Last week a video was anonymously leaked online and claimed to show a GRU officer, who was named in the leak as Colonel Kleban, paying off members of the Serbian military in Belgrade. ‘nightingale’ were able to identify images of Kleban online in his full military regalia and think it’s clearly the same person, but if that’s not enough, Bellingcat think so too: https://twitter.com/christogrozev/status/1196183790831443971. And if that wasn’t enough, even the Serbian security services have since publicly confirmed that the video is genuine and Kleban is a GRU officer.

So… who is this Kleban guy? Kleban has been Deputy Defense Attache to Serbia since October 2015, but his recent 15 minutes of fame are a small drop in the ocean of Russian operations against the countries of the Western Balkans. In October 2016, the GRU organized, financed and facilitated an attempted coup in Montenegro. We previously shared with you some details of GRU operations and their use of local proxies and this was no different. The GRU used 10 Serbian gang members and Montenegrin opposition politicians to do their dirty work.

A recent New York Times article tied this attempted Coup to the secret GRU unit 29155, headed up by Major-General Andrei Averyanov. 29155 being the same unit responsible for the 2018 Salisbury nerve agent attack. Bellingcat did some further research on this secret unit and its Commander which can be found here: https://www.bellingcat.com/news/uk-and-europe/2019/10/14/averyanov-chepiga/

Two GRU officers from unit 29155 were tried “in absentia” and sentenced following the attempted coup: Eduard Shishmakov and Vladimir Popov, both charged with terrorism and criminal conspiracy. They were sentenced to 15 and 12 years respectively. Bellingcat subsequently revealed the true identity of Popov as Vladimir Moiseev. Among this trial, which was the largest in Montenegrin history, a former Serbian Gendarmerie Commander (Bratislav Dikic) was also charged with terrorism and sentenced to 8 years. This is, we believe, the first time two serving GRU officers have been sentenced under these charges in a NATO country. Go Montenegro!

But Kleban and Shishmakov are not the only Russian GRU officers present in the Balkans. ‘nightingale’ can exclusively reveal that Kleban is also closely associated with another GRU officer in Belgrade: Colonel Sergei Vladimirovich Parubin, who is currently listed as the Assistant Military Attache in Belgrade. Here they are both seen attending an event at the school at the Embassy of Russia in Serbia.

‘nightingale’ have been looking at GRU activity in the Balkans for a while now and this Parubin guy seems really interesting to us. We’ll be back soon when we’ve done some more research on him and can share more details with you.

The GRU (Glavnoye Razvedyvalte’noye Upravleniye) recently became notorious for a series of attacks against Russia’s adversaries. They hacked the Democratic National Committee emails in 2016, they spearheaded Russian intervention in Ukraine, and they carried out a nerve-agent attack in Britain.

The Washington Post previously revealed that the GRU was at the “forefront of Russia’s psychological warfare efforts”. Now, however, new leaked documents made available to ‘nightingale’ have shed light on a number of other influence operations conducted by the GRU, and we can reveal today a range of other operations they’ve conducted – new topics and new targets of GRU interference.

While those involved in these operations may be spread across Russia, according to our sources they are all managed by GRU Unit 54777, or the “72nd Special Service Center”.

East and West

Every section of Unit 54777 appears to have specific geographical focus for their operations. They have a base in St Petersburg, the 2148th PsyOps group who target NATO, the US and the UK, as well as other European states. In the Russian far east there’s the 2040th PsyOps group targeting Japan and US military units. Then there’s the 2059th PsyOps group in Yekaterinburg, seeking to remove obstacles to Russian dominance in Central Asia. And that’s only the one’s we’ve managed to find out about… there are at least 3 more groups being managed by the GRU whose activities we are still investigating.

Online and offline

The 2148th group who target Western countries appear to carry out both online and in-person operations. They take to social media and start lighting digital fires about controversial domestic issues in those countries.

When it comes to offline operations, they often use proxy organizations to engage with people of interest to them. According to our sources, during the 2018 FIFA World Cup that was hosted in Russia, the 2148th group organized a targeted op on foreign fans. They used local proxies to hide the fact it was them, and seemed to be getting fans to wear a virtual reality headset, watch a video and take a survey. It’s not entirely clear what they were up to here with this bizarre performance (not unusual for them!), but it was possibly their way of researching new avenues for delivering their operations.

The 2148th also attempted to create similar unrest across Europe by spreading messages of an alleged rising of Nazism in Ukraine, and trying to ignite separatist tensions in the Baltic states.

What are they focused on?

Their 2040th Unit who focus on the East seem to be mostly concerned with Asia and have two goals: protect Russia’s claim on the Kuril Islands (which they claimed in 1945 at the end of WW2), and to increase opposition to US military presence in East Asia. Historically, we’ve seen them prod debates about the Japanese conduct during WW2 and started to incite fear around sexual violence that was allegedly committed by US marines. The Central Asian unit, 2059th, even drew up plans to discredit prominent politicians and pro-democracy NGOs operating in countries of interest (Kyrgyzstan and Tajikistan). The quality of their attempts wasn’t always polished like you might expect from such a large organization but they are driving a wedge into the splits in our societies.

Why does it matter?

Clearly, their Photoshop skills have a fair bit of room for improvement, and we can reveal more previously unknown and far more crude Russian campaigns as well, but the fact is these units are getting tasking from somewhere and while some of these operations are small attempts at spreading discord in countries Russia believes to be hostile, others are clearly strategically advantageous to Russia like Ukraine or North Stream oil project. These operations are clearly crude, but they reveal the breadth of the GRU’s ambitions and their casual attitude to interference. They reveal the GRU to be an unconstrained and unethical organization and we think the world should know.

We are an online collective that has formed to expose the activity of one of the most significant threats of our time: Russia. We come from several countries but the common thread is that each of our homelands has at some time been touched by “Russian malign influence”.

In the past couple of years, there has been a lot of news coverage about Russia’s malicious activity, but there is even more that Russia is doing and people don’t know about it.

As ‘nightingale’, we think the world should know about the things that Russia is doing in secret, from its interference in Ukraine, to ‘fake news’ and hacking.

For now, we want to keep our identities secret, if you keep following this page you’ll see why, but we’re going to be working with some friends of ours to make sure you get the most up to date and interesting stories that we can get our hands on. Watch our accounts so that you can find out straight away the stories Russia doesn’t want you to know.

If you have interesting information that you want to share then contact us @NightingaleRus1