The New York Times recently revealed that the secretive GRU Unit 29155 associated with the assassinations and sabotage “secretly offered bounties to Taliban-linked militants for killing coalition forces in Afghanistan – including targeting American troops” working via key middleman, Rahmatullah Azizi. It has long been suspected that the Russian government supports Taliban but this new story has shaken many. It means Unit 29155, previously described as “engaged in a campaign to destabilize Europe”, have stretch their influence into new regions of the world and have directly organized the deaths of US forces.
We remember that in 2016 two officers of Unit 29155 attempted to kill the Montenegrin prime minister and seized the parliament building. In Spain it is reported that the high-ranking GRU officer Denis Sergeyev traveled to Catalonia twice before 2017 independence referendum there. In 2015, they attempted to poison Bulgarian arms dealer Emilian Gebrev, apparently, they made two attempts one in Sofia and a month later at his home on the Black Sea. In March 2018 again two officers tried to poison former spy Sergei Skripal at his home in Great Britain.
This recent story is the first time that we have learnt about the activity of 29155 that takes place outside Europe’s borders. Sources have identified Rahmatullah Azizi as the middleman who distributed money, probably hundreds of thousands in US dollars, from the Unit 29155 to the Taliban-linked fighters to pay for the successful attacks on US forces. Azizi, originated from Northern Afghanistan, made regular trips to his homeland but has now probably returned to Russia. Azizi has been clearly linked to the financial side of this activity between Taliban and 29155 but new information reveals his extremely close links to the unit.
New passport information made available to nightingale has revealed that Azizi probably traveled using a passport with the number 654341494. Bellingcat’s investigation into the suspects behind the Skripal poisoning and investigations into Col. Eduard Shishmakov involved in the Montenegro coup revealed the cover-identity passports issued to 29155 for their travel all began with 65434. The fake passports Chepiga (alias Boshirov) used 654341294, Mishkin (alias Petrov) used 654341297 and Shishmakov (alias Shirakov) used 65434323. The fact that Azizi had access to such a passport proves that he was more than a simple middle man and was given the same privileges as GRU officers.
nightingale will keep looking into Azizi and activities in Afghanistan and we will return when we will know more.
nightingale can reveal details behind bumbling billionaire Konstantin Malofeev and his attempts to interfere with European politics. We investigate into his contacts in Europe and reveal the identity of Bellingcat’s mystery man “Yuri”.
There is no Russian separatism without Konstantin Malofeev, a name at the center of Russia’s annexation of Crimea and interference in Ukraine. In 2014 Malofeev was placed on a EU sanctions list for material support to the separatists in Eastern Ukraine. Since then Malofeev has been revealed as a central figure in similar failed insurgencies in Montenegro and Bulgaria. In Russia Malofeev has found himself at the center of a large number of failed businesses and the theft of $450m.
After multiple failed coups, businesses and backroom deals, you would think that the Kremlin might question their support of this reputational time-bomb. However, nightingale can exclusively reveal through our sources that Konstantin Malofeev is more active than ever setting his sites on the establishment of the EU that is trying to restrain him.
Should the EU be seeking to do more to stop or control Konstantin Malofeev and his activities? Why is Putin allowing Malofeev’s activities to continue and what does it say about Russia’s foreign policy goals?
nightingale takes a look in detail at who this man is and what his activities reveal…
The bumbling Billionaire
Malofeev, previously better known for his Orthodox activism, gained his vast wealth in Russia, during the early years of Putin’s presidency in finance and investment industry. From here Malofeev has branched out his business interests, with involvement globally in a range of businesses, many of which have seen countless problems and court cases.
After the sanctions Malofeev’s main investment firm Marshall Capital effectively ceased functioning. These days Malofeev has shifted focus and now uses the Tsargrad group to further his aims. According to one newspaper report, between 2013 and 2017 Malofeev’s companies recorded annual losses ranging from $7.6 to $25m. In 2012 his house and office were raided in connection with a case brought against Marshall Capital by the Russian state-bank VTB. The bank alleged it had provided a loan for a deal, in which Marshall Capital was involved as both the buyer and seller. This case was closed in 2015 when VTB agreed to an 83% discount on Malofeev’s debts and agreed to accept $100m payment.
This isn’t the only example of Malofeev’s questionable business practice. Another source of trouble for Malofeev in recent years has been repeated failed attempts to finance the purchase of a Bulgarian telecom company, Vivacom. A company linked to Malofeev, went on to make several costly unsuccessful attempts in court to declare the sale of the company null and void. This was an attempt to stop the sale to a company not controlled or owned by Malofeev.
In 2019, he was linked to the theft of $450m of cryptocurrency from the WEX cryptocurrency exchange. According to testimony from the administrator of the WEX, the FSB forced the handover of bitcoin wallets to them. According to police statements by the administrator of the WEX right before it collapsed, he was in talks with Malofeev who wanted to obtain the database of the WEX users and had previously negotiated a sale to Dmitri Kharchenko, a militia fighter in Eastern Ukraine, whose daughter is now the nomincal owner of the exchange. Audio recordings reportedly have Malofeev discussing the importance of bringing the exchange under the control of the Russian intelligence services.
Although Malofeev has lost the trust of cryptocurrency investors, he found investors for a new fund called the International Agency for Sovereign Development, who has recently signed deals with economically fragile, developing nations such as Niger, Guinea and the DRC. The fund sells itself as having the ability to attract investment into countries, which seems unlikely given Malofeev’s business record.
Not just a businessman
Malofeev doesn’t just have business problems but also political ones. Malofeev clearly has political ambitions inside Russia and his first attempt at getting political power was to announce his candidacy as a deputy for Smolensk Oblast in 2012. Despite being the winning candidate Malofeev was stuck off the ballot, when a Russian court decided he had been offering money for votes.
Outside Russia Malofeev has been more successful. HE is accused of facilitating a barrage of political interference. In the build up to the annexation of Crimea in 2014 Malofeev funded illegal armed groups, and liaised with his lieutenants on the ground. Further evidence of Malofeev’s involvement in Ukraine came when his assistant was caught sending a list of potential candidates to lead breakaway parts of the country to the office of Vladislav Surkov. Surkov was and is a Russian Presidential Aide. A criminal case was subsequently launched against Malofeev in Ukraine.
As a result of the growing case against Malofeev in Ukraine, it is believed that in late 2014 the Kremlin made a token gesture of restricting Malofeev’s geopolitical meddling to the Balkans. Even though countries in the Balkans like Serbia are supposed to be friends of Russia, so why would they need to use someone like Malofeev in these countries?
After this Malofeev was linked to political interference in Bosnia and Herzegovina for three hours before being expelled from the country. Bosnian press has linked Malofeev to the purchase of Republika Srpska bonds, in fact he tried to visit Milorad Dodik just 20 days before the transaction, which is when he was returned from the Banja Luka airport. In 2019 Nikolay Malinov a former Bulgarian lawmaker and head of the Bulgarian NGO, National Russophile Movement (NRO), was charged by Bulgarian authorities for spying for Russia. Prosecutors said Malinov was funded by Malofeev. Malinov wrote a secret report which talked of using Malofeev’s assistance to move Bulgaria towards Russia. As a result of this, Malofeev was banned from Bulgaria for 10 years.
According to online reports, Moscow tried to engineer a coup in Montenegro in 2016 to stop the country joining NATO. Malofeev was rumored to have been involved. Bellingcat research in March 2017 identified an email sent from Alexander Usovsky who had freelanced for Malofeev’s active measures campaign in 2014 and 2015. Usovsky proposed a new initiative in the email that would wash embarrassment from Malofeev’s name following the Montenegro failure. Malofeev was subsequently barred from entry into Montenegro which joined NATO in 2017. Another example of Malofeev’s best attempts giving absolutely no results.
Interference in Western Europe
Recently Malofeev’s interference seems to have spread to Western Europe. Our sources informed us that one key operative being used on the ground there is Mikhail Yakushev, who according to our research appears to have also worked for the Russian Ministry of Foreign Affairs. Yakushev has been seen linking up with European far-right groups such as the German Alternativ fur Deutschland (AfD), Freedom Party of Austria and the French Rally National. There have also been reports of Malofeev helping to facilitate two loans to Marine Le Pen’s party of two and nine million euros. One of the collaborators for one of Malofeev’s websites Katehon is in fact Marine Le Pen.
In 2019 Italian news outlet L’Espresso linked Malofeev’s oil company Avangard to the attempted funding of an Italian political party, La Liga. In Moscow in October 2018, four Russians and four Italians discussed a deal for an Italian political party to received Russian funding through an oil deal. Audio of this meeting leaked and one of the Italians present – Gianluca Savoini was heard saying the deal would mean that the Italians “can pay for a campaign”. This campaign is thought the be 2019 European parliamentary elections. Bellingcat identified all attendees of the meeting except one by the name of “Yuri”. nightingale have spoken to a source close to the deal who was able to provide more details on Yuri. At nightingale we believe that this is probably Yuri Burundukov. Avangard is a secretive organization and after the Bellingcat leaks a lot of information about them disappeared online, but we do know that Burundukov had an Avangard email address. Malofeev, as usual, was pulling the strings in the background, however his efforts were easily discovered and caused more embarrassment.
This October 2018 deal was the second deal after the first fell through, according to L’Espresso. The first also involved Avangard. Documents show that Avangard’s Director General Alexei Mustafinov, offered oil for sale to Savini in July 2018. Similar to Bulgaria, our sources have identified that Malofeev’s associates, including Yakushev, maintain contact with a number of Italian political actors even after this debacle. It could be that Yakushev and Malofeev still have intentions to interfere in Italy.
Malofeev in 2020 continues to take an interest in the German political scene, in particular AfD. Malofeev even commented to the french newspaper Le Figaro last year that he considers himself its Russian ambassador. Unsurprisingly there were numerous reported sightings last year of ex-AfD member Manuel Ochsenreiter at Malofeev’s Tsargrad hotel, with suggestions he was even living there.
Manuel Ochsenreiter
So what?
It has been and will always remain difficult to understand the intentions of Putin and Russian leadership. It seems that in Russia the oligarchs try and do what Putin wants even if he hasn’t told them what that is. If they fail, they deny ties to the Kremlin, the oligarchs, as in case of Bulgaria and Montenegro are lightly punished and given opportunity to try again. If there’s a success, like in Ukraine, the success is that of the Kremlin and Russia’s leadership not of the individual. Their one and only success in Ukraine has provided them with the motivations to continue to act in this way.
We have seen Malofeev use his business to promote Russian interests from inside the EU democratic system. He is helping to finance divisive, far-right nationalist groups in Europe for the benefit of Russia’s strategic policy and we have seen him attempt to acquire companies for the benefit of the Russian security and intelligence agencies. This seem to be a win-win for the Kremlin; however, Malofeev has provided more embarrassment than benefit. His failed coups hurt Russia’s reputation abroad and make it more difficult for Russia to do business. Malofeev sees himself as an ambassador but the world sees him as a bumbling billionaire regularly failing to carry out the Kremlin’s tasks.
We at night hope that the EU increases sanctions and scrutiny on Malofeev and his associates. Increased sanctions can and will help prevent destabilizing activity across EUrope, especially necessary at a time of global upheaval.
In the meantime, can Russia’s reputation really suffer the repeated mistakes of the self-appointed ambassador. nightingale will keep investigating and let you know.
On 14th April 2020, Major General Valery Shaytanov was arrested by the Security Service of Ukraine (SBU). Shaytanov was formerly head of the SBU’s special operations department, which is focused on counter-terrorism. He is alleged to have worked for Russia’s Federal Security Service (FSB) and has been charged with treason and terrorism. Shaytanov is accused of leaking secret information to Russia, recruiting other Ukrainian officers to work for the FSB and taking part in assassination plots.
According to the SBU, Shaytanov was recruited by Colonel Igor Egorov. It has been revealed that Egorov is a senior officer from FSB’s elite Spetznaz force known as Department V who received a medal for his role in annexing Crimea. Thanks to Bellingcat investigations, we now know that Egorov also went by the nom-de-guerre “Elbrus”, who described himself as an advisor to the LNR leadership. Commander “Elbrus” also arrived in occupied Eastern Ukraine days before the downing of MH17 – it is clear from the phone calls that Elbrus has a decision-making role in Donetsk and Luhansk, so his arrival just days before the tragic events of 17th July certainly leaves questions to be answered.
One of Shaytanov and Egorov’s target was Adam Osmayev. Osmayev was a fighter in the Chechen wars and former commander of the Chechen volunteer battalion on Ukraine’s side in the war in Eastern Ukraine. Osmayev has survived two other assassinations attempts in the pasts; however, his wife, an activist and also a veteran of the war in Eastern Ukraine, was killed on 30th October 2017, just ten kilometers outside Kyiv.
Adam Osmayev was not the only Chechen target of Egorov’s Department V. Bellingcat revealed in February that units from the department were involved in the extrajudicial killing of Zelimkhan Khangoshvili. In fact Colonel Egorov traveled back to Moscow on 23rd August 2019 just after the assassination of Khangoshvili.
The SBU published photos of a meet-up between Col. Egorov and the man hired to carry out the assassination in Hamburg, Germany. According to their press statement, Egorov, Shaytanov and the would-be assassin took place in Germany, France and Croatia.
Bellingcat provided a lot of details about the travel patterns of Egorov and it is clear that he was able to travel freely in Europe and beyond. In addition to this, he frequently traveled between Rostov, Simferopol and Krasnodar, three locations of control centers for military operations against Ukraine. The list of countries that Egorov visited is long: Germany, Jordan, Ukraine, Belarus, Croatia, Israel, Switzerland, Singapore, France, UAE, Montenegro. In December 2016, he received a multi-entry Schengen four-year visa. He used Germany for meetings to discuss assassinations, what he was doing in France and Croatia isn’t clear , but we would like to know. He also frequently traveled to Montenegro before the failed coup there in 2016.
Despite the serious nature of the story revealed by Bellingcat and SBU, this story has not reached very far. It is barely discussed outside of Ukraine, online nobody seems interested – we have to ask why.
This is a very complicated story with many twists and turns. It includes an Ukrainian double agent at the heart of the Ukrainian Secret Service. One man, Colonel Egorov of the FSB, appears to be linked to:
-The illegal annexation of Crimea by Russia -The MH17 tragedy and the war in occupied Eastern Ukraine -The attempted coup in Montenegro -One planned assassination in Germany (Osmayev) and possibly the assassination of Khangoshvili
And this is just what we know…
Maybe it doesn’t seem that surprising that Russia is spying on its neighbor in Ukraine, but Major General Shaytanov, if he did what he is accused of, will have passed information to the Russians which weakened his motherland. He will have passed information on what the Ukrainians were planning to do in their war with the Russian aggressor. His actions could have led to his compatriots deaths. The United Nations estimates that up to 13,000 Ukrainians have died in the war in Eastern Ukraine with a quarter of them estimated to be civilians.
Maybe the West doesn’t care about assassinations of Chechens even when these are planned and take place on their own soil. But this story is really very alarming, Russian Special Services operatives appear to have free reign at the moment. We know that Department V is involved in subversive operations including illegal reconnaissance, subversion, kidnappings, freeing hostages, coups d’etat and assassinations of enemies of the state. It is unbelievable to think that people involved in such kinds of things can go wherever they would like! Maybe now it feels like it affects only distant places which Western audiences don’t understand like Chechnya, Montenegro and Ukraine but the reports reveal that Russia sees Europe as a playground for its operations and who knows what countries or citizens might be the target next.
The November release from Bellingcat (‘The Dreadful Eight: GRU’s Unit 29155 and the poisoning of Emilian Gebrev’) contained evidence of a GRU operative that went by the name of ‘Georgy Gorshkov’. He was one of two GRU officers who travlled under cover to Bulgaria in April 2015, just days before Bulgarian national Emilian Gebrev fell seriously ill after being poisoned. He left the country just days after, along with his accomplice ‘Sergey Fedotov’.
Georgy Gorshkov – known in real life as Egor Aleksandrovich Gordienko Photo from Bellingcat
We can now reveal that ‘Georgy Gorshkov’ goes by the name of Egor Aleksandrovich Gordienko in real life. Our investigations uncovered that in 2017 he was posted as a Russian diplomat to the World Trade Organization in Geneva. Multiple sources, including people who recognized him from his time in Generva, confirmed that Gordienko is the man pictured as Gorshkov in the Bellingcat article. We found his name listed as an attache (3rd Secretary) to the WTO in 2017. We’ve also spoken to an individual who knew Gordienko as a keen runner. His name is indeed entered in two organized races in Geneva held in 2018. He took part in the 5km Men’s Run at the Antigel Run in January 2018 and it appears he was registered for the Course de l’Escalade but didn’t run it, it seems he had to leave Geneva suddenly. We don’t know why.
The fact that Russia is involved in delivering influence operations to their adversaries should be no surprise to anyone. More specifically, via the IRA or the Internet Research Agency. This is the name of the St Petersburg based Russian troll factory funded by Yevgeny Prigozhin. The agency continues to spread false information and disseminate social divisions through multiple Western-based social media platforms. Notably on Facebook, Twitter and Instagram.
Who is Yevgeny Prigozhin? You might know him by his nickname. Putins chef.
Prigozhin is one of the Kremlin’s inner circle. The true definition of an oligarch, with a palace in St Petersburg, a yacht, a private plane and a helipad. His company is believed to be a main backer of the IRA. He seems to have multiple links to the Kremlin, be that the IRA, or the PMC Wagner.
The IRA was based at 55 Savushkina Street, St Petersburg before it officially ceased operations in December 2016. However, it is apparent their work continues. “They have a lot of legal entities, and they still, I think, change it every year or every two years.”
Back in 2015 the employees of the IRA were aged between 20 and 30 but were drawn from a broad cross-section of Russian society. It seemed as if the agency’s task was so large that it would hire almost anyone who responded to the many ads it posted, no matter how under-educated or politically ignorant they were.
“Internet operators are required! Work in a chic office in OLGINO !!!! payment 25 960 per month. Objective: posting comments on specialized Internet sites, writing thematic posts, blogs, social networks. Screenshot reports. The work schedule is selected individually/ Payment is weekly, 1180 per shift (from 8.00-16.00, from 10.30-18.30m from 14.00-22.00) PAYMENTS WEEKLY AND FREE FOOD!!! Official and contractual employment (optional) Training is possible!”
During the last few years a large number of IRA employees has been named to the public. Most notable perhaps is Dzheykhun Nasimi Ogly Aslanov. Aslanov was named in a 2016 OFAC sanction which read “Aslanov acted for or on behalf of and provided material and technological support to the IRA. Aslanov acted as the head of the translator project, a department which focused on the United States and conducted operations on multiple social media platforms. He also oversaw many of the operations that targeted the 2016 U.S. election.”
The IRA’s involvement in 2016 US presidential elections is well known. This connection was widely and thoroughly discussed in the US Grand Jury indictment.
Additionally there are sanctions against Prigozhin and the IRA for their attempts to influence 2018 US midterm elections.
The IRA has been the center of a lot of attention recently. The most recent being in a report written by Graphika released in October.
The report was written because Facebook announced the take-down of 50 Instagram accounts posting about US social and political issues and 2020 election. These accounts claimed to represent multiple politically active US communities including black activist groups, advocates speaking out against police violence, police supporters, southern Confederates and supporters of Senator Bernie Sanders and President Donald Trump.
Facebook attributed IRACopyPasta to operators “originating from Russia” who showed “some links” to the IRA.
“Instagram was perhaps the most effective platform for the Internet Research Agency.”
But, what have the IRA been up to recently, where do their efforts lie?
We at ‘nightingale’ have identified that in September 2018, the IRA directed malign influence operations at Estonia. Their attack was three-fold. IT focused on the separatism of Narva, Nazis and fasicsm and Estexit.
Comments included; calls for NArva and the neighboring region of East Vironia to prepare to separate from Estonia, the growth of Nazi movements in Estonia and the effects this had on society, the EU being responsible for the economic problems in Estonia.
Another topic of discussion was placing the blame on the EU and NATO for the normalization of same-sex couples heading families. We have seen the IRA posting LGBT hate previously, so it’s not that surprising.
Why Africa?
Apparently their main interest at the moment is Africa. But why? Russian interest in Africa is a lot more widespread than the IRA. Russia have been making deals and spending money and making commitments all over Africa. Not including the numerous reports of the presence of Wagner mercenaries in Africa.
Putins interest in building Russia-Africa relations could stem from; Western sanctions against Russia, its unsuccessful pivot to China, hopes for billions of dollars in Middle East involvement which have not arrived in the quantities expected, the value of African votes at the United Nations.
There are also some very clear economic motives for Russian involvement in Africa. One being the diamond mining industry. Russia has a shortage of minerals such as manganese, bauxite and chromium, which Africa has in abundance.
“They’re collecting friends and allies, and they’re finding permissive environments to sell their wares and gain commercial opportunities.”
According to leaked documents, Russia is seeking to reinforce its existence in Africa by building relations with current rulers, striking military deals and grooming a new generation of “leaders” and undercover “agents”.
Activity online
On 30th October this year Facebook reportedly suspended three networks of Russian internet accounts aimed at covertly influencing events in several African countries. This list includes Madagascar, CAR, Mozambique, Democratic Republic of Congo, Ivory Coast, Cameroon, Sudan and Libya.
It is evident that Facebook are working hard to remove any suspicious accounts.
You can get banned on Facebook for being involved in rule breaking activities, some of which include: hate speech, credible threats or direct attacks on an individual or group, fake or impostor profiles and spam.
It is also against the Facebook community standards to maintain more than one personal account.
Bearing this in mind, how on earth do the vast majority of IRA accounts avoid detection on Facebook and Instagram?
Well, you could speculate forever with how their infrastructure works, but apparently you can avoid detection on Facebook by following these simple techniques when it comes to adding friends.
1) Manually add no more than 15 friends in a 24-hour period, 2) Cancel any friend requests which are left unanswered within a 24-hour period, 3) Do not send friends requests to every page visited
Last time we told you about GRU officer Sergei Parubin who is currently working in Belgrade, alongside Georgiy Kleban. We’ve been looking closely at Parubin and he seems particularly interesting to us. According to what we’ve been able to find, it seems that Parubin has a long history in the Balkan region not just Belgrade, previously serving in Zagreb, Croatia up to 2015. This isn’t even his first time in Belgrade, he was previously there in the early 2000s up to 2009. The GRU seem to rotate their military attaches and assistants throughout Russian embassies across the Balkan capitals, keeping them in the area for years. This is not normal behavior in other parts of Europe but seems to be here.
It’s probably much easier for GRU officers to stay in the same region for a long time, especially somewhere like the Balkans where people cross over into a neighboring country all the time to see family and friends. If you were for example a GRU officer, named Sergei Parubin, then you would be able to move around between countries easily with the perfect excuse of visiting some “friends” and if those friends just happened to be people you were paying to give you secret information…even better! It also means you don’t have to pass your agents off to someone new which is probably quite hard to do. New people might make mistakes and then get caught and all your hard work would go to waste or your agent might not get on with someone new… what happens if they bring the wrong type of Vodka? Not a problem for the GRU! They have been able to keep people like Parubin in the region for so long, they don’t need to take any extra risk and can carry on with whatever they’re up to as if nothing had changed!
And this is exactly what is being shown in the recent video that was leaked involving Parubin’s colleague Kleban. A GRU Officer with his Balkan friend… exchanging data for money (and the obligatory bottle of Vodka). Even more worrying is the fact that it is being done so casually. So openly. There are no dark alleyways or hidden meeting areas. No secret spy-like meeting point in the corner of a park or behind an abandoned building. It’s just two guys brazenly, though somewhat hurriedly, exchanging their goods at a bar over a nice beer. Well, we assume it’s a nice beer… and we assume it was a nice bottle of vodka!
As the latest spy game shows, the GRU don’t always slip under the radar though. Earlier this month a GRU officer, Vladimir Rusyaev, was declared a “Persona Non Grata” (PNG) in Bulgaria and expelled from the country for running a network of spies! https://www.icrazemagazine.com/news/nato-ally-expels-undercover-russian-spy/69631/
Numbers at the Russian Embassy in Belgrade are constantly on the rise. It is the largest in the region and more and more of this number are made up of intelligence officers. More officers like Kleban’s friend Sergei Parubin. What exactly is this guy’s role in everything? We’ll be investigating him further… and we invite you to do the same.
So…what is going on in Serbia?
Understandably the reaction in Serbia has been one of alarm. President Vucic said in a press conference after a National Security Council that some actions will be taken against foreign intelligence services that would be publicly visible.
We look forward to seeing the results of this action and wonder whether Sergei Parubin will be affected by these actions. If he does leave Serbia, it will be interesting to see whether he eventually reappears in another Balkan country… meaning he won’t really have left Serbia at all.
The question remains as to the motives of the GRU’s increased activities in Belgrade. President Vucic said that his only question for President Putin was “Why?” and we have the very same question. Is this part of an increasing malign campaign by the Russian government in the Balkans? Or are we looking at the early stages of another coup attempt? We’re looking for the answers and we will be back soon.
Last week a video was anonymously leaked online and claimed to show a GRU officer, who was named in the leak as Colonel Kleban, paying off members of the Serbian military in Belgrade. ‘nightingale’ were able to identify images of Kleban online in his full military regalia and think it’s clearly the same person, but if that’s not enough, Bellingcat think so too: https://twitter.com/christogrozev/status/1196183790831443971. And if that wasn’t enough, even the Serbian security services have since publicly confirmed that the video is genuine and Kleban is a GRU officer.
So… who is this Kleban guy? Kleban has been Deputy Defense Attache to Serbia since October 2015, but his recent 15 minutes of fame are a small drop in the ocean of Russian operations against the countries of the Western Balkans. In October 2016, the GRU organized, financed and facilitated an attempted coup in Montenegro. We previously shared with you some details of GRU operations and their use of local proxies and this was no different. The GRU used 10 Serbian gang members and Montenegrin opposition politicians to do their dirty work.
A recent New York Times article tied this attempted Coup to the secret GRU unit 29155, headed up by Major-General Andrei Averyanov. 29155 being the same unit responsible for the 2018 Salisbury nerve agent attack. Bellingcat did some further research on this secret unit and its Commander which can be found here: https://www.bellingcat.com/news/uk-and-europe/2019/10/14/averyanov-chepiga/
Two GRU officers from unit 29155 were tried “in absentia” and sentenced following the attempted coup: Eduard Shishmakov and Vladimir Popov, both charged with terrorism and criminal conspiracy. They were sentenced to 15 and 12 years respectively. Bellingcat subsequently revealed the true identity of Popov as Vladimir Moiseev. Among this trial, which was the largest in Montenegrin history, a former Serbian Gendarmerie Commander (Bratislav Dikic) was also charged with terrorism and sentenced to 8 years. This is, we believe, the first time two serving GRU officers have been sentenced under these charges in a NATO country. Go Montenegro!
But Kleban and Shishmakov are not the only Russian GRU officers present in the Balkans. ‘nightingale’ can exclusively reveal that Kleban is also closely associated with another GRU officer in Belgrade: Colonel Sergei Vladimirovich Parubin, who is currently listed as the Assistant Military Attache in Belgrade. Here they are both seen attending an event at the school at the Embassy of Russia in Serbia.
‘nightingale’ have been looking at GRU activity in the Balkans for a while now and this Parubin guy seems really interesting to us. We’ll be back soon when we’ve done some more research on him and can share more details with you.
The GRU? GR-Who? Well they know who you are so perhaps you should pay attention.
The GRU (Glavnoye Razvedyvalte’noye Upravleniye) recently became notorious for a series of attacks against Russia’s adversaries. They hacked the Democratic National Committee emails in 2016, they spearheaded Russian intervention in Ukraine, and they carried out a nerve-agent attack in Britain.
The Washington Post previously revealed that the GRU was at the “forefront of Russia’s psychological warfare efforts”. Now, however, new leaked documents made available to ‘nightingale’ have shed light on a number of other influence operations conducted by the GRU, and we can reveal today a range of other operations they’ve conducted – new topics and new targets of GRU interference.
While those involved in these operations may be spread across Russia, according to our sources they are all managed by GRU Unit 54777, or the “72nd Special Service Center”.
East and West
Every section of Unit 54777 appears to have specific geographical focus for their operations. They have a base in St Petersburg, the 2148th PsyOps group who target NATO, the US and the UK, as well as other European states. In the Russian far east there’s the 2040th PsyOps group targeting Japan and US military units. Then there’s the 2059th PsyOps group in Yekaterinburg, seeking to remove obstacles to Russian dominance in Central Asia. And that’s only the one’s we’ve managed to find out about… there are at least 3 more groups being managed by the GRU whose activities we are still investigating.
Online and offline
The 2148th group who target Western countries appear to carry out both online and in-person operations. They take to social media and start lighting digital fires about controversial domestic issues in those countries.
When it comes to offline operations, they often use proxy organizations to engage with people of interest to them. According to our sources, during the 2018 FIFA World Cup that was hosted in Russia, the 2148th group organized a targeted op on foreign fans. They used local proxies to hide the fact it was them, and seemed to be getting fans to wear a virtual reality headset, watch a video and take a survey. It’s not entirely clear what they were up to here with this bizarre performance (not unusual for them!), but it was possibly their way of researching new avenues for delivering their operations.
The 2148th also attempted to create similar unrest across Europe by spreading messages of an alleged rising of Nazism in Ukraine, and trying to ignite separatist tensions in the Baltic states.
What are they focused on?
Their 2040th Unit who focus on the East seem to be mostly concerned with Asia and have two goals: protect Russia’s claim on the Kuril Islands (which they claimed in 1945 at the end of WW2), and to increase opposition to US military presence in East Asia. Historically, we’ve seen them prod debates about the Japanese conduct during WW2 and started to incite fear around sexual violence that was allegedly committed by US marines. The Central Asian unit, 2059th, even drew up plans to discredit prominent politicians and pro-democracy NGOs operating in countries of interest (Kyrgyzstan and Tajikistan). The quality of their attempts wasn’t always polished like you might expect from such a large organization but they are driving a wedge into the splits in our societies.
Why does it matter?
Clearly, their Photoshop skills have a fair bit of room for improvement, and we can reveal more previously unknown and far more crude Russian campaigns as well, but the fact is these units are getting tasking from somewhere and while some of these operations are small attempts at spreading discord in countries Russia believes to be hostile, others are clearly strategically advantageous to Russia like Ukraine or North Stream oil project. These operations are clearly crude, but they reveal the breadth of the GRU’s ambitions and their casual attitude to interference. They reveal the GRU to be an unconstrained and unethical organization and we think the world should know.
We are an online collective that has formed to expose the activity of one of the most significant threats of our time: Russia. We come from several countries but the common thread is that each of our homelands has at some time been touched by “Russian malign influence”.
In the past couple of years, there has been a lot of news coverage about Russia’s malicious activity, but there is even more that Russia is doing and people don’t know about it.
As ‘nightingale’, we think the world should know about the things that Russia is doing in secret, from its interference in Ukraine, to ‘fake news’ and hacking.
For now, we want to keep our identities secret, if you keep following this page you’ll see why, but we’re going to be working with some friends of ours to make sure you get the most up to date and interesting stories that we can get our hands on. Watch our accounts so that you can find out straight away the stories Russia doesn’t want you to know.
If you have interesting information that you want to share then contact us @NightingaleRus1
