Analysis: HUMINT insights from the Muller/Cherkasov case

June 20, 2022 by 6 Comments

AIVD HollandAT A TIME WHEN dozens of countries are routinely expelling record numbers of Russian intelligence officers, news of the unmasking of yet another Russian spy is barely newsworthy. However, the case of Sergey Cherkasov/Victor Muller is different. That is because, unlike the vast majority of Russian spies with blown covers, he did not operate under diplomatic protection. This is not necessarily uncommon —in fact, there are probably dozens of Russian case officers operating internationally without diplomatic cover. What is unusual is that one of them has been publicly unmasked. What is more, the case offers some interesting pointers for those interested in contemporary human intelligence (HUMINT).

The Facts

According to the Netherlands General Intelligence and Security Service (AIVD), which publicized the case last week, a man using a Brazilian passport attempted to enter Holland in April of this year. His passport had been issued under the name Victor Muller Ferreira, allegedly born to an Irish father and a Spanish-speaking mother in Niteroi (near Rio de Janeiro) on April 4, 1989. However, according to the AIVD, the man’s real name is Sergey Vladimirovich Cherkasov, a citizen of Russia, who was born on September 11, 1985. Based on the information released by Dutch intelligence, Cherkasov is an intelligence officer of the Main Directorate of the Russian Armed Forces’ General Staff, which is commonly known as the GRU.

The AIVD claims that the reason for Cherkasov’s visit to the Netherlands was to join the International Criminal Court (ICC) in The Hague, as a paid intern. He eventually planned to transition into full-time employment in the ICC, where he “would be highly valuable to the Russian intelligence services”. The AIVD reportedly notified the Dutch Immigration and Naturalization Service, which detained Cherkasov upon his arrival at Amsterdam’s Schiphol International Airport. The Dutch government declared the alleged GRU officer persona non grata and promptly expelled him back to Brazil “on the first flight out”.

Cherkasov’s Cover and Legend

Cherkasov arrived in Holland with a cover, a term that refers to a fake operational identity used for purposes of espionage. It is unlikely that his cover was natural, meaning that he is probably not Brazilian by birth —though it is possible that at least one of his parents was/is not Russian by birth. What is more likely is that Cherkasov’s cover is contractual, meaning that it was crafted especially for him by the GRU after he was hired as an intelligence officer. This likely happened as many as 10 years ago, when Cherkasov was in his early 20s. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , , , ,

Dutch intelligence disrupts Russian effort to infiltrate International Criminal Court

June 16, 2022 by 1 Comment

International Criminal CourtON JUNE 16, THE Dutch General Intelligence and Security Service (AIVD) announced that it prevented a Russian military intelligence officer from gaining access as an intern to the International Criminal Court (ICC) in The Hague. The ICC is of interest to the GRU because it investigates possible war crimes committed by Russia in the Russo-Georgian War of 2008 and more recently in Ukraine.

The GRU officer reportedly traveled from Brazil to Schiphol Airport in Amsterdam in April 2022, using a Brazilian cover identity, making him a so-called “illegal”. This means the intelligence operative was not formally associated with a Russian diplomatic facility. He allegedly planned to start an internship with the ICC, which would have given him access to the ICC’s building and systems. This could have enabled the GRU to collect intelligence, spot and recruit sources, and possibly influence criminal proceedings inside the ICC.

On his arrival at Schiphol, the AIVD informed the Dutch Immigration and Naturalization Service (IND), after which the officer was refused entry to the Netherlands and put on the first plane back to Brazil as persona non grata. The AIVD assessed the officer as a “potentially very serious” threat to both national security and the security of the ICC and Holland’s international allies, due to his access to the organization.

In a first-ever for the AIVD, the agency also released the contents of a partially redacted 4-page document that describes the “extensive and complex” cover identity of the officer. It was originally written in Portuguese, “probably created around mid-2010” and “likely written” by the officer himself. According to the AIVD, the information provides valuable insight into his modus operandi. The cover identity hid any and all links between him and Russia. According to the AIVD, the construction of this kind of cover identity “generally takes years to complete”.

In the note accompanying the document, the AIVD says that Russian intelligence services “spend years” on the construction of cover identities for illegals, using “information on how other countries register and store personal data”. Alternatively, they illegally procure or forge identity documents. Information in the cover identity “can therefore be traceable to one or more actual persons, living or dead” as well as to forged identities of individuals “who only exist on paper or in registries of local authorities”.

► Author: Matthijs Koot | Date: 17 June 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Russian diplomats expelled from Ireland ‘met with members of paramilitary groups’

April 5, 2022 by 2 Comments

Russian embassy IrelandFOUR RUSSIAN DIPLOMATS, WHO Ireland claims are undercover intelligence officers, met with Irish paramilitaries as part of a wider plan to “stoke political unrest” in Britain and Ireland, according to a new report. In a press conference held in Dublin last week, Irish Taoiseach (Prime Minister) Micheál Martin announced that his government would expel four employees of the Russian Embassy there.

Martin did not provide details about the Russian diplomats, nor did he give their names. He said, however, that his administration had been provided with detailed information about the activities of the Russians by members of the National Crime and Security Intelligence Service of the An Garda Síochána (police service of the Republic of Ireland) and the Defence Intelligence Section of the Irish Armed Forces.

On Monday, an article by the London-based Times newspaper alleged that a major reason why Dublin decided to expel the Russian diplomats was their “efforts to cultivate contacts with dissident republicans and loyalist paramilitaries” in the Republic of Ireland and in Northern Ireland, which is British soil. The Russian diplomats began meeting dissident republicans under the pretext of attending lectures and presentations on Irish history in Dublin and elsewhere, The Times said.

According to the paper, the activities of the Russian diplomats were part of a wider campaign by Russian intelligence to “undermine confidence” in European institutions, by exploiting nationalist tensions stirred by Britain’s recent exit from the European Union. The effort is being led by the Main Intelligence Directorate of the General Staff of the Russian Armed Forces, which is widely known by its Cold War-era initials, GRU. The spy agency is in charge of a campaign to amplify the voices of republican and loyalist paramilitary groups on social media and other platforms, in order to undermine regional security, The Times said.

The paper added that at least one of the four expelled Russian diplomats is believed to be an intelligence officer for the GRU. IntelNews has discussed previously a number of concerns among Irish officials regarding the size of the Russian embassy in Dublin. Many believe that Moscow intends to turn its embassy in the Irish capital into a major espionage hub in Europe. In 2018, the Irish government denied a request by Moscow to expand its embassy complex by 86,000 sq ft.

► Author: Joseph Fitsanakis | Date: 05 April 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

More Russian spies in Mexico than anywhere else in the world, US official claims

March 28, 2022 by Leave a comment

Glen VanHerckTHE PRESIDENT OF MEXICO has stated that his country is “sovereign” in response to comments, made by a senior United States military official, that Mexico hosts more Russian intelligence personnel than any other country in the world. These claims were made on Thursday by US Air Force General Glen VanHerck (pictured), during his appearance before the Senate Committee on Armed Services. General VanHerck is commander of the US Northern Command, which is one of the US Department of Defense’s eleven unified combatant commands.

While speaking at the open-door hearing on Thursday, General VanHerck said the Russian embassy in Mexico City was among the largest in all of Latin America. He added that the embassy hosts an unusually high number of officers of the Main Directorate of the General Staff of Russia’s Armed Forces. Known by its Russian initials, GRU, the Directorate is Moscow’s primary military intelligence agency. According to General VanHerck, the GRU uses Russian diplomatic facilities in Mexico as a base from which to access the United States.

The general added that Russian and Chinese intelligence operatives were “very aggressive and active” in the entire area that falls under the regional mission of the US Northern Command, including in Caribbean islands, such as the Bahamas. As the intelligence competition between the US and Russia heats up over Ukraine, Latin America and the Caribbean have the potential to attract intelligence personnel from both the United States and Russia.

Speaking on Friday at a scheduled press conference in Mexico City, Mexico’s President, Andres Manuel Lopez Obrador, appeared to evade a question by a journalist about General VanHerck’s allegations. When asked to respond to the allegations, President Obrador said he and his team “don’t have information on this”. He went on to state that Mexico is a “free, independent, sovereign country”, adding that the country’s territory was not a base from which “Moscow […] Beijing or Washington” could “spy on anybody”. The Russian embassy in Mexico City has not yet commented on General VanHerck’s claims.

► Author: Joseph Fitsanakis | Date: 28 March 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

Dutch intelligence disrupt large-scale botnet belonging to Russian spy agency

March 7, 2022 by Leave a comment

GRU KtON MARCH 3, 2022, Dutch newspaper Volkskrant reported that the Dutch Military Intelligence and Security Service (MIVD) took action in response to abuse of SOHO-grade network devices in the Netherlands. The attacks are believed to have been perpetrated by the Main Intelligence Directorate of the General Staff of the Russian Armed Forces (GRU) Unit 74455. The unit, which is also known as Sandworm or BlackEnergy, is linked to numerous instances of influence operations and sabotage around the world.

The devices had reportedly been compromised and made part of a large-scale botnet consisting of thousands of devices around the globe, which the GRU has been using to carry out digital attacks. The MIVD traced affected devices in the Netherlands and informed their owners, MIVD chief Jan Swillens told Volkskrant. The MIVD’s discovery came after American and British [pdf] services warned in late February that Russian operatives were using a formerly undisclosed kind of malware, dubbed Cyclops Blink. According to authorities, the botnet in which the compromised devices were incorporated has been active since at least June 2019.

Cyclops Blink leverages a vulnerability in WatchGuard Firebox appliances that can be exploited if the device is configured to allow unrestricted remote management. This feature is disabled by default. The malware has persistence, in that it can survive device reboots and firmware updates. The United Kingdom’s National Cyber Security Centre describes Cyclops Blink as a “highly sophisticated piece of malware”.

Some owners of affected devices in the Netherlands were asked by the MIVD to (voluntarily) hand over infected devices. They were advised to replace the router, and in a few cases given a “coupon” for an alternative router, according to the Volkskrant. The precise number of devices compromised in the Netherlands is unclear, but is reportedly in the order of dozens. Swillens said the public disclosure is aimed at raising public awareness. “The threat is sometimes closer than you think. We want to make citizens aware of this. Consumer and SOHO devices, used by the grocery around the corner, so to speak, are leveraged by foreign state actors”, he added.

The disclosure can also be said to fit in the strategy of public attribution that was first mentioned in the Netherlands’ Defense Cyber Strategy of 2018. Published shortly after the disclosure of the disruption by MIVD of an attempted GRU attack against the computer network of the OPCW, the new strategy included the development of attribution capabilities, as well as the development of offensive capabilities in support of attribution. It advocates the view that state actors “that are [publicly] held accountable for their actions will make a different assessment than attackers who can operate in complete anonymity”.

► Author: Matthijs Koot | Date: 07 March 2022 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

US Army Special Forces soldier sentenced to 15 years for spying for Russia

May 17, 2021 by 1 Comment

Peter Debbins

A FORMER MEMBER OF the United States Army’s Special Forces has been sentenced for spying for Russia for 15 years, after he was reportedly groomed by Russian military intelligence at a young age. Peter Debbins, 46, born in the US to an American father and a Soviet-born mother, admitted in 2020 to spying for Russia for over 20 years.

Even though he had Russian background from his mother’s side of the family, he had never been to Russia until he traveled there in 1994. On that trip he met his Russian family members for the first time, as well as a young Russian woman who would eventually become his wife. In 1996 Debbins returned to Russia as an exchange student from the University of Minnesota, and reconnected with a Russian woman. She was from the city of Chelyabinsk, located near the Russian-Kazakh border. The woman’s father was reportedly a colonel in the Russian Air Force.

It was during that second trip, according to the Federal Bureau of Investigation, that he was spotted by the Main Directorate of the Russian Armed Forces’ General Staff, known commonly as GRU. By 1997, when Debbins returned to Russia to marry his girlfriend, he was already working for the GRU, according to US government prosecutors. It is stated in his indictment that he told his GRU handler he saw himself as a “son of Russia” and sought to limit America’s dominance in the world.

Between 1998 and 2005, Debbins served in the US Army, where he became a Green Beret. He was discharged and lost his security clearance after “violating protocols” while he was stationed in Azerbaijan. Throughout his time in the US Army, Debbins frequently traveled to Russia, where his wife was studying at the time. While there he met with his GRU handlers. The court heard that he gave the GRU information on a variety of classified subjects, as well as private information on other members of the Green Berets. This information was intended to be used to blackmail these soldiers to work for the GRU.

Following his stint in the US Army, Debbins worked as a contractor for the US military, on topics relating to Russian language translation, as well as counterintelligence. Throughout that time, he reportedly continued to apply for dozens of positions in the US intelligence community, but without success. He is believed to have stopped spying for Russia in 2011.

The judge who hand down Debbins’ sentence ordered that his incarceration should begin immediately. Debbins’ legal team has requested that he be incarcerated near the Washington Metropolitan Area, so that he can remain in contact with his wife and four daughters.

► Author: Joseph Fitsanakis | Date: 17 May 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Czechs ask EU and NATO to expel Russian diplomats in solidarity against Moscow

April 20, 2021 by Leave a comment

Jan HamacekCZECH GOVERNMENT OFFICIALS SAID they would welcome the expulsion of Russian diplomats from European Union and North Atlantic Treaty Organization countries, in support of Prague’s ongoing diplomatic spat with Moscow. The Czech Republic expelled 18 Russian diplomats last weekend, in order to protest against an explosion at a remote munition depot in the east of the country, which the government claims was part of a Russian intelligence operation.

As intelNews reported on Monday, the explosion occurred in October of 2014. It killed two people and destroyed a munitions storage facility belonging to the Military Technical Institute of the Czech Ministry of Defense. Although the blast was initially classified as an accident, Czech investigators have recently come to the conclusion that it was in fact caused by Unit 29155, a Russian elite spy outfit. Little is known about Unit 29155, which is believed to operate under the Main Directorate of the General Staff of the Russian Armed Forces, commonly known as GRU.

The Kremlin responded to the expulsions of its diplomats by ordering 20 Czech diplomats to leave Russia, and condemning Prague’s move as an “unprecedented” and “a hostile act” that was designed “to please the United States”. Meanwhile the Czech Republic’s acting Minister of Foreign Affairs, Jan Hamacek (pictured), stated on Tuesday that Prague “would welcome” if its allies in the EU and NATO “expelled officers of Russian special services” in the coming days, in an act of solidarity with the efforts of his office.

Following consultations with Hamacek, the office of the EU’s High Representative for Foreign Affairs and Security Policy said that it stood in “full support and solidarity” with the Czech Republic. No EU or NATO country has so far announced that it plans to expel Russian diplomats in response to Prague’s request. According to Czech media, discussions on the matter between Hamacek and several of his counterparts in the EU’s so-called Visegrad Group —consisting of Poland, the Czech Republic, Hungary, and Slovakia— are ongoing.

► Author: Joseph Fitsanakis | Date: 20 April 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

Russia expels Czech diplomats after Prague links Kremlin to munitions depot explosion

April 19, 2021 by 1 Comment

Vrbětice Czech Republic ammunition depot explosions

RUSSIA AND THE CZECH Republic ordered expulsions of each other’s diplomats over the weekend, after authorities in Prague said the Kremlin was behind a mystery explosion that leveled a munitions depot. The explosion took place on October 16, 2014, in a remote forest area near the village of Vlachovice, which is situated 171 miles southeast of the Czech capital, Prague.

The storage depot belonged to the Military Technical Institute of the Czech Ministry of Defense, and it was managed by a contractor, Imex Group. The blast killed two security guards and forced the evacuation of several communities located nearby. It was assumed to have been the result of an accident, though investigators were unable to determine the cause of the explosion.

On Saturday, Czech authorities announced that the blast was the work of Unit 29155, a Russian elite spy outfit, whose goal is to subvert European political and economic systems and processes. As intelNews has reported in the past, Unit 29155 operates under the Main Directorate of the General Staff of the Russian Armed Forces, commonly known as GRU. It has allegedly been in existence since at least 2009. According to Czech investigators, two members of Unit 29155 visited the munitions depot days prior to the explosion. They used forged passports from Tajikistan and Moldova, and claimed to be members of the National Guard of Tajikistan that were scheduled for an inspection. Based on their passport photographs, the two men, who used the cover names Ruslan Tabarov and Nicolaj Popa, appear to be the same men who tried to kill GRU defector Sergei Skripal in England in 2018.

The reasons why the Russians allegedly decided to blow up the munitions depot are unclear. It is speculated that some of the weapons in the depot were intended to be delivered to Ukraine on behalf of Bulgarian weapons dealer Emilian Gebrev. In 2015 Gebrev was hospitalized for several days for signs of poisoning, along with his son and one of his company’s executives. They eventually made a full recovery, but have since alleged that they were targeted by Moscow, because Gebrev’s firm sells weapons to adversaries of the Kremlin, including the government of Ukraine.

On Saturday, the Czech government gave 18 Russian diplomats, which its claims are intelligence officers, 48 hours to leave the country. It also said it would provide detailed information about its probe into the blast to European Union ministers and representatives of the North Atlantic Treaty Organization. But Moscow called the allegations “unfounded and absurd” and condemned the expulsions of its diplomats, describing them as “unprecedented” and “a hostile act” that was designed “to please the United States”. On Sunday, the Russian Ministry of Foreign Affairs announced that 20 diplomats of the Czech Republic would be expelled from Russian in retaliation to the expulsion of its diplomats by its former Cold War ally.

► Author: Joseph Fitsanakis | Date: 19 April 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Bulgaria expels Russian diplomats over spy claims, Moscow threatens retaliation

March 24, 2021 by Leave a comment

Bulgaria MFA

TWO RUSSIAN DIPLOMATS STATIONED in Bulgaria were declared personae non grata by the Bulgarian government on Monday, after they were allegedly implicated in acts of espionage, according to reports. The two Russians, who have not been officially named, were stationed at the embassy of Russia in the Bulgarian capital Sofia. They were allegedly implicated in an espionage affair that has resulted in the arrests of at least six Bulgarian citizens, accused of carrying out acts of espionage on behalf of Moscow.

As intelNews reported on Monday, six members of the alleged spy-ring were arrested by Bulgarian counterintelligence on Thursday, March 18. They were charged with espionage on behalf of the Main Directorate of the General Staff of the Russian Armed Forces, known commonly as GRU, which is Russia’s main military intelligence agency. The six alleged spies reportedly gave Moscow secrets about Bulgarian military affairs, as well as information concerning the North Atlantic Treaty Organization and the European Union. Bulgaria, a former ally of the Soviet Union, joined NATO in 2004 and the EU in 2007.

On Tuesday, the Bulgarian Ministry of Foreign Affairs said it proceeded to declare the two Russian diplomats personae non grata on March 22. The decision to expel the diplomats was reportedly taken soon after the ministry received official confirmation from the state prosecutor’s office that the two Russians had been implicated in the alleged spy ring’s espionage activities. The Russian embassy was given 72 hours to make arrangements for the two diplomats to leave Bulgaria. Nor further information was provided by the ministry.

The Russian embassy in Sofia said on Tuesday that the Kremlin could carry out reprisals against the Bulgarian government in the coming days —potentially by expelling at least two Bulgarian diplomats from Moscow or St. Petersburgh. In a statement posted on its website, the embassy blasted what it described as “another groundless demarche of the Bulgarian authorities [that] will not contribute to the further building of a constructive Russian-Bulgarian dialogue”. The statement added that “[t]he Russian side reserves the right to retaliate” to the Russian diplomats’ expulsions.

► Author: Joseph Fitsanakis | Date: 24 March 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Bulgaria confirms arrest of six-member spy-ring allegedly working for Russia

March 22, 2021 by Leave a comment

Russian embassy Bulgaria

AUTHORITIES IN BULGARIA HAVE confirmed media reports aired last week, which alleged that at least six members of a spy-ring working for the government of Russia had been arrested in the capital Sofia. News of the arrests was first reported by the Bulgarian National Television, or BNT, late on Thursday, March 18. Citing “government sources”, BNT said that “several” Bulgarian citizens had been arrested in simultaneous raids by the country’s counterintelligence service.

On Friday, March 19, the Bulgarian government confirmed the BNT report, saying that six Bulgarian citizens had been charged with espionage on behalf of the Main Directorate of the General Staff of the Russian Armed Forces, known commonly as GRU. The GRU is Russia’s foremost military intelligence agency. The six alleged spies reportedly gave Moscow secrets about Bulgarian military affairs, as well as information concerning the North Atlantic Treaty Organization (NATO) and the European Union (EU). Bulgaria, a former ally of the Soviet Union, joined NATO in 2004 and the EU in 2007.

Some reports claim that the spy ring members also gave information to the Russians about the presence and operations of United States intelligence personnel in Bulgaria. The American intelligence agencies that were allegedly affected by these disclosures include the Central Intelligence Agency and the National Security Agency. The United States has not officially commented on these reports. On Friday, US Department of State spokesperson Ned Price tweeted that “Bulgaria is a friend, NATO ally, and partner”, adding that Washington was “attentively watching the Bulgarian investigation into an alleged Russian spy ring”.

The head of the alleged spy ring is reportedly a retired senior official in the Bulgarian Ministry of Defense, who was allegedly recruited by the GRU and received training in clandestine tradecraft from his Russian handlers. Another member is a retired military counterintelligence officer, who is currently serving in a counterintelligence capacity in the Bulgarian parliament. Three other members of the spy ring are active or retired officers in the Bulgarian armed forces. According to the BNT report, the wife of the head of the spy ring, who is a citizen of both Bulgaria and Russia, operated as a courier for the spy ring. She allegedly made regular visits to the Russian embassy in Sofia, where she delivered stolen secrets in return for cash payments.

The Office of the Bulgarian State Prosecutor published a 20-minute video on Friday, which contains intercepted audio recordings of alleged conversations between members of the spy group and their Russian handlers. The video also contains surreptitiously filmed footage of alleged meetings between the members of the spy ring and their Russian handlers in public places. Some of the footage shows the exchange of documents with cash payments between assets and handlers.

► Author: Joseph Fitsanakis | Date: 22 March 2021 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

Colombia and Russia expel diplomats over espionage allegations

December 24, 2020 by Leave a comment

SVR hqCOLOMBIA EXPELLED TWO RUSSIAN diplomats earlier this month, without publicly explaining why, according to news reports. Several Colombian news outlets reported on Tuesday that the two Russians were expelled after they were found engaging in espionage. Also on Tuesday, Colombian officials confirmed earlier reports that Moscow had expelled two Colombian diplomats in a tit-for-tat response.

At a press conference held in Bogota on Tuesday December 22, officials from Colombia’s Ministry of Foreign Affairs revealed that two Russian diplomats had been expelled from the Colombian capital on December 8. However, they refused to provide the reasons for the expulsions, other than to claim that the two Russians had “engaged in violations” of the Vienna Convention on Diplomatic Relations. In a separate interview, Colombian President Ivan Duque said that “to reveal more information at this moment would not correspond with the principal of continuing bilateral relations” between Colombia and Russia.

However, several leading Colombian newspapers, including El Tiempo and Semana claimed that the two Russians had engaged in espionage that targeted Colombia’s energy and minerals industry in the city of Cali. An urban center of 2.2 million inhabitants, Cali is known as southern Colombia’s leading economic hub, and is among Latin America’s fastest-growing local economies.

El Tiempo named the two Russians as Alexander Paristov and Alexander Belousov. Also on Tuesday, Colombia’s W Radio alleged that Paristov is an officer in the Russian Foreign Intelligence Service, which is the Russian equivallent of the United States’ Central Intelligence Agency. It added that Belousov is an officer in the Main Directorate of the Russian Armed Forces’ General Staff, which is known as GRU.

The Russian Ministry of Foreign Affairs and the Russian embassy in Bogota did not respond to questions by Colombian media about the diplomats’ expulsions.

► Author: Joseph Fitsanakis | Date: 24 December 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , ,

United States charges six Russian intelligence operatives with hacking

October 20, 2020 by 2 Comments

US Department of Justice

THE UNITED STATES DEPARTMENT of Justice has unsealed charges against six members of Russia’s military intelligence agency for allegedly engaging in worldwide computer hacking against several countries. The charges, announced in Pittsburgh on Monday, represent in a rare move that targets specific intelligence operatives and identifies them by name and visually. According to the US government, the six Russian operatives were instrumental in some of the most destructive and costly cyber-attacks that have taken place worldwide in the past five years.

The indictment alleges that the six Russian intelligence operatives were members of a hacker group named “Sandworm Team” and “Voodoo Bear” by cybersecurity experts. In reality, however, they were —and probably still are— employees of Unit 74455 of the Russian Armed Forces’ Main Intelligence Directorate, known as GRU. Their cyber-attacks employed the full resources of the GRU, according to the indictment. They were thus “highly advanced”, and were carried out in direct support of “Russian economic and national objectives”. At times, the group allegedly tried to hide its tracks and connections to the Russian government, by making it seem like its cyber-attacks were carried out by Chinese- and North Korean-linked hackers. However, according to the US government, its operations and targets were carried out “for the strategic benefit of Russia”.

The hacker group has been active since the end of 2015, and is alleged to have continued its operations until at least October of 2019. Alleged attacks include a major assault on the power grid of Ukraine in December of 2015, which left hundreds of thousands without electricity and heat. Other alleged attacks targeted the government of Georgia and the French national elections of 2017. The charges include alleged attacks on Western chemical laboratories that examined the toxic substance used in 2018 against former GRU officer Sergei Skripal in England.

Finally, some of the group’s alleged efforts centered on sabotaging the 2018 Winter Olympics in Pyeongchang, South Korea. Russian athletes were barred from the games, after the Russian government was accused of participating in wholesale doping of its Olympic team. Notably, none of the attacks connected with the group’s operations appeared to have directly targeted the United States —though some of the viruses that were allegedly unleashed by the group affected some American companies.

► Author: Joseph Fitsanakis | Date: 21 October 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

Bulgaria expels two Russian diplomats for espionage, Russia vows to respond in kind

September 24, 2020 by 1 Comment

Russian embassy BulgariaBulgaria, a once close Soviet ally, which is now a member of the European Union and the North Atlantic Treaty Organization, has expelled two Russian diplomats whom it accuses of conducting military espionage. This raises to five the number of Russian diplomats who have been expelled from Bulgaria for espionage in the past year.

In a hastily announced press conference on Wednesday, a spokesman for the Ministry of Foreign Affairs told reporters in the Bulgarian capital Sofia that the ministry had “declared two Russian diplomats personae non grate”, a Latin term meaning unwanted persons. He added that the Bulgarian government had notified the Russian embassy of its decision with an official diplomatic note. The two Russian diplomats, who have not been named, were given 72 hours to leave the country, said the spokesman.

In addition to the expulsion of the two diplomats, it was later reported that the Bulgarian government had denied an earlier request by Moscow to provide diplomatic accreditation to Russia’s new military attaché to the country, who was expected to assume his post in Sofia this coming December. It is believed that this action by the Bulgarian government is connected to the alleged espionage case involving the two Russian diplomats.

Bulgarian government prosecutors allege that the two Russians have engaged in espionage activities in Bulgaria since 2016. Their goal, according to the Bulgarians, was to obtain classified information about the technological modernization of the Bulgarian Armed Forces, which is ongoing. They had allegedly already made contacts with Bulgarian officials who were privy to such information, and in some cases had already provided them with money in exchange for secrets. The two diplomats are believed to be working for the Main Directorate of the Russian Armed Forces’ General Staff, which is commonly referred to as GRU.

The Russian Embassy in Sofia confirmed late on Wednesday that it had received a telephone call from the Bulgarian Ministry of Foreign Affairs, informing it of the expulsion order issued for the two diplomats. It added, however, that it had not been given proof of acts of espionage by the two diplomats. In the same statement, the Russian Embassy said the two diplomats would leave Bulgaria as instructed, but warned that Moscow reserved the right “to a response in kind”.

► Author: Joseph Fitsanakis | Date: 24 September 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

French lieutenant-colonel serving with NATO arrested for spying for Russia

August 31, 2020 by 1 Comment

Florence ParlyFrench authorities are reportedly investigating a senior military officer, who is serving with the North Atlantic Treaty Organization in Italy, for spying on behalf of Russia, according to a news report from France. On Sunday, France’s Minister of the Armed Forces, Florence Parly (pictured), gave a press conference in Paris, during which she provided limited information about the ongoing investigation. Parly said she could confirm that “a senior officer” in the French military was undergoing “legal proceedings” relating to a “security breach”. She refused to provide specific details on the case.

Later on Sunday, however, French radio station Europe 1 reported that the military officer was a lieutenant-colonel who is currently serving at a NATO facility in Italy. The officer is believed to speak Russian and is considered a specialist on Russian military affairs, said the station. It added that French authorities began investigating him after he was spotted in Italy with a man who was later identified as an intelligence officer with the Main Directorate of the General Staff of the Russian Armed Forces, known commonly as GRU. According to Europe 1, the French military officer was arrested by the General Directorate for Internal Security (DGSI), France’s counterintelligence and counterterrorism agency.

At the time of his arrest, the unnamed man was making preparations to return to his NATO post in Italy, after holidaying in France, according to the radio station’s report. He is currently in detention in the French capital on suspicion of having supplied classified military documents to Russian intelligence. Europe 1 cited an unnamed source who said the officer would be prosecuted for “collecting [and] sharing information with a foreign power” that “harms the fundamental interests of the [French] nation” and “harms national defense”.

► Author: Joseph Fitsanakis | Date: 31 August 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

Austrian financier dubbed ‘world’s most wanted man’ hiding under Russian protection

July 21, 2020 by 1 Comment

Jan MarsalekAn Austrian financier, who disappeared following the outbreak of a massive financial scandal in Germany last month, and is wanted by several Western spy agencies, is reportedly hiding under Russian protection. The financier, Jan Marsalek, dubbed by some as “the world’s most wanted man”, is connected with the sudden collapse of Wirecard AG in Germany last month.

Wirecard (est. 1999) was a German provider of financial services, such as mobile phone payment processing and other electronic payment transaction systems. The company also issued physical and virtual credit and pre-paid cards. But on June 25, the company declared itself insolvent, after an audit revealed that nearly €2 billion ($2.3 billion) in cash deposits were missing from its accounts. Soon afterwards, the company’s share value lost over 70 percent of its value and its management team, including its chief executive officer, Markus Braun, stepped down.

On June 22, Braun was arrested, and a criminal investigation was launched following reports that the missing €2 billion probably never existed in the first place. Meanwhile, German police sought to arrest Marsalek, who had worked as Wirecard’s chief operating officer since 2010. Marsalek, 40, was also in charge of Winecard’s operations in Asia and specifically the Philippines, where the fictitious €2 billion was reportedly deposited.

On June 18, after getting fired from his job, Marsalek told colleagues that he was leaving immediately for Manilla, in order to track down the missing funds and clear his name. However, he never arrived there, as he seemed to disappear into thin air on the way. An investigative report by The Financial Times revealed that Marsalek never made use of his airline ticket to the Philippine capital, and that the immigration records that showed him entering the country and then flying from there to China had been forged. This was later confirmed by the Philippines government.

According to the investigative website Bellingcat, Marsalek never went to the Philippines, but instead fled to Belarus via Estonia. By the time he arrived in Minsk, the Austrian financier was reportedly “a person of interest” to at least three Western spy agencies, and is now believed to have links to Russian intelligence. Bellingcat said Marsalek has made over 60 trips to Russia since 2010, in some cases staying on Russian soil for just a few hours before flying back to Germany. He is also wanted by several European governments on charges of embezzlement and fraud.

On Sunday, German financial newspaper Handelsblatt said Marsalek had been located in Russia and was allegedly staying at a villa outside Moscow, under the protection of Russian military intelligence. The newspaper claimed that the Austrian financier was being protected by officers of the Main Directorate of the General Staff of the Russian Armed Forces, which is commonly known as GRU. According to Handelsblatt, the current tension in relations between Russia and Belarus made it “too risky” for the Kremlin to keep Marsalek in the Belarussian capital. The decision was therefore made to secretly transport him to Moscow.

The German newspaper said it found out about Marsalek’s whereabouts from sources including “financiers, judges and diplomats”. On Monday the Russian government said it had no information about Marsalek’s current whereabouts. It also denied that the Austrian financier has any ties to its intelligence services.

► Author: Joseph Fitsanakis | Date: 21 July 2020 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

← Older posts

Newer posts →