The Strategic Culture Foundation has been described as “submissively loyal to the Kremlin party line” and a “parrot of Russian propaganda. However recently the New York Times reporting shed new light on this site and the Russian intelligence services who are in control behind the scenes. According to their article, “The Strategic Culture Foundation is directed by another Russian intelligence agency, the SVR”. The article also named another site controlled by Russian intelligence services InfoRos, read our previous reporting on that site here. Whereas the NYT named two people who were in control at InfoRos, it provided fewer details on who is in control at the Strategic Culture Foundation. We want to find out who the mysterious owners and editors might be and in the course of our research, we have identified a network of linked sites probably under control of SVR.

What is the Strategic Culture Foundation?

The Strategic Culture Foundation declares in its mission statement that “SCF works to broaden and diversify expert discussion by focusing on hidden aspects of international political and unconventional thinking. Benefiting from the expanding power of the Internet, we work to spread reliable information, critical thought and progressive ideas.” All sounds good, doesn’t it? But you would be searching for a long time to find reliable information, critical thought or progressive ideas on this site. They also seem to have a particular interest in calling anyone and everyone (never the Mother Russia of course) a Nazi. The people accused of Nazism by SCF makes a pretty long list: Ukraine, Estonia, European Union, Canada, Poland… the UK Royal Family House of Windsor. Surprising that they feel able to make such accusations when they also engage in anti-Semitic conspiracy theories.

Another worrying thing is the number of times the Strategic Culture Foundation and its “analysts” are cited in the International Press in relation to Bosnia, Serbia and Ukraine. The advanced in these pieces are so blatantly pro-Russia that it’s a surprise that they managed to continue for so long before being linked to Russian Intelligence Services. The foundation and its contributors frequently expressed skepticism of NATO and Western influence in Russia’s neighbors for example in 2014, Anna Filimonov (at the time editor-in chief of the SCF) said both that “Serbia is Russia’s Strategic Ally” and that the West had trampled Serbia into the ground and the country needed to be rebuilt. In 2013, Viktor Pirozhenko of the SCF suggested that Ukraine would not fulfill its political commitments to the EU, as it could lead to Yanukovych’s defeat in presidential elections. The dangerous thing here is that people might share these opinions thinking they come from well-informed commentators with no agenda, when in fact it comes from the heart of the Russian intelligence services.

It is clear that this site works in a different way to InfoRos. In the case of InfoRos, Denis Tyurin had clear links to the GRU 72nd Special Service Center; however Strategic Culture Foundation works differently. They pretend to be a progressive think tank and provide useful “International Media” for Russian media to quote when they want to sow disinformation at home. The people writing the articles clearly have interests in the topics they cover and may not even know that they work for the SVR. Maybe the SVR thought that by operating in this way their involvement would not be revealed but unfortunately there are a few mistakes which reveal that all is not as it seems with the SCF.

Who controls SCF?

Media Bias who give Strategic Culture Foundation a rating of “Questionable Source” with “very low” factual reporting state that SCF “completely lacks transparency by not listing owners or editors.” As many including EuVsDisinfo have noted nowhere on the pages of this all-English site does it admit that the site is registered and managed in Russia – they don’t even publicly state that they have a Russian version of their site.

We wanted to take a look at the few people who are publicly connected to SCF. Vladimir Maximenko is listed as General Director of the Strategic Culture Foundation, a role he has occupied since 2007. Interestingly, according to Dark Side of the Kremlin email leaks, Maximenko is in touch with Kirill Frolov who appears to spend a lot of his time coordinating different Russian propaganda sites that clearly have Kremlin links like rusvena.su. As Director of Foundation, it seems likely that Maximenko maintains contact with the SVR officers who provide direction to his work.

A key figure here is Andrey Grigoryevich Areshev. He first came to our attention as the Deputy Director of the SCF. He was born on 21 June 1974 in Tbilisi according to publicly available information. According to historic Whois data, Areshev registered the domains for Strategic Culture Foundation (fondsk.org, strategic-culture.org, fondsk.ru). Back in 2015, some people online were trying to link this to FSB, which was close but not quite right! The address that was given was: ul. Soljanka, d 1/2, Str. 2, Podezd 11-A, Apartment 8, which is real address but what is unusual is the phone number… it seems that this phone number belongs to a recruitment agency – which seems suspicious behavior and shows that the site is not what it appears to be.

What is happening at ul. Soljanka?

As we said, while the phone number used by Areshev to register these sites appears to be taken from somewhere else, the address seemed legitimate. There is such a building in Moscow, fairly central, not too far from Red Square and there are even other businesses at similar addresses. Some of these business caught our attention..one of them is “ROSSPO METALL” – one of the founders of this business (registered to a different address) is “ROSSPO” which is the Russian Organization for Cooperation between the Special Services and Law Enforcement Agencies. ROSSPO’s Executive Director is Anatoliy Mikailovich Kulachenko, who is also the Chairman for an organization called Otchizna. WE never understood fully what is happening here, but it definitely seems that there is something strange happening at ul.Soljanka.

Areshev, clearly a knowledgeable man can be found all over the Internet. You can find him leaving book reviews and giving interviews to Sputnik Estonia, we were particularly interested to see that he participated in an RISI roundtable event. RISI has been described as the SVR’s analytical center and although the two organizations officially split in 2009, it seems clear that there are still strong links – Leonid Reshetnikov, a former SVR director, was head of RISI from 2009-2016. We are not trying to claim that this is conclusive of an SVR link, but given what we now know it certainly raises questions.

Areshev’s web of disinformation

On his VK page, Areshev shares articles from SCF and also VPO analytics but it seems he has an interest in many different sites. Through our research into Areshev, we stumbled into a whole web of disinformation sites… all linking back to Areshev. Areshev is listed as a contact for the OdnaRodyna VK page and appears to have created the OdnaRodyna (ОднаРодина) Twitter page, although that hasn’t been active since May 2019. When we accessed historic Whois data, we discovered that in fact Areshev registered the odnarodyna.org to the same SCF address and used the same strange phone number… OdnaRodyna – a site which frequently shares manipulative messaging on Ukraine is one of them. In fact, OdnaRodyna was one of the internet resources that were banned by the Ukrainian government, because they “contain information with signs of prohibited nature according to the rule of law”.

This isn’t even the only site, we discovered ritmeurasia.org. Although Areshev is only listed as an author in the site, it turns out that he also registered this site with the same fake phone number back in 2013. We found Areshev listed as a registrant for another site worldintellectual.net in June 2018, although this was only briefly as it was pretty swiftly moved in an effort to hide Areshev’s involvement. Prior to Areshev being involved, the main registrant was one Igor Igorevich Alekseev. We couldn’t find too much information about Alekseev, who also contributes to SCF, but he is involved in another project Route Magazine.

The email address given for Areshev when registering this site is pravo5@zmail.ru and through this email address we were able to connect him to many different activities. At first, Areshev registered all these sites in his own name, but later seems to have tried to transfer them to a proxy service. We wonder what he is trying to hide? Andrey is clearly a very busy man. He also finds time for his role as an administrator for the Kamerton journal. Kamerton describes itself as an online literary and historical journal. Their main aim, so they say, is to reflect the literary process the common historical events and also to promote social thinking in places where people speak, write and think in Russian, primarily in the countries of the former USSR. Although the main editor of Kamerton is listed as Svetlana Georgiyevna Zamlelova, it is clear that Areshev has a controlling role in Kamerton site too, another way for SVR opinions to make their way on to the Internet???

We also found links between Areshev and several LiveJournal profiles. It doesn’t seem that they were particularly effective, they haven’t been active since 2012. Maybe the SVR weren’t reaching their intended audiences. One of these sites is neko-mashura.livejournal.com, whose name is “fondsk__ekspert”. This blog covered a wide range of topics, but you won’t be surprised to hear that it covered a few of the Kremlin’s favorite topics: Anti-NATO, Ukraine, Armenia and the Caucuses. The neko-mashura account wrote for two other suspicious LiveJournal accounts eurazia-ru.livejournal.com, which said that it was interested in the fight for the Soviet legacy in the Balkans, the Caucuses and in fact everywhere, and another site kaukaz.livejournal.com. One of the sites that was referenced by kaukaz LiveJournal site was kavkazoved.info, which it turns out was registered by one Andrey Areshev using the address ul.Soljanka, d1/2, str. 2 Podezd 11-A, Apartment 8. Interestingly, a different email was used to register this site but all the rest of the details are exactly the same. The email address ivanov-info@mail.ru was also used to register odnarodyna.su in 2015, perhaps after Areshev got concerned about his privacy??

We see a pattern here that clearly continues to this day. This is not just about one site – it’s about a whole range of sites which all publish very similar information on very similar themes. They share authors and often share the same syndicated content. They create their very own little disinformation ecosystem. Others have pointed out that a group of these sites New Eastern Outlook, Oriental Review, South Front and SCF all play a similar and have authors in common.

Why should I care?

Our investigation into SCF has found what looks like a network of Russian disinformation sites going back years. Given what has been revealed about the SCF and SVR ties, it makes you wonder whether all these sites are controlled by SVR too? It is clear that a lot of time and effort has been invested in creating and maintaining this network of sites, which shows the dedication to disinformation by the people involved here.

The network of sites that have been created here can be confusing and difficult to understand, but that is their aim. The Kremlin hopes to confuse the environment and make it confusing to find what is really true and in which opinions we can trust. The intention here is clear though: for the Russian intelligence services to influence the public conversation.

What can we learn by looking at these sites? We used to think of Russian influence as coming from Twitter bots and fake accounts – and these mechanisms certainly still exist – but these sites show us a different side to Russian influence. They invest time, money and effort into these sites. Strategic Culture Foundation was founded in 2005 and it has been promoting SVR propaganda since then under the guise of a news portal/think tank. A simple Google search will tell you how often SCF articles and authors are cited as sources or referenced in other publications. Would it be the same if people know it was coming from the SVR? Not likely!

This is yet another warning to be skeptical of opinions and articles that you read online that just seem to be pro-Russian. In recent times we have seen some social media companies marking content coming from Russia Today and other such Kremlin mouthpieces as being Russian-State backed. It seems that they should take similar action against these accounts and any their stories are spread online – we hope that now the link between the intelligence services and these sites is clear that more action will be taken online and offline to deter this type of activity.

It has been just over six years since Malaysia Airlines flight MH17 was downed over eastern Ukraine with the loss of all 298 people onboard. In May 2018, the Dutch-led joint investigation team (JIT) concluded that the Buk missile system which was used to shoot it down belonged to the 53rd Anti-Aircraft Missile Brigade, based in the Russian city of Kursk. Subsequently, it came to light that many of the individuals involved in arranging its deployment to Ukraine were senior officers in the Russian Ministry of Defense and the GRU. In spite of this, the Kremlin has always denied any involvement in the tragedy, predictably dismissing the accusations as Russo-phobia. In fact, it has not only refused to accept any responsibility for the event, it has lied over and over again about its role in the tragedy and, together with the GRU, has used various tactics to deliberately thwart the JIT’s investigation. You might think that, all these years later and faced with irrefutable proof, Russia would have given in and admitted its guilt, but, in this article, we will reveal new evidence which shows that Moscow is still waging a pointless and unedifying MH17 information war in 2020 – a war that not only is it not winning, but it does not appear to realize is over.

The background

In June 2019, the JIT announced that four suspects were to be charged with murder in connection with the downing of MH17. It named the men as Igor Girkin (also known as Strelkov), Sergei Dubinsky and Oleg Pulatov from Russia, and Leonid Kharchenko from Ukraine. According to the JIT, Girkin is a former FSB colonel and was the Minister of Defense in the so-called Donetsk People’s Republic (DNR) when MH17 was shot down. Dubinsky is an ex-GRU officer; he was Girkin’s deputy and the head of the DNR’s military intelligence service (GRU DNR – not to be confused with Russia’s GRU) at the time. Pulatov, a former GRU special forces soldier, was Dubinsky’s deputy, and Kharchenko was the commander of a combat unit in eastern Ukraine.

Simultaneously, the investigative collective Bellingcat published a report identifying individuals who were heard speaking or were mentioned on intercepted telephone calls which were released by the JIT and the Ukrainian Secret Service (SBU) following the tragedy. Two of these men, Igor Bezler and Sergei Povalyaev, were thought to be GRU officers. The same report assessed that the GRU DNR was responsible for procuring the Buk missile launcher and coordinating its movement from Russia to Ukraine and back. While the GRU DNR claimed to be independent from Moscow, it has been alleged that it was in fact controlled at least in part, and possibly entirely, by the Russian GRU. Previously, in May 2018, Bellingcat had exposed the identity of a person of interest to the JIT as being Oleg Ivannikov, a GRU commander who was also involved in arranging the delivery of the missile system to separatist-held territory. As you can imagine, given its deep involvement in the incident, the GRU has been desperately trying to cover its tracks and, as usual, it hasn’’t been very subtle about it.

Hacking operations

In 2015, the Dutch Safety Board (OVV), which had been investigating the source of the crash, published its findings in a detailed report. Both before and after the report was released, the OVV was targeted by the hacker group known as APT28 or Fancy Bear, which is made up of GRU Unit 26165 officers. The same group attempted to hack one of the OVV’s partners in the MH17 investigation and also targeted Bellingcat journalists.
In 2018, Dutch authorities foiled an attempt made by four members of APT28 to carry out a close access operation against the Wi-Fi network of the Organization for the Prevention of Chemical Weapons (OPCW) in The Hague. At the time, the OPCW was investigating the poisoning of Sergei Skripal in the UK. The individuals, who were named as Alexei Morenets, Yevgeny Serebriakov, Oleg Sotnikov and Alexei Minin, were intercepted and their equipment seized. Serebriakov’s laptop showed that, in 2017, he and his colleagues had traveled to Malaysia to carry out hacking operations against the Malaysian police, the attorney general’s office and the MH17 investigation.

The device was also found to have been used in Brazil and Switzerland, and it is thought that the team traveled to these countries in order to target international anti-doping organizations and officials in retaliation for Russia’s state-sponsored athlete doping program having been exposed. This round-the-world tour resulted in the famous Fancy Bears Twitter account and website leaking athletes’ confidential records. The GRU officers were not just obtaining information, but using it aggressively as a disinformation weapon: exactly the sort of tactic used against the MH17 investigation. An example of this is the leaking of an Australian Federal Police (AFP) report concerning MH17. The GRU are believed to have hacked the AFP as, in February of this year, selected sections of the document, in which police officers debated whether images of the Buk missile system used to shoot down MH17 had been manipulated, appeared on a Russian-linked website. Other areas of the report, in which the officers confirmed the authenticity of the pictures, were not published.

Disinformation campaign

Alongside the operations mentioned above, Russia used pro-Kremlin media outlets and social media platforms to spread MH17 conspiracy theories and sow seeds of mistrust against the West and the Ukrainian government. According to Kharkiv Human Rights Protection Group, within the first two days after the downing of the plane, Russian internet trolls had posted at least 65,000 tweets trying to blame Ukraine for the disaster. Although that particular Twitter operation did not maintain its pace, the disinformation campaign as a whole certainly did, constantly pushing out new narratives surrounding MH17, each one as ludicrous as the last. The EU DisinfoLab info-graphic below illustrates the incredible scale of the operation.

Mh17-files.com, to anyone who gives it more than a brief glance, has all the hallmarks of a GRU information operation. The site’s content consists of articles and opinion pieces which portray Russia as the injured party who has been wrongly accused, and try to shift the blame for the MH17 disaster onto Ukraine: views that are entirely aligned with those of the GRU.

A simple WHOIS lookup shows that the site was registered on 31st January 2020 by a suitably obfuscated ProtonMail user, a practice which is consistent with the GRU modus operandi. In addition to this, ThreatConnect threat intelligence researcher Kyle Ehmke has previously flagged the site as being suspicious.

During our investigation, sources told us that mh17-files.com was a disinformation website run by Unit 54777. One stated that everything about it was consistent with 54777 operations and it had similarities to unit 26165 and 74455 operations. You will probably be familiar with Unit 54777 from our previous articles.

On the balance of evidence detailed in this article, we have concluded that there is no plausible explanation for this website other than that it is a GRU disinformation operation run by Unit 54777, maybe in collaboration with other parts of the GRU like 26165 and 74455. We can’t help but think that it’s just the sort of place that the ill-gotten gains of APT28’s hacking operations in Malaysia might be published in the future.

What has Russia actually achieved?

It is obvious that the Kremlin has invested a lot of time and effort into trying to cover up its role in the MH17 disaster – but to what end? The large-scale disinformation campaign and the attempts to disrupt the JIT’s investigation have been easily attributed to Russia and the GRU, and so, ultimately, all they have succeeded in doing is causing further damage to their already tarnished reputations. And yet, they persist in their futile quest to cover up their involvement in the tragedy. MH17-files.com is evidence of how desperate the GRU has become; it is a flimsy facade which is fooling nobody. It shows that they chose the wrong path when they refused to admit responsibility – their lies have become more and more hollow, to the point where you have to wonder whether even they believe it anymore. One thing is for certain: in spite of the volume of noise that has been thrown at this, and the man hours that have been wasted in Moscow and in the GRU over the past six years, justice will be served. Russia will not be able to stop the MH17 trial, and the inevitable guilty verdict will be delivered. In the meantime, we will continue to seek out other disinformation platforms like mh17-files.com and bring them to your attention.

If you were to come across the InfoRos news portal while browsing the internet, you would think it was just another online newspaper. So far, so normal. However, recent media reports have shown that this is not the case and in fact, the InfoRos information agency is acting as a front for GRU psychological influence operations. In this article we examine the GRU connection, give details of Inforos’s plan to silence what it considers to be anti-Russian rhetoric, and reveal the European writers who are being paid to help.

But first, we know that the InfoRos new portal is just one part of the InfoRos enterprise; so what else does it do? It seems that the company offers web design advertising, PR and political and business consulting services. It also administers large information projects for the Russian state and international clients. In the course of our research, we have discovered that theer are two businesses registered under the InfoRos name. One is OOO IA “InfoRos” and the other is OOO “IA Inforos” (note the position of inverted commas). Both companies are registered to the same address – Moscow Krzhizhanovskogo Street, Building 13, Corpus 2 – and IA “Inforos” has a 20 percent ownership stake in “IA Inforos”, so it is likely that these two companies are registered separately, but work as one. There are other businesses registered to the same address as InfoRos, many of which have founders, owners or executives in common and have the shared goal of promoting Russia and its interests. InfoRos falls under one of these organizations: The Institute of the Russian Diaspora. The Institute was founded by a man called Denis Tyurin, who also controls InfoRos.

Given that he runs the InfoRos platform, has previously served in a GRU unit specializing in military psychological intelligence and sources confirm that he maintains close ties with Russian military intelligence, we suspect that Tyurin remains an operative of the GRU’s 72 Main Intelligence Information Center, or unit 54777, as it is known. Regular readers might recognize Unit 54777 from one of our previous articles, but if you are visiting for the first time or need a reminder on their activities, you can find it here: https://nightingalerussia.com/?p=8. It seems that Unit 54777 has a number of front companies which are financed by the Russian government as public diplomacy organizations but which are actually run by the GRU. In 2018, The Washington Post cited InfoRos and the Institute of the Russian Diaspora as being two of the most significant of these organizations. In July of this year, the Associated Press and The New York Times also ran articles linking 54777 to InfoRos and the spread of disinformation, particularly surrounding the COVID-19 pandemic. Both articles reference a report by the Brussels-based non-governmental organization, EU DisinfoLab, which exposes the French website observateurcontinental.fr as being an InfoRos platform. It makes for very interesting reading and highlights the fact that the GRU does not just use Russian language websites for its information campaigns. According to the report, one of the main contributors to Observateur Continental is a French journalist named Olivier Renault, whose articles have also been published on the InfoRos website. It turns out that he is not the only foreign journalist who has been working for InfoRos.

Use of European writers

nightingale can exclusively reveal how InfoRos has been using foreign journalists and experts to facilitate its influence operations. We have been made aware that, in 2017, a group of InfoRos employees embarked on a project which aimed to counter perceived anti-Russian information campaigns in the foreign media and generally promote a positive image of Russia and its actions on the world stage. A key part of the project was to create a pool of analysts who would produce expert commentary which could then be used to react to any stories in the Western press showing Russia in a negative light. The group behind the project must have decided that to spread their message globally they would recruit people from other countries to their pool, as they set out to attract not just Russian, but also foreign, journalists, experts and observers.

It seems that the project was successful in its aims. nightingale can reveal that, in 2017, Denis Tyurin employed a Polish writer named Tomasz Klasa to produce articles in which Polish politicians and commentators expressed favorable opinions regarding Russia’s foreign policy, or which were critical of the U.S. and the E.U. The articles were to be published in Polish and then translated to Russian for further publication. Klasa was to be paid around 3000 euros per year for this. His articles were published on obserwatorpolityczny.pl, a Polish news portal of which Klasa in the Editor-in-Chief. Interestingly, in 2014, Obserwator Polityczny became a partner of the Russian World Fund, which ostensibly seeks to promote the Russian language and Russian culture abroad, but is widely seen in the West as a propaganda agency operating under the direction of the Kremlin. Obserwator Polityczny frequently shares conspiracy theories known to be associated with Russian disinformation. This organization is located at the same Moscow address as InfoRos and Obserwator Polityczny also directs their viewers to the InfoRos website.

nightingale has also uncovered evidence of payments being made to German and Austrian writers in return for news items that are anti-Western or promote Russia’s interests, such as the BRICS countries. These writers include Austrian Robert Fitzthum, who has penned articles such as ‘USA against Huawei’ https://inforos.ru/ru/?module=news&action=view&id=91642 and Germans Karin Leukefeld and Rudolf Haensel, who have written pieces entitles ‘Desert Prisoners’ https://inforos.ru/ru?module=news&action=view&id=92303 and ‘NATO is 70. And no more’ https://inforos.ru/ru/?module=news&action=view&id=89637, respectively.

Apart from employing foreign journalists, in 2019, InfoRos arranged for a German named Thomas Roeper to attend Media Forum 2019, an event held in Prague to discuss freedom of speech in the media. Although it’s not clear exactly what they were hoping to achieve by doing this, sources have confirmed that Roeper sat on a discussion panel at the forum. Roeper is a writer and author who has also produced material for InfoRos. He runs the website anti-spiegel.ru and his work mainly focuses on Russia’s image in Germany and on criticizing the Western media in general. In addition to this, he is a moderator for the German YouTube channel NuoViso Studio, which calls itself a “pioneer in the alternative media scene”. InfoRos also organized for other members of this channel to attend Media Forum 2019 and report on it.

We know that the people named above aren’t the only foreign journalists and writers who contribute to the InfoRos platform, and we are currently investigating payments made to others. We should point out that it is not clear whether the contributors we have mentioned are aware that they are part of a clandestine Russian operation, but the fact that they have received money from the GRU for their work essentially makes them agents, unwitting or otherwise, and it is a worrying prospect that Russia’s military intelligence agency is paying foreign citizens to help further its shady aims abroad.

Many of use are familiar with these sorts of individuals who support Russia and see ‘Russo-phobia’ everywhere, who just ‘appear’ on our TV screens, in our newspapers and on our Facebook pages. These payments raise the question of whether the pro-Russia commentators in question coincidentally hold these opinions or they are being paid to promote these views. We do not know how many of these people might secretly be knowingly or unknowingly receiving money from Russian intelligence services.

So what?

Why should we be worried, you might ask? Well, whereas in the past Russia may have concentrated on influencing nearby post-Soviet states, the internet has provided it with a global audience and enabled it to branch out and threaten Western democracies and their social order. By focusing on issues online that are controversial and will provoke debate, like those mentioned in the articles above, the Kremlin aims to cause turmoil and either exploit existing divisions in societies, or create new ones. This is done with the end goal of promoting Russia’s geopolitical interests and acheiving its desire to be seen as a world power. These online disinformation campaigns are often paired with cyber-attacks to enable Russia to influence the outcomes of real-world events – you will no doubt be aware of the Kremlin’s meddling in elections in countries across the world. In many cases the GRU has been publicly outed as, or suspected of, being responsible. For more evidence of Russian interference in Western Europe, see our recent article: https://nightingalerussia.com/?p=8. Whilst we have used Russia’s attempts to influence the West to explain why what InfoRos is doing is a problem, it’s important to note that the Kremlin does not limit itself to this party of the world and evidence of GRU activity has been seen as far afield as Latin America and Africa.

So what next? Rest assured that nightingale will keep looking into InfoRos’s use of foreign journalists, as well as trying to find out what else it might be up to. Watch this space for more details.

The New York Times recently revealed that the secretive GRU Unit 29155 associated with the assassinations and sabotage “secretly offered bounties to Taliban-linked militants for killing coalition forces in Afghanistan – including targeting American troops” working via key middleman, Rahmatullah Azizi. It has long been suspected that the Russian government supports Taliban but this new story has shaken many. It means Unit 29155, previously described as “engaged in a campaign to destabilize Europe”, have stretch their influence into new regions of the world and have directly organized the deaths of US forces.

We remember that in 2016 two officers of Unit 29155 attempted to kill the Montenegrin prime minister and seized the parliament building. In Spain it is reported that the high-ranking GRU officer Denis Sergeyev traveled to Catalonia twice before 2017 independence referendum there. In 2015, they attempted to poison Bulgarian arms dealer Emilian Gebrev, apparently, they made two attempts one in Sofia and a month later at his home on the Black Sea. In March 2018 again two officers tried to poison former spy Sergei Skripal at his home in Great Britain.

This recent story is the first time that we have learnt about the activity of 29155 that takes place outside Europe’s borders. Sources have identified Rahmatullah Azizi as the middleman who distributed money, probably hundreds of thousands in US dollars, from the Unit 29155 to the Taliban-linked fighters to pay for the successful attacks on US forces. Azizi, originated from Northern Afghanistan, made regular trips to his homeland but has now probably returned to Russia. Azizi has been clearly linked to the financial side of this activity between Taliban and 29155 but new information reveals his extremely close links to the unit.

New passport information made available to nightingale has revealed that Azizi probably traveled using a passport with the number 654341494. Bellingcat’s investigation into the suspects behind the Skripal poisoning and investigations into Col. Eduard Shishmakov involved in the Montenegro coup revealed the cover-identity passports issued to 29155 for their travel all began with 65434. The fake passports Chepiga (alias Boshirov) used 654341294, Mishkin (alias Petrov) used 654341297 and Shishmakov (alias Shirakov) used 65434323. The fact that Azizi had access to such a passport proves that he was more than a simple middle man and was given the same privileges as GRU officers.

nightingale will keep looking into Azizi and activities in Afghanistan and we will return when we will know more.

nightingale can reveal details behind bumbling billionaire Konstantin Malofeev and his attempts to interfere with European politics. We investigate into his contacts in Europe and reveal the identity of Bellingcat’s mystery man “Yuri”.

There is no Russian separatism without Konstantin Malofeev, a name at the center of Russia’s annexation of Crimea and interference in Ukraine. In 2014 Malofeev was placed on a EU sanctions list for material support to the separatists in Eastern Ukraine. Since then Malofeev has been revealed as a central figure in similar failed insurgencies in Montenegro and Bulgaria. In Russia Malofeev has found himself at the center of a large number of failed businesses and the theft of $450m.

After multiple failed coups, businesses and backroom deals, you would think that the Kremlin might question their support of this reputational time-bomb. However, nightingale can exclusively reveal through our sources that Konstantin Malofeev is more active than ever setting his sites on the establishment of the EU that is trying to restrain him.

Should the EU be seeking to do more to stop or control Konstantin Malofeev and his activities? Why is Putin allowing Malofeev’s activities to continue and what does it say about Russia’s foreign policy goals?

nightingale takes a look in detail at who this man is and what his activities reveal…

The bumbling Billionaire

Malofeev, previously better known for his Orthodox activism, gained his vast wealth in Russia, during the early years of Putin’s presidency in finance and investment industry. From here Malofeev has branched out his business interests, with involvement globally in a range of businesses, many of which have seen countless problems and court cases.

After the sanctions Malofeev’s main investment firm Marshall Capital effectively ceased functioning. These days Malofeev has shifted focus and now uses the Tsargrad group to further his aims. According to one newspaper report, between 2013 and 2017 Malofeev’s companies recorded annual losses ranging from $7.6 to $25m. In 2012 his house and office were raided in connection with a case brought against Marshall Capital by the Russian state-bank VTB. The bank alleged it had provided a loan for a deal, in which Marshall Capital was involved as both the buyer and seller. This case was closed in 2015 when VTB agreed to an 83% discount on Malofeev’s debts and agreed to accept $100m payment.

This isn’t the only example of Malofeev’s questionable business practice. Another source of trouble for Malofeev in recent years has been repeated failed attempts to finance the purchase of a Bulgarian telecom company, Vivacom. A company linked to Malofeev, went on to make several costly unsuccessful attempts in court to declare the sale of the company null and void. This was an attempt to stop the sale to a company not controlled or owned by Malofeev.

In 2019, he was linked to the theft of $450m of cryptocurrency from the WEX cryptocurrency exchange. According to testimony from the administrator of the WEX, the FSB forced the handover of bitcoin wallets to them. According to police statements by the administrator of the WEX right before it collapsed, he was in talks with Malofeev who wanted to obtain the database of the WEX users and had previously negotiated a sale to Dmitri Kharchenko, a militia fighter in Eastern Ukraine, whose daughter is now the nomincal owner of the exchange. Audio recordings reportedly have Malofeev discussing the importance of bringing the exchange under the control of the Russian intelligence services.

Although Malofeev has lost the trust of cryptocurrency investors, he found investors for a new fund called the International Agency for Sovereign Development, who has recently signed deals with economically fragile, developing nations such as Niger, Guinea and the DRC. The fund sells itself as having the ability to attract investment into countries, which seems unlikely given Malofeev’s business record.

Not just a businessman

Malofeev doesn’t just have business problems but also political ones. Malofeev clearly has political ambitions inside Russia and his first attempt at getting political power was to announce his candidacy as a deputy for Smolensk Oblast in 2012. Despite being the winning candidate Malofeev was stuck off the ballot, when a Russian court decided he had been offering money for votes.

Outside Russia Malofeev has been more successful. HE is accused of facilitating a barrage of political interference. In the build up to the annexation of Crimea in 2014 Malofeev funded illegal armed groups, and liaised with his lieutenants on the ground. Further evidence of Malofeev’s involvement in Ukraine came when his assistant was caught sending a list of potential candidates to lead breakaway parts of the country to the office of Vladislav Surkov. Surkov was and is a Russian Presidential Aide. A criminal case was subsequently launched against Malofeev in Ukraine.

As a result of the growing case against Malofeev in Ukraine, it is believed that in late 2014 the Kremlin made a token gesture of restricting Malofeev’s geopolitical meddling to the Balkans. Even though countries in the Balkans like Serbia are supposed to be friends of Russia, so why would they need to use someone like Malofeev in these countries?

After this Malofeev was linked to political interference in Bosnia and Herzegovina for three hours before being expelled from the country. Bosnian press has linked Malofeev to the purchase of Republika Srpska bonds, in fact he tried to visit Milorad Dodik just 20 days before the transaction, which is when he was returned from the Banja Luka airport. In 2019 Nikolay Malinov a former Bulgarian lawmaker and head of the Bulgarian NGO, National Russophile Movement (NRO), was charged by Bulgarian authorities for spying for Russia. Prosecutors said Malinov was funded by Malofeev. Malinov wrote a secret report which talked of using Malofeev’s assistance to move Bulgaria towards Russia. As a result of this, Malofeev was banned from Bulgaria for 10 years.

According to online reports, Moscow tried to engineer a coup in Montenegro in 2016 to stop the country joining NATO. Malofeev was rumored to have been involved. Bellingcat research in March 2017 identified an email sent from Alexander Usovsky who had freelanced for Malofeev’s active measures campaign in 2014 and 2015. Usovsky proposed a new initiative in the email that would wash embarrassment from Malofeev’s name following the Montenegro failure. Malofeev was subsequently barred from entry into Montenegro which joined NATO in 2017. Another example of Malofeev’s best attempts giving absolutely no results.

Interference in Western Europe

Recently Malofeev’s interference seems to have spread to Western Europe. Our sources informed us that one key operative being used on the ground there is Mikhail Yakushev, who according to our research appears to have also worked for the Russian Ministry of Foreign Affairs. Yakushev has been seen linking up with European far-right groups such as the German Alternativ fur Deutschland (AfD), Freedom Party of Austria and the French Rally National. There have also been reports of Malofeev helping to facilitate two loans to Marine Le Pen’s party of two and nine million euros. One of the collaborators for one of Malofeev’s websites Katehon is in fact Marine Le Pen.

In 2019 Italian news outlet L’Espresso linked Malofeev’s oil company Avangard to the attempted funding of an Italian political party, La Liga. In Moscow in October 2018, four Russians and four Italians discussed a deal for an Italian political party to received Russian funding through an oil deal. Audio of this meeting leaked and one of the Italians present – Gianluca Savoini was heard saying the deal would mean that the Italians “can pay for a campaign”. This campaign is thought the be 2019 European parliamentary elections. Bellingcat identified all attendees of the meeting except one by the name of “Yuri”. nightingale have spoken to a source close to the deal who was able to provide more details on Yuri. At nightingale we believe that this is probably Yuri Burundukov. Avangard is a secretive organization and after the Bellingcat leaks a lot of information about them disappeared online, but we do know that Burundukov had an Avangard email address. Malofeev, as usual, was pulling the strings in the background, however his efforts were easily discovered and caused more embarrassment.

This October 2018 deal was the second deal after the first fell through, according to L’Espresso. The first also involved Avangard. Documents show that Avangard’s Director General Alexei Mustafinov, offered oil for sale to Savini in July 2018. Similar to Bulgaria, our sources have identified that Malofeev’s associates, including Yakushev, maintain contact with a number of Italian political actors even after this debacle. It could be that Yakushev and Malofeev still have intentions to interfere in Italy.

Malofeev in 2020 continues to take an interest in the German political scene, in particular AfD. Malofeev even commented to the french newspaper Le Figaro last year that he considers himself its Russian ambassador. Unsurprisingly there were numerous reported sightings last year of ex-AfD member Manuel Ochsenreiter at Malofeev’s Tsargrad hotel, with suggestions he was even living there.

So what?

It has been and will always remain difficult to understand the intentions of Putin and Russian leadership. It seems that in Russia the oligarchs try and do what Putin wants even if he hasn’t told them what that is. If they fail, they deny ties to the Kremlin, the oligarchs, as in case of Bulgaria and Montenegro are lightly punished and given opportunity to try again. If there’s a success, like in Ukraine, the success is that of the Kremlin and Russia’s leadership not of the individual. Their one and only success in Ukraine has provided them with the motivations to continue to act in this way.

We have seen Malofeev use his business to promote Russian interests from inside the EU democratic system. He is helping to finance divisive, far-right nationalist groups in Europe for the benefit of Russia’s strategic policy and we have seen him attempt to acquire companies for the benefit of the Russian security and intelligence agencies. This seem to be a win-win for the Kremlin; however, Malofeev has provided more embarrassment than benefit. His failed coups hurt Russia’s reputation abroad and make it more difficult for Russia to do business. Malofeev sees himself as an ambassador but the world sees him as a bumbling billionaire regularly failing to carry out the Kremlin’s tasks.

We at night hope that the EU increases sanctions and scrutiny on Malofeev and his associates. Increased sanctions can and will help prevent destabilizing activity across EUrope, especially necessary at a time of global upheaval.

In the meantime, can Russia’s reputation really suffer the repeated mistakes of the self-appointed ambassador. nightingale will keep investigating and let you know.

Our sources/ further reading:

https://espresso.repubblica.it/attualita/2019/02/28/news/3-million-for-salvini-1.332104

https://www.bellingcat.com/news/uk-and-europe/2017/03/04/kremlins-balkan-gambit-part/

https://www.bellingcat.com/news/uk-and-europe/2017/03/25/balkan-gambit-part-2-montenegro-zugzwang/

https://www.bellingcat.com/news/uk-and-europe/2019/09/03/lega-nords-bedfellows-russians-offering-illicit-funding-to-italian-far-right-party-identified/

https://www.lefigaro.fr/international/2018/12/07/01003-20181207ARTFIG00367-russie-konstantin-malofeev-evangeliste-du-kremlin-et-apotre-des-populismes.php

On 14th April 2020, Major General Valery Shaytanov was arrested by the Security Service of Ukraine (SBU). Shaytanov was formerly head of the SBU’s special operations department, which is focused on counter-terrorism. He is alleged to have worked for Russia’s Federal Security Service (FSB) and has been charged with treason and terrorism. Shaytanov is accused of leaking secret information to Russia, recruiting other Ukrainian officers to work for the FSB and taking part in assassination plots.

According to the SBU, Shaytanov was recruited by Colonel Igor Egorov. It has been revealed that Egorov is a senior officer from FSB’s elite Spetznaz force known as Department V who received a medal for his role in annexing Crimea. Thanks to Bellingcat investigations, we now know that Egorov also went by the nom-de-guerre “Elbrus”, who described himself as an advisor to the LNR leadership. Commander “Elbrus” also arrived in occupied Eastern Ukraine days before the downing of MH17 – it is clear from the phone calls that Elbrus has a decision-making role in Donetsk and Luhansk, so his arrival just days before the tragic events of 17th July certainly leaves questions to be answered.

One of Shaytanov and Egorov’s target was Adam Osmayev. Osmayev was a fighter in the Chechen wars and former commander of the Chechen volunteer battalion on Ukraine’s side in the war in Eastern Ukraine. Osmayev has survived two other assassinations attempts in the pasts; however, his wife, an activist and also a veteran of the war in Eastern Ukraine, was killed on 30th October 2017, just ten kilometers outside Kyiv.

Adam Osmayev was not the only Chechen target of Egorov’s Department V. Bellingcat revealed in February that units from the department were involved in the extrajudicial killing of Zelimkhan Khangoshvili. In fact Colonel Egorov traveled back to Moscow on 23rd August 2019 just after the assassination of Khangoshvili.

The SBU published photos of a meet-up between Col. Egorov and the man hired to carry out the assassination in Hamburg, Germany. According to their press statement, Egorov, Shaytanov and the would-be assassin took place in Germany, France and Croatia.

Bellingcat provided a lot of details about the travel patterns of Egorov and it is clear that he was able to travel freely in Europe and beyond. In addition to this, he frequently traveled between Rostov, Simferopol and Krasnodar, three locations of control centers for military operations against Ukraine. The list of countries that Egorov visited is long: Germany, Jordan, Ukraine, Belarus, Croatia, Israel, Switzerland, Singapore, France, UAE, Montenegro. In December 2016, he received a multi-entry Schengen four-year visa. He used Germany for meetings to discuss assassinations, what he was doing in France and Croatia isn’t clear , but we would like to know. He also frequently traveled to Montenegro before the failed coup there in 2016.

Despite the serious nature of the story revealed by Bellingcat and SBU, this story has not reached very far. It is barely discussed outside of Ukraine, online nobody seems interested – we have to ask why.

This is a very complicated story with many twists and turns. It includes an Ukrainian double agent at the heart of the Ukrainian Secret Service. One man, Colonel Egorov of the FSB, appears to be linked to:

-The illegal annexation of Crimea by Russia
-The MH17 tragedy and the war in occupied Eastern Ukraine
-The attempted coup in Montenegro
-One planned assassination in Germany (Osmayev) and possibly the assassination of Khangoshvili

And this is just what we know…

Maybe it doesn’t seem that surprising that Russia is spying on its neighbor in Ukraine, but Major General Shaytanov, if he did what he is accused of, will have passed information to the Russians which weakened his motherland. He will have passed information on what the Ukrainians were planning to do in their war with the Russian aggressor. His actions could have led to his compatriots deaths. The United Nations estimates that up to 13,000 Ukrainians have died in the war in Eastern Ukraine with a quarter of them estimated to be civilians.

Maybe the West doesn’t care about assassinations of Chechens even when these are planned and take place on their own soil. But this story is really very alarming, Russian Special Services operatives appear to have free reign at the moment. We know that Department V is involved in subversive operations including illegal reconnaissance, subversion, kidnappings, freeing hostages, coups d’etat and assassinations of enemies of the state. It is unbelievable to think that people involved in such kinds of things can go wherever they would like! Maybe now it feels like it affects only distant places which Western audiences don’t understand like Chechnya, Montenegro and Ukraine but the reports reveal that Russia sees Europe as a playground for its operations and who knows what countries or citizens might be the target next.

The November release from Bellingcat (‘The Dreadful Eight: GRU’s Unit 29155 and the poisoning of Emilian Gebrev’) contained evidence of a GRU operative that went by the name of ‘Georgy Gorshkov’. He was one of two GRU officers who travlled under cover to Bulgaria in April 2015, just days before Bulgarian national Emilian Gebrev fell seriously ill after being poisoned. He left the country just days after, along with his accomplice ‘Sergey Fedotov’.

https://017qndpynh-flywheel.netdna-ssl.com/wp-content/uploads/2019/11/gorshkov_sharp.png

We can now reveal that ‘Georgy Gorshkov’ goes by the name of Egor Aleksandrovich Gordienko in real life. Our investigations uncovered that in 2017 he was posted as a Russian diplomat to the World Trade Organization in Geneva. Multiple sources, including people who recognized him from his time in Generva, confirmed that Gordienko is the man pictured as Gorshkov in the Bellingcat article. We found his name listed as an attache (3rd Secretary) to the WTO in 2017. We’ve also spoken to an individual who knew Gordienko as a keen runner. His name is indeed entered in two organized races in Geneva held in 2018. He took part in the 5km Men’s Run at the Antigel Run in January 2018 and it appears he was registered for the Course de l’Escalade but didn’t run it, it seems he had to leave Geneva suddenly. We don’t know why.

What were unit 29155 trying to do that required a would-be assassin being posted to the WTO?

The fact that Russia is involved in delivering influence operations to their adversaries should be no surprise to anyone. More specifically, via the IRA or the Internet Research Agency. This is the name of the St Petersburg based Russian troll factory funded by Yevgeny Prigozhin. The agency continues to spread false information and disseminate social divisions through multiple Western-based social media platforms. Notably on Facebook, Twitter and Instagram.

Who is Yevgeny Prigozhin? You might know him by his nickname. Putins chef.

Prigozhin is one of the Kremlin’s inner circle. The true definition of an oligarch, with a palace in St Petersburg, a yacht, a private plane and a helipad. His company is believed to be a main backer of the IRA. He seems to have multiple links to the Kremlin, be that the IRA, or the PMC Wagner.

The IRA was based at 55 Savushkina Street, St Petersburg before it officially ceased operations in December 2016. However, it is apparent their work continues. “They have a lot of legal entities, and they still, I think, change it every year or every two years.”

Back in 2015 the employees of the IRA were aged between 20 and 30 but were drawn from a broad cross-section of Russian society. It seemed as if the agency’s task was so large that it would hire almost anyone who responded to the many ads it posted, no matter how under-educated or politically ignorant they were.

“Internet operators are required! Work in a chic office in OLGINO !!!! payment 25 960 per month. Objective: posting comments on specialized Internet sites, writing thematic posts, blogs, social networks. Screenshot reports. The work schedule is selected individually/ Payment is weekly, 1180 per shift (from 8.00-16.00, from 10.30-18.30m from 14.00-22.00) PAYMENTS WEEKLY AND FREE FOOD!!! Official and contractual employment (optional) Training is possible!”

During the last few years a large number of IRA employees has been named to the public. Most notable perhaps is Dzheykhun Nasimi Ogly Aslanov. Aslanov was named in a 2016 OFAC sanction which read “Aslanov acted for or on behalf of and provided material and technological support to the IRA. Aslanov acted as the head of the translator project, a department which focused on the United States and conducted operations on multiple social media platforms. He also oversaw many of the operations that targeted the 2016 U.S. election.”

The IRA’s involvement in 2016 US presidential elections is well known. This connection was widely and thoroughly discussed in the US Grand Jury indictment.

Additionally there are sanctions against Prigozhin and the IRA for their attempts to influence 2018 US midterm elections.

The IRA has been the center of a lot of attention recently. The most recent being in a report written by Graphika released in October.

The report was written because Facebook announced the take-down of 50 Instagram accounts posting about US social and political issues and 2020 election. These accounts claimed to represent multiple politically active US communities including black activist groups, advocates speaking out against police violence, police supporters, southern Confederates and supporters of Senator Bernie Sanders and President Donald Trump.

Facebook attributed IRACopyPasta to operators “originating from Russia” who showed “some links” to the IRA.

“Instagram was perhaps the most effective platform for the Internet Research Agency.”

But, what have the IRA been up to recently, where do their efforts lie?

We at ‘nightingale’ have identified that in September 2018, the IRA directed malign influence operations at Estonia. Their attack was three-fold. IT focused on the separatism of Narva, Nazis and fasicsm and Estexit.

Comments included; calls for NArva and the neighboring region of East Vironia to prepare to separate from Estonia, the growth of Nazi movements in Estonia and the effects this had on society, the EU being responsible for the economic problems in Estonia.

Another topic of discussion was placing the blame on the EU and NATO for the normalization of same-sex couples heading families. We have seen the IRA posting LGBT hate previously, so it’s not that surprising.

Why Africa?

Apparently their main interest at the moment is Africa. But why? Russian interest in Africa is a lot more widespread than the IRA. Russia have been making deals and spending money and making commitments all over Africa. Not including the numerous reports of the presence of Wagner mercenaries in Africa.

Putins interest in building Russia-Africa relations could stem from; Western sanctions against Russia, its unsuccessful pivot to China, hopes for billions of dollars in Middle East involvement which have not arrived in the quantities expected, the value of African votes at the United Nations.

There are also some very clear economic motives for Russian involvement in Africa. One being the diamond mining industry. Russia has a shortage of minerals such as manganese, bauxite and chromium, which Africa has in abundance.

“They’re collecting friends and allies, and they’re finding permissive environments to sell their wares and gain commercial opportunities.”

According to leaked documents, Russia is seeking to reinforce its existence in Africa by building relations with current rulers, striking military deals and grooming a new generation of “leaders” and undercover “agents”.

Activity online

On 30th October this year Facebook reportedly suspended three networks of Russian internet accounts aimed at covertly influencing events in several African countries. This list includes Madagascar, CAR, Mozambique, Democratic Republic of Congo, Ivory Coast, Cameroon, Sudan and Libya.

It is evident that Facebook are working hard to remove any suspicious accounts.

You can get banned on Facebook for being involved in rule breaking activities, some of which include: hate speech, credible threats or direct attacks on an individual or group, fake or impostor profiles and spam.

It is also against the Facebook community standards to maintain more than one personal account.

Bearing this in mind, how on earth do the vast majority of IRA accounts avoid detection on Facebook and Instagram?

Well, you could speculate forever with how their infrastructure works, but apparently you can avoid detection on Facebook by following these simple techniques when it comes to adding friends.

1) Manually add no more than 15 friends in a 24-hour period,
2) Cancel any friend requests which are left unanswered within a 24-hour period,
3) Do not send friends requests to every page visited

Maybe something to keep an eye on Facebook?

Last time we told you about GRU officer Sergei Parubin who is currently working in Belgrade, alongside Georgiy Kleban. We’ve been looking closely at Parubin and he seems particularly interesting to us. According to what we’ve been able to find, it seems that Parubin has a long history in the Balkan region not just Belgrade, previously serving in Zagreb, Croatia up to 2015. This isn’t even his first time in Belgrade, he was previously there in the early 2000s up to 2009. The GRU seem to rotate their military attaches and assistants throughout Russian embassies across the Balkan capitals, keeping them in the area for years. This is not normal behavior in other parts of Europe but seems to be here.

So what? Who cares? Why does that matter?

It’s probably much easier for GRU officers to stay in the same region for a long time, especially somewhere like the Balkans where people cross over into a neighboring country all the time to see family and friends. If you were for example a GRU officer, named Sergei Parubin, then you would be able to move around between countries easily with the perfect excuse of visiting some “friends” and if those friends just happened to be people you were paying to give you secret information…even better! It also means you don’t have to pass your agents off to someone new which is probably quite hard to do. New people might make mistakes and then get caught and all your hard work would go to waste or your agent might not get on with someone new… what happens if they bring the wrong type of Vodka? Not a problem for the GRU! They have been able to keep people like Parubin in the region for so long, they don’t need to take any extra risk and can carry on with whatever they’re up to as if nothing had changed!

And this is exactly what is being shown in the recent video that was leaked involving Parubin’s colleague Kleban. A GRU Officer with his Balkan friend… exchanging data for money (and the obligatory bottle of Vodka). Even more worrying is the fact that it is being done so casually. So openly. There are no dark alleyways or hidden meeting areas. No secret spy-like meeting point in the corner of a park or behind an abandoned building. It’s just two guys brazenly, though somewhat hurriedly, exchanging their goods at a bar over a nice beer. Well, we assume it’s a nice beer… and we assume it was a nice bottle of vodka!

As the latest spy game shows, the GRU don’t always slip under the radar though. Earlier this month a GRU officer, Vladimir Rusyaev, was declared a “Persona Non Grata” (PNG) in Bulgaria and expelled from the country for running a network of spies! https://www.icrazemagazine.com/news/nato-ally-expels-undercover-russian-spy/69631/

Numbers at the Russian Embassy in Belgrade are constantly on the rise. It is the largest in the region and more and more of this number are made up of intelligence officers. More officers like Kleban’s friend Sergei Parubin. What exactly is this guy’s role in everything? We’ll be investigating him further… and we invite you to do the same.

So…what is going on in Serbia?

Understandably the reaction in Serbia has been one of alarm. President Vucic said in a press conference after a National Security Council that some actions will be taken against foreign intelligence services that would be publicly visible.

We look forward to seeing the results of this action and wonder whether Sergei Parubin will be affected by these actions. If he does leave Serbia, it will be interesting to see whether he eventually reappears in another Balkan country… meaning he won’t really have left Serbia at all.

The question remains as to the motives of the GRU’s increased activities in Belgrade. President Vucic said that his only question for President Putin was “Why?” and we have the very same question. Is this part of an increasing malign campaign by the Russian government in the Balkans? Or are we looking at the early stages of another coup attempt? We’re looking for the answers and we will be back soon.

Last week a video was anonymously leaked online and claimed to show a GRU officer, who was named in the leak as Colonel Kleban, paying off members of the Serbian military in Belgrade. ‘nightingale’ were able to identify images of Kleban online in his full military regalia and think it’s clearly the same person, but if that’s not enough, Bellingcat think so too: https://twitter.com/christogrozev/status/1196183790831443971. And if that wasn’t enough, even the Serbian security services have since publicly confirmed that the video is genuine and Kleban is a GRU officer.

So… who is this Kleban guy? Kleban has been Deputy Defense Attache to Serbia since October 2015, but his recent 15 minutes of fame are a small drop in the ocean of Russian operations against the countries of the Western Balkans. In October 2016, the GRU organized, financed and facilitated an attempted coup in Montenegro. We previously shared with you some details of GRU operations and their use of local proxies and this was no different. The GRU used 10 Serbian gang members and Montenegrin opposition politicians to do their dirty work.

A recent New York Times article tied this attempted Coup to the secret GRU unit 29155, headed up by Major-General Andrei Averyanov. 29155 being the same unit responsible for the 2018 Salisbury nerve agent attack. Bellingcat did some further research on this secret unit and its Commander which can be found here: https://www.bellingcat.com/news/uk-and-europe/2019/10/14/averyanov-chepiga/

Two GRU officers from unit 29155 were tried “in absentia” and sentenced following the attempted coup: Eduard Shishmakov and Vladimir Popov, both charged with terrorism and criminal conspiracy. They were sentenced to 15 and 12 years respectively. Bellingcat subsequently revealed the true identity of Popov as Vladimir Moiseev. Among this trial, which was the largest in Montenegrin history, a former Serbian Gendarmerie Commander (Bratislav Dikic) was also charged with terrorism and sentenced to 8 years. This is, we believe, the first time two serving GRU officers have been sentenced under these charges in a NATO country. Go Montenegro!

But Kleban and Shishmakov are not the only Russian GRU officers present in the Balkans. ‘nightingale’ can exclusively reveal that Kleban is also closely associated with another GRU officer in Belgrade: Colonel Sergei Vladimirovich Parubin, who is currently listed as the Assistant Military Attache in Belgrade. Here they are both seen attending an event at the school at the Embassy of Russia in Serbia.

‘nightingale’ have been looking at GRU activity in the Balkans for a while now and this Parubin guy seems really interesting to us. We’ll be back soon when we’ve done some more research on him and can share more details with you.