On 14th April 2020, Major General Valery Shaytanov was arrested by the Security Service of Ukraine (SBU). Shaytanov was formerly head of the SBU’s special operations department, which is focused on counter-terrorism. He is alleged to have worked for Russia’s Federal Security Service (FSB) and has been charged with treason and terrorism. Shaytanov is accused of leaking secret information to Russia, recruiting other Ukrainian officers to work for the FSB and taking part in assassination plots.

According to the SBU, Shaytanov was recruited by Colonel Igor Egorov. It has been revealed that Egorov is a senior officer from FSB’s elite Spetznaz force known as Department V who received a medal for his role in annexing Crimea. Thanks to Bellingcat investigations, we now know that Egorov also went by the nom-de-guerre “Elbrus”, who described himself as an advisor to the LNR leadership. Commander “Elbrus” also arrived in occupied Eastern Ukraine days before the downing of MH17 – it is clear from the phone calls that Elbrus has a decision-making role in Donetsk and Luhansk, so his arrival just days before the tragic events of 17th July certainly leaves questions to be answered.

One of Shaytanov and Egorov’s target was Adam Osmayev. Osmayev was a fighter in the Chechen wars and former commander of the Chechen volunteer battalion on Ukraine’s side in the war in Eastern Ukraine. Osmayev has survived two other assassinations attempts in the pasts; however, his wife, an activist and also a veteran of the war in Eastern Ukraine, was killed on 30th October 2017, just ten kilometers outside Kyiv.

Adam Osmayev was not the only Chechen target of Egorov’s Department V. Bellingcat revealed in February that units from the department were involved in the extrajudicial killing of Zelimkhan Khangoshvili. In fact Colonel Egorov traveled back to Moscow on 23rd August 2019 just after the assassination of Khangoshvili.

The SBU published photos of a meet-up between Col. Egorov and the man hired to carry out the assassination in Hamburg, Germany. According to their press statement, Egorov, Shaytanov and the would-be assassin took place in Germany, France and Croatia.

Bellingcat provided a lot of details about the travel patterns of Egorov and it is clear that he was able to travel freely in Europe and beyond. In addition to this, he frequently traveled between Rostov, Simferopol and Krasnodar, three locations of control centers for military operations against Ukraine. The list of countries that Egorov visited is long: Germany, Jordan, Ukraine, Belarus, Croatia, Israel, Switzerland, Singapore, France, UAE, Montenegro. In December 2016, he received a multi-entry Schengen four-year visa. He used Germany for meetings to discuss assassinations, what he was doing in France and Croatia isn’t clear , but we would like to know. He also frequently traveled to Montenegro before the failed coup there in 2016.

Despite the serious nature of the story revealed by Bellingcat and SBU, this story has not reached very far. It is barely discussed outside of Ukraine, online nobody seems interested – we have to ask why.

This is a very complicated story with many twists and turns. It includes an Ukrainian double agent at the heart of the Ukrainian Secret Service. One man, Colonel Egorov of the FSB, appears to be linked to:

-The illegal annexation of Crimea by Russia
-The MH17 tragedy and the war in occupied Eastern Ukraine
-The attempted coup in Montenegro
-One planned assassination in Germany (Osmayev) and possibly the assassination of Khangoshvili

And this is just what we know…

Maybe it doesn’t seem that surprising that Russia is spying on its neighbor in Ukraine, but Major General Shaytanov, if he did what he is accused of, will have passed information to the Russians which weakened his motherland. He will have passed information on what the Ukrainians were planning to do in their war with the Russian aggressor. His actions could have led to his compatriots deaths. The United Nations estimates that up to 13,000 Ukrainians have died in the war in Eastern Ukraine with a quarter of them estimated to be civilians.

Maybe the West doesn’t care about assassinations of Chechens even when these are planned and take place on their own soil. But this story is really very alarming, Russian Special Services operatives appear to have free reign at the moment. We know that Department V is involved in subversive operations including illegal reconnaissance, subversion, kidnappings, freeing hostages, coups d’etat and assassinations of enemies of the state. It is unbelievable to think that people involved in such kinds of things can go wherever they would like! Maybe now it feels like it affects only distant places which Western audiences don’t understand like Chechnya, Montenegro and Ukraine but the reports reveal that Russia sees Europe as a playground for its operations and who knows what countries or citizens might be the target next.

The November release from Bellingcat (‘The Dreadful Eight: GRU’s Unit 29155 and the poisoning of Emilian Gebrev’) contained evidence of a GRU operative that went by the name of ‘Georgy Gorshkov’. He was one of two GRU officers who travlled under cover to Bulgaria in April 2015, just days before Bulgarian national Emilian Gebrev fell seriously ill after being poisoned. He left the country just days after, along with his accomplice ‘Sergey Fedotov’.

https://017qndpynh-flywheel.netdna-ssl.com/wp-content/uploads/2019/11/gorshkov_sharp.png

We can now reveal that ‘Georgy Gorshkov’ goes by the name of Egor Aleksandrovich Gordienko in real life. Our investigations uncovered that in 2017 he was posted as a Russian diplomat to the World Trade Organization in Geneva. Multiple sources, including people who recognized him from his time in Generva, confirmed that Gordienko is the man pictured as Gorshkov in the Bellingcat article. We found his name listed as an attache (3rd Secretary) to the WTO in 2017. We’ve also spoken to an individual who knew Gordienko as a keen runner. His name is indeed entered in two organized races in Geneva held in 2018. He took part in the 5km Men’s Run at the Antigel Run in January 2018 and it appears he was registered for the Course de l’Escalade but didn’t run it, it seems he had to leave Geneva suddenly. We don’t know why.

What were unit 29155 trying to do that required a would-be assassin being posted to the WTO?

The fact that Russia is involved in delivering influence operations to their adversaries should be no surprise to anyone. More specifically, via the IRA or the Internet Research Agency. This is the name of the St Petersburg based Russian troll factory funded by Yevgeny Prigozhin. The agency continues to spread false information and disseminate social divisions through multiple Western-based social media platforms. Notably on Facebook, Twitter and Instagram.

Who is Yevgeny Prigozhin? You might know him by his nickname. Putins chef.

Prigozhin is one of the Kremlin’s inner circle. The true definition of an oligarch, with a palace in St Petersburg, a yacht, a private plane and a helipad. His company is believed to be a main backer of the IRA. He seems to have multiple links to the Kremlin, be that the IRA, or the PMC Wagner.

The IRA was based at 55 Savushkina Street, St Petersburg before it officially ceased operations in December 2016. However, it is apparent their work continues. “They have a lot of legal entities, and they still, I think, change it every year or every two years.”

Back in 2015 the employees of the IRA were aged between 20 and 30 but were drawn from a broad cross-section of Russian society. It seemed as if the agency’s task was so large that it would hire almost anyone who responded to the many ads it posted, no matter how under-educated or politically ignorant they were.

“Internet operators are required! Work in a chic office in OLGINO !!!! payment 25 960 per month. Objective: posting comments on specialized Internet sites, writing thematic posts, blogs, social networks. Screenshot reports. The work schedule is selected individually/ Payment is weekly, 1180 per shift (from 8.00-16.00, from 10.30-18.30m from 14.00-22.00) PAYMENTS WEEKLY AND FREE FOOD!!! Official and contractual employment (optional) Training is possible!”

During the last few years a large number of IRA employees has been named to the public. Most notable perhaps is Dzheykhun Nasimi Ogly Aslanov. Aslanov was named in a 2016 OFAC sanction which read “Aslanov acted for or on behalf of and provided material and technological support to the IRA. Aslanov acted as the head of the translator project, a department which focused on the United States and conducted operations on multiple social media platforms. He also oversaw many of the operations that targeted the 2016 U.S. election.”

The IRA’s involvement in 2016 US presidential elections is well known. This connection was widely and thoroughly discussed in the US Grand Jury indictment.

Additionally there are sanctions against Prigozhin and the IRA for their attempts to influence 2018 US midterm elections.

The IRA has been the center of a lot of attention recently. The most recent being in a report written by Graphika released in October.

The report was written because Facebook announced the take-down of 50 Instagram accounts posting about US social and political issues and 2020 election. These accounts claimed to represent multiple politically active US communities including black activist groups, advocates speaking out against police violence, police supporters, southern Confederates and supporters of Senator Bernie Sanders and President Donald Trump.

Facebook attributed IRACopyPasta to operators “originating from Russia” who showed “some links” to the IRA.

“Instagram was perhaps the most effective platform for the Internet Research Agency.”

But, what have the IRA been up to recently, where do their efforts lie?

We at ‘nightingale’ have identified that in September 2018, the IRA directed malign influence operations at Estonia. Their attack was three-fold. IT focused on the separatism of Narva, Nazis and fasicsm and Estexit.

Comments included; calls for NArva and the neighboring region of East Vironia to prepare to separate from Estonia, the growth of Nazi movements in Estonia and the effects this had on society, the EU being responsible for the economic problems in Estonia.

Another topic of discussion was placing the blame on the EU and NATO for the normalization of same-sex couples heading families. We have seen the IRA posting LGBT hate previously, so it’s not that surprising.

Why Africa?

Apparently their main interest at the moment is Africa. But why? Russian interest in Africa is a lot more widespread than the IRA. Russia have been making deals and spending money and making commitments all over Africa. Not including the numerous reports of the presence of Wagner mercenaries in Africa.

Putins interest in building Russia-Africa relations could stem from; Western sanctions against Russia, its unsuccessful pivot to China, hopes for billions of dollars in Middle East involvement which have not arrived in the quantities expected, the value of African votes at the United Nations.

There are also some very clear economic motives for Russian involvement in Africa. One being the diamond mining industry. Russia has a shortage of minerals such as manganese, bauxite and chromium, which Africa has in abundance.

“They’re collecting friends and allies, and they’re finding permissive environments to sell their wares and gain commercial opportunities.”

According to leaked documents, Russia is seeking to reinforce its existence in Africa by building relations with current rulers, striking military deals and grooming a new generation of “leaders” and undercover “agents”.

Activity online

On 30th October this year Facebook reportedly suspended three networks of Russian internet accounts aimed at covertly influencing events in several African countries. This list includes Madagascar, CAR, Mozambique, Democratic Republic of Congo, Ivory Coast, Cameroon, Sudan and Libya.

It is evident that Facebook are working hard to remove any suspicious accounts.

You can get banned on Facebook for being involved in rule breaking activities, some of which include: hate speech, credible threats or direct attacks on an individual or group, fake or impostor profiles and spam.

It is also against the Facebook community standards to maintain more than one personal account.

Bearing this in mind, how on earth do the vast majority of IRA accounts avoid detection on Facebook and Instagram?

Well, you could speculate forever with how their infrastructure works, but apparently you can avoid detection on Facebook by following these simple techniques when it comes to adding friends.

1) Manually add no more than 15 friends in a 24-hour period,
2) Cancel any friend requests which are left unanswered within a 24-hour period,
3) Do not send friends requests to every page visited

Maybe something to keep an eye on Facebook?

Last time we told you about GRU officer Sergei Parubin who is currently working in Belgrade, alongside Georgiy Kleban. We’ve been looking closely at Parubin and he seems particularly interesting to us. According to what we’ve been able to find, it seems that Parubin has a long history in the Balkan region not just Belgrade, previously serving in Zagreb, Croatia up to 2015. This isn’t even his first time in Belgrade, he was previously there in the early 2000s up to 2009. The GRU seem to rotate their military attaches and assistants throughout Russian embassies across the Balkan capitals, keeping them in the area for years. This is not normal behavior in other parts of Europe but seems to be here.

So what? Who cares? Why does that matter?

It’s probably much easier for GRU officers to stay in the same region for a long time, especially somewhere like the Balkans where people cross over into a neighboring country all the time to see family and friends. If you were for example a GRU officer, named Sergei Parubin, then you would be able to move around between countries easily with the perfect excuse of visiting some “friends” and if those friends just happened to be people you were paying to give you secret information…even better! It also means you don’t have to pass your agents off to someone new which is probably quite hard to do. New people might make mistakes and then get caught and all your hard work would go to waste or your agent might not get on with someone new… what happens if they bring the wrong type of Vodka? Not a problem for the GRU! They have been able to keep people like Parubin in the region for so long, they don’t need to take any extra risk and can carry on with whatever they’re up to as if nothing had changed!

And this is exactly what is being shown in the recent video that was leaked involving Parubin’s colleague Kleban. A GRU Officer with his Balkan friend… exchanging data for money (and the obligatory bottle of Vodka). Even more worrying is the fact that it is being done so casually. So openly. There are no dark alleyways or hidden meeting areas. No secret spy-like meeting point in the corner of a park or behind an abandoned building. It’s just two guys brazenly, though somewhat hurriedly, exchanging their goods at a bar over a nice beer. Well, we assume it’s a nice beer… and we assume it was a nice bottle of vodka!

As the latest spy game shows, the GRU don’t always slip under the radar though. Earlier this month a GRU officer, Vladimir Rusyaev, was declared a “Persona Non Grata” (PNG) in Bulgaria and expelled from the country for running a network of spies! https://www.icrazemagazine.com/news/nato-ally-expels-undercover-russian-spy/69631/

Numbers at the Russian Embassy in Belgrade are constantly on the rise. It is the largest in the region and more and more of this number are made up of intelligence officers. More officers like Kleban’s friend Sergei Parubin. What exactly is this guy’s role in everything? We’ll be investigating him further… and we invite you to do the same.

So…what is going on in Serbia?

Understandably the reaction in Serbia has been one of alarm. President Vucic said in a press conference after a National Security Council that some actions will be taken against foreign intelligence services that would be publicly visible.

We look forward to seeing the results of this action and wonder whether Sergei Parubin will be affected by these actions. If he does leave Serbia, it will be interesting to see whether he eventually reappears in another Balkan country… meaning he won’t really have left Serbia at all.

The question remains as to the motives of the GRU’s increased activities in Belgrade. President Vucic said that his only question for President Putin was “Why?” and we have the very same question. Is this part of an increasing malign campaign by the Russian government in the Balkans? Or are we looking at the early stages of another coup attempt? We’re looking for the answers and we will be back soon.

Last week a video was anonymously leaked online and claimed to show a GRU officer, who was named in the leak as Colonel Kleban, paying off members of the Serbian military in Belgrade. ‘nightingale’ were able to identify images of Kleban online in his full military regalia and think it’s clearly the same person, but if that’s not enough, Bellingcat think so too: https://twitter.com/christogrozev/status/1196183790831443971. And if that wasn’t enough, even the Serbian security services have since publicly confirmed that the video is genuine and Kleban is a GRU officer.

So… who is this Kleban guy? Kleban has been Deputy Defense Attache to Serbia since October 2015, but his recent 15 minutes of fame are a small drop in the ocean of Russian operations against the countries of the Western Balkans. In October 2016, the GRU organized, financed and facilitated an attempted coup in Montenegro. We previously shared with you some details of GRU operations and their use of local proxies and this was no different. The GRU used 10 Serbian gang members and Montenegrin opposition politicians to do their dirty work.

A recent New York Times article tied this attempted Coup to the secret GRU unit 29155, headed up by Major-General Andrei Averyanov. 29155 being the same unit responsible for the 2018 Salisbury nerve agent attack. Bellingcat did some further research on this secret unit and its Commander which can be found here: https://www.bellingcat.com/news/uk-and-europe/2019/10/14/averyanov-chepiga/

Two GRU officers from unit 29155 were tried “in absentia” and sentenced following the attempted coup: Eduard Shishmakov and Vladimir Popov, both charged with terrorism and criminal conspiracy. They were sentenced to 15 and 12 years respectively. Bellingcat subsequently revealed the true identity of Popov as Vladimir Moiseev. Among this trial, which was the largest in Montenegrin history, a former Serbian Gendarmerie Commander (Bratislav Dikic) was also charged with terrorism and sentenced to 8 years. This is, we believe, the first time two serving GRU officers have been sentenced under these charges in a NATO country. Go Montenegro!

But Kleban and Shishmakov are not the only Russian GRU officers present in the Balkans. ‘nightingale’ can exclusively reveal that Kleban is also closely associated with another GRU officer in Belgrade: Colonel Sergei Vladimirovich Parubin, who is currently listed as the Assistant Military Attache in Belgrade. Here they are both seen attending an event at the school at the Embassy of Russia in Serbia.

‘nightingale’ have been looking at GRU activity in the Balkans for a while now and this Parubin guy seems really interesting to us. We’ll be back soon when we’ve done some more research on him and can share more details with you.

The GRU (Glavnoye Razvedyvalte’noye Upravleniye) recently became notorious for a series of attacks against Russia’s adversaries. They hacked the Democratic National Committee emails in 2016, they spearheaded Russian intervention in Ukraine, and they carried out a nerve-agent attack in Britain.

The Washington Post previously revealed that the GRU was at the “forefront of Russia’s psychological warfare efforts”. Now, however, new leaked documents made available to ‘nightingale’ have shed light on a number of other influence operations conducted by the GRU, and we can reveal today a range of other operations they’ve conducted – new topics and new targets of GRU interference.

While those involved in these operations may be spread across Russia, according to our sources they are all managed by GRU Unit 54777, or the “72nd Special Service Center”.

East and West

Every section of Unit 54777 appears to have specific geographical focus for their operations. They have a base in St Petersburg, the 2148th PsyOps group who target NATO, the US and the UK, as well as other European states. In the Russian far east there’s the 2040th PsyOps group targeting Japan and US military units. Then there’s the 2059th PsyOps group in Yekaterinburg, seeking to remove obstacles to Russian dominance in Central Asia. And that’s only the one’s we’ve managed to find out about… there are at least 3 more groups being managed by the GRU whose activities we are still investigating.

Online and offline

The 2148th group who target Western countries appear to carry out both online and in-person operations. They take to social media and start lighting digital fires about controversial domestic issues in those countries.

When it comes to offline operations, they often use proxy organizations to engage with people of interest to them. According to our sources, during the 2018 FIFA World Cup that was hosted in Russia, the 2148th group organized a targeted op on foreign fans. They used local proxies to hide the fact it was them, and seemed to be getting fans to wear a virtual reality headset, watch a video and take a survey. It’s not entirely clear what they were up to here with this bizarre performance (not unusual for them!), but it was possibly their way of researching new avenues for delivering their operations.

The 2148th also attempted to create similar unrest across Europe by spreading messages of an alleged rising of Nazism in Ukraine, and trying to ignite separatist tensions in the Baltic states.

What are they focused on?

Their 2040th Unit who focus on the East seem to be mostly concerned with Asia and have two goals: protect Russia’s claim on the Kuril Islands (which they claimed in 1945 at the end of WW2), and to increase opposition to US military presence in East Asia. Historically, we’ve seen them prod debates about the Japanese conduct during WW2 and started to incite fear around sexual violence that was allegedly committed by US marines. The Central Asian unit, 2059th, even drew up plans to discredit prominent politicians and pro-democracy NGOs operating in countries of interest (Kyrgyzstan and Tajikistan). The quality of their attempts wasn’t always polished like you might expect from such a large organization but they are driving a wedge into the splits in our societies.

Why does it matter?

Clearly, their Photoshop skills have a fair bit of room for improvement, and we can reveal more previously unknown and far more crude Russian campaigns as well, but the fact is these units are getting tasking from somewhere and while some of these operations are small attempts at spreading discord in countries Russia believes to be hostile, others are clearly strategically advantageous to Russia like Ukraine or North Stream oil project. These operations are clearly crude, but they reveal the breadth of the GRU’s ambitions and their casual attitude to interference. They reveal the GRU to be an unconstrained and unethical organization and we think the world should know.

We are an online collective that has formed to expose the activity of one of the most significant threats of our time: Russia. We come from several countries but the common thread is that each of our homelands has at some time been touched by “Russian malign influence”.

In the past couple of years, there has been a lot of news coverage about Russia’s malicious activity, but there is even more that Russia is doing and people don’t know about it.

As ‘nightingale’, we think the world should know about the things that Russia is doing in secret, from its interference in Ukraine, to ‘fake news’ and hacking.

For now, we want to keep our identities secret, if you keep following this page you’ll see why, but we’re going to be working with some friends of ours to make sure you get the most up to date and interesting stories that we can get our hands on. Watch our accounts so that you can find out straight away the stories Russia doesn’t want you to know.

If you have interesting information that you want to share then contact us @NightingaleRus1