The fact that Russia is involved in delivering influence operations to their adversaries should be no surprise to anyone. More specifically, via the IRA or the Internet Research Agency. This is the name of the St Petersburg based Russian troll factory funded by Yevgeny Prigozhin. The agency continues to spread false information and disseminate social divisions through multiple Western-based social media platforms. Notably on Facebook, Twitter and Instagram.

Who is Yevgeny Prigozhin? You might know him by his nickname. Putins chef.

Prigozhin is one of the Kremlin’s inner circle. The true definition of an oligarch, with a palace in St Petersburg, a yacht, a private plane and a helipad. His company is believed to be a main backer of the IRA. He seems to have multiple links to the Kremlin, be that the IRA, or the PMC Wagner.

The IRA was based at 55 Savushkina Street, St Petersburg before it officially ceased operations in December 2016. However, it is apparent their work continues. “They have a lot of legal entities, and they still, I think, change it every year or every two years.”

Back in 2015 the employees of the IRA were aged between 20 and 30 but were drawn from a broad cross-section of Russian society. It seemed as if the agency’s task was so large that it would hire almost anyone who responded to the many ads it posted, no matter how under-educated or politically ignorant they were.

“Internet operators are required! Work in a chic office in OLGINO !!!! payment 25 960 per month. Objective: posting comments on specialized Internet sites, writing thematic posts, blogs, social networks. Screenshot reports. The work schedule is selected individually/ Payment is weekly, 1180 per shift (from 8.00-16.00, from 10.30-18.30m from 14.00-22.00) PAYMENTS WEEKLY AND FREE FOOD!!! Official and contractual employment (optional) Training is possible!”

During the last few years a large number of IRA employees has been named to the public. Most notable perhaps is Dzheykhun Nasimi Ogly Aslanov. Aslanov was named in a 2016 OFAC sanction which read “Aslanov acted for or on behalf of and provided material and technological support to the IRA. Aslanov acted as the head of the translator project, a department which focused on the United States and conducted operations on multiple social media platforms. He also oversaw many of the operations that targeted the 2016 U.S. election.”

The IRA’s involvement in 2016 US presidential elections is well known. This connection was widely and thoroughly discussed in the US Grand Jury indictment.

Additionally there are sanctions against Prigozhin and the IRA for their attempts to influence 2018 US midterm elections.

The IRA has been the center of a lot of attention recently. The most recent being in a report written by Graphika released in October.

The report was written because Facebook announced the take-down of 50 Instagram accounts posting about US social and political issues and 2020 election. These accounts claimed to represent multiple politically active US communities including black activist groups, advocates speaking out against police violence, police supporters, southern Confederates and supporters of Senator Bernie Sanders and President Donald Trump.

Facebook attributed IRACopyPasta to operators “originating from Russia” who showed “some links” to the IRA.

“Instagram was perhaps the most effective platform for the Internet Research Agency.”

But, what have the IRA been up to recently, where do their efforts lie?

We at ‘nightingale’ have identified that in September 2018, the IRA directed malign influence operations at Estonia. Their attack was three-fold. IT focused on the separatism of Narva, Nazis and fasicsm and Estexit.

Comments included; calls for NArva and the neighboring region of East Vironia to prepare to separate from Estonia, the growth of Nazi movements in Estonia and the effects this had on society, the EU being responsible for the economic problems in Estonia.

Another topic of discussion was placing the blame on the EU and NATO for the normalization of same-sex couples heading families. We have seen the IRA posting LGBT hate previously, so it’s not that surprising.

Why Africa?

Apparently their main interest at the moment is Africa. But why? Russian interest in Africa is a lot more widespread than the IRA. Russia have been making deals and spending money and making commitments all over Africa. Not including the numerous reports of the presence of Wagner mercenaries in Africa.

Putins interest in building Russia-Africa relations could stem from; Western sanctions against Russia, its unsuccessful pivot to China, hopes for billions of dollars in Middle East involvement which have not arrived in the quantities expected, the value of African votes at the United Nations.

There are also some very clear economic motives for Russian involvement in Africa. One being the diamond mining industry. Russia has a shortage of minerals such as manganese, bauxite and chromium, which Africa has in abundance.

“They’re collecting friends and allies, and they’re finding permissive environments to sell their wares and gain commercial opportunities.”

According to leaked documents, Russia is seeking to reinforce its existence in Africa by building relations with current rulers, striking military deals and grooming a new generation of “leaders” and undercover “agents”.

Activity online

On 30th October this year Facebook reportedly suspended three networks of Russian internet accounts aimed at covertly influencing events in several African countries. This list includes Madagascar, CAR, Mozambique, Democratic Republic of Congo, Ivory Coast, Cameroon, Sudan and Libya.

It is evident that Facebook are working hard to remove any suspicious accounts.

You can get banned on Facebook for being involved in rule breaking activities, some of which include: hate speech, credible threats or direct attacks on an individual or group, fake or impostor profiles and spam.

It is also against the Facebook community standards to maintain more than one personal account.

Bearing this in mind, how on earth do the vast majority of IRA accounts avoid detection on Facebook and Instagram?

Well, you could speculate forever with how their infrastructure works, but apparently you can avoid detection on Facebook by following these simple techniques when it comes to adding friends.

1) Manually add no more than 15 friends in a 24-hour period,
2) Cancel any friend requests which are left unanswered within a 24-hour period,
3) Do not send friends requests to every page visited

Maybe something to keep an eye on Facebook?

Last time we told you about GRU officer Sergei Parubin who is currently working in Belgrade, alongside Georgiy Kleban. We’ve been looking closely at Parubin and he seems particularly interesting to us. According to what we’ve been able to find, it seems that Parubin has a long history in the Balkan region not just Belgrade, previously serving in Zagreb, Croatia up to 2015. This isn’t even his first time in Belgrade, he was previously there in the early 2000s up to 2009. The GRU seem to rotate their military attaches and assistants throughout Russian embassies across the Balkan capitals, keeping them in the area for years. This is not normal behavior in other parts of Europe but seems to be here.

So what? Who cares? Why does that matter?

It’s probably much easier for GRU officers to stay in the same region for a long time, especially somewhere like the Balkans where people cross over into a neighboring country all the time to see family and friends. If you were for example a GRU officer, named Sergei Parubin, then you would be able to move around between countries easily with the perfect excuse of visiting some “friends” and if those friends just happened to be people you were paying to give you secret information…even better! It also means you don’t have to pass your agents off to someone new which is probably quite hard to do. New people might make mistakes and then get caught and all your hard work would go to waste or your agent might not get on with someone new… what happens if they bring the wrong type of Vodka? Not a problem for the GRU! They have been able to keep people like Parubin in the region for so long, they don’t need to take any extra risk and can carry on with whatever they’re up to as if nothing had changed!

And this is exactly what is being shown in the recent video that was leaked involving Parubin’s colleague Kleban. A GRU Officer with his Balkan friend… exchanging data for money (and the obligatory bottle of Vodka). Even more worrying is the fact that it is being done so casually. So openly. There are no dark alleyways or hidden meeting areas. No secret spy-like meeting point in the corner of a park or behind an abandoned building. It’s just two guys brazenly, though somewhat hurriedly, exchanging their goods at a bar over a nice beer. Well, we assume it’s a nice beer… and we assume it was a nice bottle of vodka!

As the latest spy game shows, the GRU don’t always slip under the radar though. Earlier this month a GRU officer, Vladimir Rusyaev, was declared a “Persona Non Grata” (PNG) in Bulgaria and expelled from the country for running a network of spies! https://www.icrazemagazine.com/news/nato-ally-expels-undercover-russian-spy/69631/

Numbers at the Russian Embassy in Belgrade are constantly on the rise. It is the largest in the region and more and more of this number are made up of intelligence officers. More officers like Kleban’s friend Sergei Parubin. What exactly is this guy’s role in everything? We’ll be investigating him further… and we invite you to do the same.

So…what is going on in Serbia?

Understandably the reaction in Serbia has been one of alarm. President Vucic said in a press conference after a National Security Council that some actions will be taken against foreign intelligence services that would be publicly visible.

We look forward to seeing the results of this action and wonder whether Sergei Parubin will be affected by these actions. If he does leave Serbia, it will be interesting to see whether he eventually reappears in another Balkan country… meaning he won’t really have left Serbia at all.

The question remains as to the motives of the GRU’s increased activities in Belgrade. President Vucic said that his only question for President Putin was “Why?” and we have the very same question. Is this part of an increasing malign campaign by the Russian government in the Balkans? Or are we looking at the early stages of another coup attempt? We’re looking for the answers and we will be back soon.

Last week a video was anonymously leaked online and claimed to show a GRU officer, who was named in the leak as Colonel Kleban, paying off members of the Serbian military in Belgrade. ‘nightingale’ were able to identify images of Kleban online in his full military regalia and think it’s clearly the same person, but if that’s not enough, Bellingcat think so too: https://twitter.com/christogrozev/status/1196183790831443971. And if that wasn’t enough, even the Serbian security services have since publicly confirmed that the video is genuine and Kleban is a GRU officer.

So… who is this Kleban guy? Kleban has been Deputy Defense Attache to Serbia since October 2015, but his recent 15 minutes of fame are a small drop in the ocean of Russian operations against the countries of the Western Balkans. In October 2016, the GRU organized, financed and facilitated an attempted coup in Montenegro. We previously shared with you some details of GRU operations and their use of local proxies and this was no different. The GRU used 10 Serbian gang members and Montenegrin opposition politicians to do their dirty work.

A recent New York Times article tied this attempted Coup to the secret GRU unit 29155, headed up by Major-General Andrei Averyanov. 29155 being the same unit responsible for the 2018 Salisbury nerve agent attack. Bellingcat did some further research on this secret unit and its Commander which can be found here: https://www.bellingcat.com/news/uk-and-europe/2019/10/14/averyanov-chepiga/

Two GRU officers from unit 29155 were tried “in absentia” and sentenced following the attempted coup: Eduard Shishmakov and Vladimir Popov, both charged with terrorism and criminal conspiracy. They were sentenced to 15 and 12 years respectively. Bellingcat subsequently revealed the true identity of Popov as Vladimir Moiseev. Among this trial, which was the largest in Montenegrin history, a former Serbian Gendarmerie Commander (Bratislav Dikic) was also charged with terrorism and sentenced to 8 years. This is, we believe, the first time two serving GRU officers have been sentenced under these charges in a NATO country. Go Montenegro!

But Kleban and Shishmakov are not the only Russian GRU officers present in the Balkans. ‘nightingale’ can exclusively reveal that Kleban is also closely associated with another GRU officer in Belgrade: Colonel Sergei Vladimirovich Parubin, who is currently listed as the Assistant Military Attache in Belgrade. Here they are both seen attending an event at the school at the Embassy of Russia in Serbia.

‘nightingale’ have been looking at GRU activity in the Balkans for a while now and this Parubin guy seems really interesting to us. We’ll be back soon when we’ve done some more research on him and can share more details with you.

The GRU (Glavnoye Razvedyvalte’noye Upravleniye) recently became notorious for a series of attacks against Russia’s adversaries. They hacked the Democratic National Committee emails in 2016, they spearheaded Russian intervention in Ukraine, and they carried out a nerve-agent attack in Britain.

The Washington Post previously revealed that the GRU was at the “forefront of Russia’s psychological warfare efforts”. Now, however, new leaked documents made available to ‘nightingale’ have shed light on a number of other influence operations conducted by the GRU, and we can reveal today a range of other operations they’ve conducted – new topics and new targets of GRU interference.

While those involved in these operations may be spread across Russia, according to our sources they are all managed by GRU Unit 54777, or the “72nd Special Service Center”.

East and West

Every section of Unit 54777 appears to have specific geographical focus for their operations. They have a base in St Petersburg, the 2148th PsyOps group who target NATO, the US and the UK, as well as other European states. In the Russian far east there’s the 2040th PsyOps group targeting Japan and US military units. Then there’s the 2059th PsyOps group in Yekaterinburg, seeking to remove obstacles to Russian dominance in Central Asia. And that’s only the one’s we’ve managed to find out about… there are at least 3 more groups being managed by the GRU whose activities we are still investigating.

Online and offline

The 2148th group who target Western countries appear to carry out both online and in-person operations. They take to social media and start lighting digital fires about controversial domestic issues in those countries.

When it comes to offline operations, they often use proxy organizations to engage with people of interest to them. According to our sources, during the 2018 FIFA World Cup that was hosted in Russia, the 2148th group organized a targeted op on foreign fans. They used local proxies to hide the fact it was them, and seemed to be getting fans to wear a virtual reality headset, watch a video and take a survey. It’s not entirely clear what they were up to here with this bizarre performance (not unusual for them!), but it was possibly their way of researching new avenues for delivering their operations.

The 2148th also attempted to create similar unrest across Europe by spreading messages of an alleged rising of Nazism in Ukraine, and trying to ignite separatist tensions in the Baltic states.

What are they focused on?

Their 2040th Unit who focus on the East seem to be mostly concerned with Asia and have two goals: protect Russia’s claim on the Kuril Islands (which they claimed in 1945 at the end of WW2), and to increase opposition to US military presence in East Asia. Historically, we’ve seen them prod debates about the Japanese conduct during WW2 and started to incite fear around sexual violence that was allegedly committed by US marines. The Central Asian unit, 2059th, even drew up plans to discredit prominent politicians and pro-democracy NGOs operating in countries of interest (Kyrgyzstan and Tajikistan). The quality of their attempts wasn’t always polished like you might expect from such a large organization but they are driving a wedge into the splits in our societies.

Why does it matter?

Clearly, their Photoshop skills have a fair bit of room for improvement, and we can reveal more previously unknown and far more crude Russian campaigns as well, but the fact is these units are getting tasking from somewhere and while some of these operations are small attempts at spreading discord in countries Russia believes to be hostile, others are clearly strategically advantageous to Russia like Ukraine or North Stream oil project. These operations are clearly crude, but they reveal the breadth of the GRU’s ambitions and their casual attitude to interference. They reveal the GRU to be an unconstrained and unethical organization and we think the world should know.

We are an online collective that has formed to expose the activity of one of the most significant threats of our time: Russia. We come from several countries but the common thread is that each of our homelands has at some time been touched by “Russian malign influence”.

In the past couple of years, there has been a lot of news coverage about Russia’s malicious activity, but there is even more that Russia is doing and people don’t know about it.

As ‘nightingale’, we think the world should know about the things that Russia is doing in secret, from its interference in Ukraine, to ‘fake news’ and hacking.

For now, we want to keep our identities secret, if you keep following this page you’ll see why, but we’re going to be working with some friends of ours to make sure you get the most up to date and interesting stories that we can get our hands on. Watch our accounts so that you can find out straight away the stories Russia doesn’t want you to know.

If you have interesting information that you want to share then contact us @NightingaleRus1