from Russian intelligence services.

So what?

Why should we be worried, you might ask? Well, whereas in the past Russia may have concentrated on influencing nearby post-Soviet states, the internet has provided it with a global audience and enabled it to branch out and threaten Western democracies and their social order. By focusing on issues online that are controversial and will provoke debate, like those mentioned in the articles above, the Kremlin aims to cause turmoil and either exploit existing divisions in societies, or create new ones. This is done with the end goal of promoting Russia’s geopolitical interests and acheiving its desire to be seen as a world power. These online disinformation campaigns are often paired with cyber-attacks to enable Russia to influence the outcomes of real-world events – you will no doubt be aware of the Kremlin’s meddling in elections in countries across the world. In many cases the GRU has been publicly outed as, or suspected of, being responsible. For more evidence of Russian interference in Western Europe, see our recent article: https://nightingalerussia.com/?p=8. Whilst we have used Russia’s attempts to influence the West to explain why what InfoRos is doing is a problem, it’s important to note that the Kremlin does not limit itself to this party of the world and evidence of GRU activity has been seen as far afield as Latin America and Africa.

So what next? Rest assured that nightingale will keep looking into InfoRos’s use of foreign journalists, as well as trying to find out what else it might be up to. Watch this space for more details.

The New York Times recently revealed that the secretive GRU Unit 29155 associated with the assassinations and sabotage “secretly offered bounties to Taliban-linked militants for killing coalition forces in Afghanistan – including targeting American troops” working via key middleman, Rahmatullah Azizi. It has long been suspected that the Russian government supports Taliban but this new story has shaken many. It means Unit 29155, previously described as “engaged in a campaign to destabilize Europe”, have stretch their influence into new regions of the world and have directly organized the deaths of US forces.

We remember that in 2016 two officers of Unit 29155 attempted to kill the Montenegrin prime minister and seized the parliament building. In Spain it is reported that the high-ranking GRU officer Denis Sergeyev traveled to Catalonia twice before 2017 independence referendum there. In 2015, they attempted to poison Bulgarian arms dealer Emilian Gebrev, apparently, they made two attempts one in Sofia and a month later at his home on the Black Sea. In March 2018 again two officers tried to poison former spy Sergei Skripal at his home in Great Britain.

This recent story is the first time that we have learnt about the activity of 29155 that takes place outside Europe’s borders. Sources have identified Rahmatullah Azizi as the middleman who distributed money, probably hundreds of thousands in US dollars, from the Unit 29155 to the Taliban-linked fighters to pay for the successful attacks on US forces. Azizi, originated from Northern Afghanistan, made regular trips to his homeland but has now probably returned to Russia. Azizi has been clearly linked to the financial side of this activity between Taliban and 29155 but new information reveals his extremely close links to the unit.

New passport information made available to nightingale has revealed that Azizi probably traveled using a passport with the number 654341494. Bellingcat’s investigation into the suspects behind the Skripal poisoning and investigations into Col. Eduard Shishmakov involved in the Montenegro coup revealed the cover-identity passports issued to 29155 for their travel all began with 65434. The fake passports Chepiga (alias Boshirov) used 654341294, Mishkin (alias Petrov) used 654341297 and Shishmakov (alias Shirakov) used 65434323. The fact that Azizi had access to such a passport proves that he was more than a simple middle man and was given the same privileges as GRU officers.

nightingale will keep looking into Azizi and activities in Afghanistan and we will return when we will know more.

nightingale can reveal details behind bumbling billionaire Konstantin Malofeev and his attempts to interfere with European politics. We investigate into his contacts in Europe and reveal the identity of Bellingcat’s mystery man “Yuri”.

There is no Russian separatism without Konstantin Malofeev, a name at the center of Russia’s annexation of Crimea and interference in Ukraine. In 2014 Malofeev was placed on a EU sanctions list for material support to the separatists in Eastern Ukraine. Since then Malofeev has been revealed as a central figure in similar failed insurgencies in Montenegro and Bulgaria. In Russia Malofeev has found himself at the center of a large number of failed businesses and the theft of $450m.

After multiple failed coups, businesses and backroom deals, you would think that the Kremlin might question their support of this reputational time-bomb. However, nightingale can exclusively reveal through our sources that Konstantin Malofeev is more active than ever setting his sites on the establishment of the EU that is trying to restrain him.

Should the EU be seeking to do more to stop or control Konstantin Malofeev and his activities? Why is Putin allowing Malofeev’s activities to continue and what does it say about Russia’s foreign policy goals?

nightingale takes a look in detail at who this man is and what his activities reveal…

The bumbling Billionaire

Malofeev, previously better known for his Orthodox activism, gained his vast wealth in Russia, during the early years of Putin’s presidency in finance and investment industry. From here Malofeev has branched out his business interests, with involvement globally in a range of businesses, many of which have seen countless problems and court cases.

After the sanctions Malofeev’s main investment firm Marshall Capital effectively ceased functioning. These days Malofeev has shifted focus and now uses the Tsargrad group to further his aims. According to one newspaper report, between 2013 and 2017 Malofeev’s companies recorded annual losses ranging from $7.6 to $25m. In 2012 his house and office were raided in connection with a case brought against Marshall Capital by the Russian state-bank VTB. The bank alleged it had provided a loan for a deal, in which Marshall Capital was involved as both the buyer and seller. This case was closed in 2015 when VTB agreed to an 83% discount on Malofeev’s debts and agreed to accept $100m payment.

This isn’t the only example of Malofeev’s questionable business practice. Another source of trouble for Malofeev in recent years has been repeated failed attempts to finance the purchase of a Bulgarian telecom company, Vivacom. A company linked to Malofeev, went on to make several costly unsuccessful attempts in court to declare the sale of the company null and void. This was an attempt to stop the sale to a company not controlled or owned by Malofeev.

In 2019, he was linked to the theft of $450m of cryptocurrency from the WEX cryptocurrency exchange. According to testimony from the administrator of the WEX, the FSB forced the handover of bitcoin wallets to them. According to police statements by the administrator of the WEX right before it collapsed, he was in talks with Malofeev who wanted to obtain the database of the WEX users and had previously negotiated a sale to Dmitri Kharchenko, a militia fighter in Eastern Ukraine, whose daughter is now the nomincal owner of the exchange. Audio recordings reportedly have Malofeev discussing the importance of bringing the exchange under the control of the Russian intelligence services.

Although Malofeev has lost the trust of cryptocurrency investors, he found investors for a new fund called the International Agency for Sovereign Development, who has recently signed deals with economically fragile, developing nations such as Niger, Guinea and the DRC. The fund sells itself as having the ability to attract investment into countries, which seems unlikely given Malofeev’s business record.

Not just a businessman

Malofeev doesn’t just have business problems but also political ones. Malofeev clearly has political ambitions inside Russia and his first attempt at getting political power was to announce his candidacy as a deputy for Smolensk Oblast in 2012. Despite being the winning candidate Malofeev was stuck off the ballot, when a Russian court decided he had been offering money for votes.

Outside Russia Malofeev has been more successful. HE is accused of facilitating a barrage of political interference. In the build up to the annexation of Crimea in 2014 Malofeev funded illegal armed groups, and liaised with his lieutenants on the ground. Further evidence of Malofeev’s involvement in Ukraine came when his assistant was caught sending a list of potential candidates to lead breakaway parts of the country to the office of Vladislav Surkov. Surkov was and is a Russian Presidential Aide. A criminal case was subsequently launched against Malofeev in Ukraine.

As a result of the growing case against Malofeev in Ukraine, it is believed that in late 2014 the Kremlin made a token gesture of restricting Malofeev’s geopolitical meddling to the Balkans. Even though countries in the Balkans like Serbia are supposed to be friends of Russia, so why would they need to use someone like Malofeev in these countries?

After this Malofeev was linked to political interference in Bosnia and Herzegovina for three hours before being expelled from the country. Bosnian press has linked Malofeev to the purchase of Republika Srpska bonds, in fact he tried to visit Milorad Dodik just 20 days before the transaction, which is when he was returned from the Banja Luka airport. In 2019 Nikolay Malinov a former Bulgarian lawmaker and head of the Bulgarian NGO, National Russophile Movement (NRO), was charged by Bulgarian authorities for spying for Russia. Prosecutors said Malinov was funded by Malofeev. Malinov wrote a secret report which talked of using Malofeev’s assistance to move Bulgaria towards Russia. As a result of this, Malofeev was banned from Bulgaria for 10 years.

According to online reports, Moscow tried to engineer a coup in Montenegro in 2016 to stop the country joining NATO. Malofeev was rumored to have been involved. Bellingcat research in March 2017 identified an email sent from Alexander Usovsky who had freelanced for Malofeev’s active measures campaign in 2014 and 2015. Usovsky proposed a new initiative in the email that would wash embarrassment from Malofeev’s name following the Montenegro failure. Malofeev was subsequently barred from entry into Montenegro which joined NATO in 2017. Another example of Malofeev’s best attempts giving absolutely no results.

Interference in Western Europe

Recently Malofeev’s interference seems to have spread to Western Europe. Our sources informed us that one key operative being used on the ground there is Mikhail Yakushev, who according to our research appears to have also worked for the Russian Ministry of Foreign Affairs. Yakushev has been seen linking up with European far-right groups such as the German Alternativ fur Deutschland (AfD), Freedom Party of Austria and the French Rally National. There have also been reports of Malofeev helping to facilitate two loans to Marine Le Pen’s party of two and nine million euros. One of the collaborators for one of Malofeev’s websites Katehon is in fact Marine Le Pen.

In 2019 Italian news outlet L’Espresso linked Malofeev’s oil company Avangard to the attempted funding of an Italian political party, La Liga. In Moscow in October 2018, four Russians and four Italians discussed a deal for an Italian political party to received Russian funding through an oil deal. Audio of this meeting leaked and one of the Italians present – Gianluca Savoini was heard saying the deal would mean that the Italians “can pay for a campaign”. This campaign is thought the be 2019 European parliamentary elections. Bellingcat identified all attendees of the meeting except one by the name of “Yuri”. nightingale have spoken to a source close to the deal who was able to provide more details on Yuri. At nightingale we believe that this is probably Yuri Burundukov. Avangard is a secretive organization and after the Bellingcat leaks a lot of information about them disappeared online, but we do know that Burundukov had an Avangard email address. Malofeev, as usual, was pulling the strings in the background, however his efforts were easily discovered and caused more embarrassment.

This October 2018 deal was the second deal after the first fell through, according to L’Espresso. The first also involved Avangard. Documents show that Avangard’s Director General Alexei Mustafinov, offered oil for sale to Savini in July 2018. Similar to Bulgaria, our sources have identified that Malofeev’s associates, including Yakushev, maintain contact with a number of Italian political actors even after this debacle. It could be that Yakushev and Malofeev still have intentions to interfere in Italy.

Malofeev in 2020 continues to take an interest in the German political scene, in particular AfD. Malofeev even commented to the french newspaper Le Figaro last year that he considers himself its Russian ambassador. Unsurprisingly there were numerous reported sightings last year of ex-AfD member Manuel Ochsenreiter at Malofeev’s Tsargrad hotel, with suggestions he was even living there.

So what?

It has been and will always remain difficult to understand the intentions of Putin and Russian leadership. It seems that in Russia the oligarchs try and do what Putin wants even if he hasn’t told them what that is. If they fail, they deny ties to the Kremlin, the oligarchs, as in case of Bulgaria and Montenegro are lightly punished and given opportunity to try again. If there’s a success, like in Ukraine, the success is that of the Kremlin and Russia’s leadership not of the individual. Their one and only success in Ukraine has provided them with the motivations to continue to act in this way.

We have seen Malofeev use his business to promote Russian interests from inside the EU democratic system. He is helping to finance divisive, far-right nationalist groups in Europe for the benefit of Russia’s strategic policy and we have seen him attempt to acquire companies for the benefit of the Russian security and intelligence agencies. This seem to be a win-win for the Kremlin; however, Malofeev has provided more embarrassment than benefit. His failed coups hurt Russia’s reputation abroad and make it more difficult for Russia to do business. Malofeev sees himself as an ambassador but the world sees him as a bumbling billionaire regularly failing to carry out the Kremlin’s tasks.

We at night hope that the EU increases sanctions and scrutiny on Malofeev and his associates. Increased sanctions can and will help prevent destabilizing activity across EUrope, especially necessary at a time of global upheaval.

In the meantime, can Russia’s reputation really suffer the repeated mistakes of the self-appointed ambassador. nightingale will keep investigating and let you know.

Our sources/ further reading:

https://espresso.repubblica.it/attualita/2019/02/28/news/3-million-for-salvini-1.332104

https://www.bellingcat.com/news/uk-and-europe/2017/03/04/kremlins-balkan-gambit-part/

https://www.bellingcat.com/news/uk-and-europe/2017/03/25/balkan-gambit-part-2-montenegro-zugzwang/

https://www.bellingcat.com/news/uk-and-europe/2019/09/03/lega-nords-bedfellows-russians-offering-illicit-funding-to-italian-far-right-party-identified/

https://www.lefigaro.fr/international/2018/12/07/01003-20181207ARTFIG00367-russie-konstantin-malofeev-evangeliste-du-kremlin-et-apotre-des-populismes.php