It has been just over six years since Malaysia Airlines flight MH17 was downed over eastern Ukraine with the loss of all 298 people onboard. In May 2018, the Dutch-led joint investigation team (JIT) concluded that the Buk missile system which was used to shoot it down belonged to the 53rd Anti-Aircraft Missile Brigade, based in the Russian city of Kursk. Subsequently, it came to light that many of the individuals involved in arranging its deployment to Ukraine were senior officers in the Russian Ministry of Defense and the GRU. In spite of this, the Kremlin has always denied any involvement in the tragedy, predictably dismissing the accusations as Russo-phobia. In fact, it has not only refused to accept any responsibility for the event, it has lied over and over again about its role in the tragedy and, together with the GRU, has used various tactics to deliberately thwart the JITs investigation. You might think that, all these years later and faced with irrefutable proof, Russia would have given in and admitted its guilt, but, in this article, we will reveal new evidence which shows that Moscow is still waging a pointless and unedifying MH17 information war in 2020 – a war that not only is it not winning, but it does not appear to realize is over.
The background
In June 2019, the JIT announced that four suspects were to be charged with murder in connection with the downing of MH17. It named the men as Igor Girkin (also known as Strelkov), Sergei Dubinsky and Oleg Pulatov from Russia, and Leonid Kharchenko from Ukraine. According to the JIT, Girkin is a former FSB colonel and was the Minister of Defense in the so-called Donetsk Peoples Republic (DNR) when MH17 was shot down. Dubinsky is an ex-GRU officer; he was Girkins deputy and the head of the DNRs military intelligence service (GRU DNR not to be confused with Russias GRU) at the time. Pulatov, a former GRU special forces soldier, was Dubinskys deputy, and Kharchenko was the commander of a combat unit in eastern Ukraine.
Simultaneously, the investigative collective Bellingcat published a report identifying individuals who were heard speaking or were mentioned on intercepted telephone calls which were released by the JIT and the Ukrainian Secret Service (SBU) following the tragedy. Two of these men, Igor Bezler and Sergei Povalyaev, were thought to be GRU officers. The same report assessed that the GRU DNR was responsible for procuring the Buk missile launcher and coordinating its movement from Russia to Ukraine and back. While the GRU DNR claimed to be independent from Moscow, it has been alleged that it was in fact controlled at least in part, and possibly entirely, by the Russian GRU. Previously, in May 2018, Bellingcat had exposed the identity of a person of interest to the JIT as being Oleg Ivannikov, a GRU commander who was also involved in arranging the delivery of the missile system to separatist-held territory. As you can imagine, given its deep involvement in the incident, the GRU has been desperately trying to cover its tracks and, as usual, it hasn’t been very subtle about it.
Hacking operations
In 2015, the Dutch Safety Board (OVV), which had been investigating the source of the crash, published its findings in a detailed report. Both before and after the report was released, the OVV was targeted by the hacker group known as APT28 or Fancy Bear, which is made up of GRU Unit 26165 officers. The same group attempted to hack one of the OVVs partners in the MH17 investigation and also targeted Bellingcat journalists.
In 2018, Dutch authorities foiled an attempt made by four members of APT28 to carry out a close access operation against the Wi-Fi network of the Organization for the Prevention of Chemical Weapons (OPCW) in The Hague. At the time, the OPCW was investigating the poisoning of Sergei Skripal in the UK. The individuals, who were named as Alexei Morenets, Yevgeny Serebriakov, Oleg Sotnikov and Alexei Minin, were intercepted and their equipment seized. Serebriakovs laptop showed that, in 2017, he and his colleagues had traveled to Malaysia to carry out hacking operations against the Malaysian police, the attorney generals office and the MH17 investigation.
The device was also found to have been used in Brazil and Switzerland, and it is thought that the team traveled to these countries in order to target international anti-doping organizations and officials in retaliation for Russias state-sponsored athlete doping program having been exposed. This round-the-world tour resulted in the famous Fancy Bears Twitter account and website leaking athletes confidential records. The GRU officers were not just obtaining information, but using it aggressively as a disinformation weapon: exactly the sort of tactic used against the MH17 investigation. An example of this is the leaking of an Australian Federal Police (AFP) report concerning MH17. The GRU are believed to have hacked the AFP as, in February of this year, selected sections of the document, in which police officers debated whether images of the Buk missile system used to shoot down MH17 had been manipulated, appeared on a Russian-linked website. Other areas of the report, in which the officers confirmed the authenticity of the pictures, were not published.
Disinformation campaign
Alongside the operations mentioned above, Russia used pro-Kremlin media outlets and social media platforms to spread MH17 conspiracy theories and sow seeds of mistrust against the West and the Ukrainian government. According to Kharkiv Human Rights Protection Group, within the first two days after the downing of the plane, Russian internet trolls had posted at least 65,000 tweets trying to blame Ukraine for the disaster. Although that particular Twitter operation did not maintain its pace, the disinformation campaign as a whole certainly did, constantly pushing out new narratives surrounding MH17, each one as ludicrous as the last. The EU DisinfoLab info-graphic below illustrates the incredible scale of the operation.
Given the renewed interest in the MH17 tragedy since the trial began in March this year, and the likelihood of the GRU ramping up its disruption efforts accordingly, we decided to dig a little deeper into this particular area of GRU disinformation operations.
Unsurprisingly, we discovered that news items relating to MH17 were a common theme shared between known platforms with links to Russian intelligence. In the course of our research, we noticed that one particular story concerning MH17 was mentioned across a selection of them. The website observateurcontinental.fr, which was recently exposed by EU DisinfoLab as being linked to InfoRos (see our previous article for more on this GRU front company https://nightingalerussia.com/?p=227), featured an article entitled, Malaysia Rejects the Accusations Made Against Russia, which referred to a speech made in 2019 by the Malaysian prime minister, Mahathir Mohamad, in which he appeared to call into question the JITs assertion that Russia was to blame for the incident, and instead suggested that Ukraine could be responsible. Anti-spiegel.ru, a website run by Thomas Röper (who you may remember writes for InfoRos), globalresearch.ca, which regularly amplifies GRU propaganda, and InfoRos itself, all published articles along the same lines which specifically cited the part of Mohamads speech in which he said that Ukraine could equally as likely be behind the attack as Russia. The story was also run by another website which you might not be familiar with:
Mh17-files.com, to anyone who gives it more than a brief glance, has all the hallmarks of a GRU information operation. The sites content consists of articles and opinion pieces which portray Russia as the injured party who has been wrongly accused, and try to shift the blame for the MH17 disaster onto Ukraine: views that are entirely aligned with those of the GRU.
A simple WHOIS lookup shows that the site was registered on 31st January 2020 by a suitably obfuscated ProtonMail user, a practice which is consistent with the GRU modus operandi. In addition to this, ThreatConnect threat intelligence researcher Kyle Ehmke has previously flagged the site as being suspicious.
During our investigation, sources told us that mh17-files.com was a disinformation website run by Unit 54777. One stated that everything about it was consistent with 54777 operations and it had similarities to unit 26165 and 74455 operations. You will probably be familiar with Unit 54777 from our previous articles.
On the balance of evidence detailed in this article, we have concluded that there is no plausible explanation for this website other than that it is a GRU disinformation operation run by Unit 54777, maybe in collaboration with other parts of the GRU like 26165 and 74455. We cant help but think that its just the sort of place that the ill-gotten gains of APT28s hacking operations in Malaysia might be published in the future.
What has Russia actually achieved?
It is obvious that the Kremlin has invested a lot of time and effort into trying to cover up its role in the MH17 disaster – but to what end? The large-scale disinformation campaign and the attempts to disrupt the JITs investigation have been easily attributed to Russia and the GRU, and so, ultimately, all they have succeeded in doing is causing further damage to their already tarnished reputations. And yet, they persist in their futile quest to cover up their involvement in the tragedy. MH17-files.com is evidence of how desperate the GRU has become; it is a flimsy facade which is fooling nobody. It shows that they chose the wrong path when they refused to admit responsibility their lies have become more and more hollow, to the point where you have to wonder whether even they believe it anymore. One thing is for certain: in spite of the volume of noise that has been thrown at this, and the man hours that have been wasted in Moscow and in the GRU over the past six years, justice will be served. Russia will not be able to stop the MH17 trial, and the inevitable guilty verdict will be delivered. In the meantime, we will continue to seek out other disinformation platforms like mh17-files.com and bring them to your attention.
