The Russian authorities deny this version and insist that there was no pathogen leak; they claim Shipilova died of pneumonia. The silence of the officials caused concern not only amongst the residents of Irkutsk, but also globally. The World Health Organisation (WHO) has been concerned about the possible spread of the plague. The organisation stated that it was “monitoring the situation.” On October 10, the WHO reported that “a key uncertainty remains the absence of a confirmed diagnosis in the deceased laboratory worker.”

As early as October 5, the possibility of a plague outbreak was discussed at the White House, according to The Washington Post. The US authorities are attempting to obtain more information about the incident, and Trump has already offered Russia assistance. It is likely that the US authorities believe Moscow is concealing the scale of the incident. Speaking to Fox News, former CIA officer Dan Hoffman even compared the incident to the Chernobyl disaster. IStories look into the scale of the situation.

What happened in Irkutsk?

On September 25, Daria Shipilova, an employee of the Irkutsk Anti-Plague Institute, reportedly broke a test tube containing the pathogen responsible for pneumonic plague, according to Pavel Stepanov, a local blogger. Stepanov claims that the young woman “concealed this fact” and did not self isolate in order to avoid spreading the disease. “The number of people she had been in contact with ran into the hundreds, and you can imagine what a risk that poses,” said Stepanov.

Shortly afterwards, Shipilova started feeling unwell and was admitted to a hospital in Shelekhov. On the night of October 2, Shipilova died, and the hospital was placed under quarantine. The news quickly spread through local chat groups, and rumours of plague outbreak began to circulate. The authorities made no comment on the situation whatsoever. Against this backdrop, two further theories emerged: according to the first, the woman had been bitten by a rat; according to the second, she had contracted pneumonic plague while on a trip to Thailand. 

Stepanov’s version, however, became the prevailing one, albeit unofficial, and soon after journalists managed to identify the infected woman.

Does the plague still exist?

Humanity has never managed to completely eradicate the plague (unlike smallpox). The causative agent of the infection — Yersinia pestis — still exists in the wild and is carried by ground squirrels, rodents and many other animals. The infection is transmitted among animals via fleas.

The disease can only spread effectively amongst animals in certain regions of the world where certain species of small mammals and flea vectors are present. In these areas, the plague exists as natural foci.

According to Rospotrebnadzor, Russia’s public health and consumer protection agency, the natural foci of plague are present in at least 13 regions of the country — Kalmykia, Dagestan, Ingushetia, Karachay-Cherkessia, Chechnya, Tuva, Altai, Kabardino-Balkaria, the Astrakhan, Volgograd and Rostov oblasts, and the Stavropolsky and Zabaykalsky Krai. The bacterium particularly thrives in border areas near Kazakhstan, Mongolia, China, Azerbaijan and Georgia.

There are three main forms of the plague infection: bubonic, pneumonic and septicaemic. The infection is the same, but the symptoms and fatality rates are different. Bubonic plague, which was rampant in the Middle Ages, is now considered the mildest form. While the bubonic form is caused by an infected flea’s bite, or contacting the tissues of infected animals, pneumonic plague is caused by inhaling bacteria-laden droplets (tiny particles of moisture expelled by infected animals or people). Septicaemic plague, the rarest and most dangerous form, is caused by the bacteria entering the bloodstream directly.

Could there be a new epidemic?

Cases of plague infection in Russia are extremely rare. The latest officially recorded death from the plague occurred in 1979 in Kalmykia. Over the following 35 years, the disease would be scarcely mentioned. Between 2014 and 2016, Rospotrebnadzor recorded three non-fatal plague cases in Altai, where the cause was unlawful hunting of plague-infected grey ground squirrels. The most recent case was widely covered by the media: a ten-year-old boy visited his grandparents and contracted the plague whilst butchering a ground squirrel. He later recovered.

It is likely that all those three patients contracted the bubonic form, whilst the incident in Irkutsk — if it actually had to do with plague — involved the pneumonic form, which is more dangerous and can be transmitted between people via airborne droplets.

In reality, it is very difficult to contract plague this way. Transmission of the infection requires prolonged contact with the infected person. In modern Russia, there has never been a single recorded human-to-human transmission case. In the US, the latest recorded instance was in 1924.

Experts believe that a single case of pneumonic plague in Irkutsk is unlikely to trigger a full-blown epidemic. According to Irina Yakutenko, a molecular biologist, we are not at risk of a new ‘Black Death,’ even if the disease were to accidentally spread into a large town or city. The necessary transmission chain — “rats to fleas to humans” — is missing for it to spread further. Furthermore, doctors are able to trace contact chains and diagnose and treat the disease quickly.

“In Russia, the United States and in Europe there is no risk of a plague epidemic because the conditions to foster this risk are absent. As for the pneumonic form, the transmission chains are short because victims die before they have a chance to infect large numbers of people. For a bubonic plague epidemic, which would claim millions of people’s lives in the past, a sustained combination of poor sanitation, rats, fleas and people living together in close proximity is required,” Yakutenko told the BBC Russian Service.

Do anti-plague institutes pose a danger?

There are at least five anti-plague institutes in Russia — in Saratov, Volgograd, Rostov, Irkutsk and Stavropol. The Stavropol Research Institute also has two branches in Sochi and Budennovsk.

According to Stepanov, the Irkutsk Anti-Plague Institute has “deteriorated” in recent years. “Many people have left, and the expertise has weakened. It is possible that this is precisely what led to the tragedy,” he said. There is no confirmation on this information in open sources.

Experts, however, note that incidents in laboratories do indeed occur, even despite strict safety protocols. This also happens in developed countries and in laboratories with the highest biosafety levels, according to Irina Yakutenko.

Precautionary measures are to be set out in the institute’s internal documents. Furthermore, more general recommendations are available on the World Health Organisation (WHO) website.

Stepanov claims that the laboratory assistant breached numerous instructions. According to him, Daria did not inform the research institute’s officials about the incident, most importantly. It is not known whether she had been vaccinated and briefed on what to do in an emergency, and whether she wore a protective suit.

Daria’s colleagues were sceptical about this explanation. In an interview with a local outlet, Lyudi Baikala, they described her as a highly responsible worker.

“Daria was extremely anxious about infecting anyone if the worst were to happen. This was evident from how often she sanitised her hands, even outside of work,” one of her colleagues said.

Furthermore, the institute’s staff do not believe it was possible to simply break a test tube in the laboratory.

“That sort of thing doesn’t happen here. But even if she had broken one — the booth and the clothing are isolated. Nothing would have happened at all,” said a source speaking to Lyudi Baikala.

In global medical history, there had been another well-known case where a researcher studying the plague died from the disease. In 2009, Malcolm Casadaban, a biologist from the University of Chicago, died from the septicaemic form of the plague. The exact route of infection was never established. However, Casadaban’s colleagues said that was not consistently wearing protective gloves, and experts suggest that the bacteria entered his bloodstream through a small wound or mucosa.

How to manage plague outbreaks?

In the event of a plague outbreak, the WHO issues the following recommendations to the authorities: find and stop the source of infection; protect health workers by instructing them and providing them with protective equipment and antibiotics; isolate patients with pneumonic plague and ensure the correct treatment; identify and monitor close contacts of pneumonic plague patients and do the testing; responsibly disinfect the spaces and ensure safe burial practices.

The plague is treated with antibiotics, primarily fluoroquinolones and aminoglycosides. According to Yakutenko, if diagnosed early, a course of antibiotics (10–14 days) will be sufficient to save the patient’s life. With timely treatment, the plague mortality rate is 5–10%, while in the Middle Ages the fatality rate reached 90–100 per cent.

One should not self-medicate. In the case of the pneumonic form, it is not only the medication that is important, but isolation as well. Therefore, if suspicious symptoms arise, one must first and foremost consult a doctor.

Furthermore, the necessary medication may not be freely available. On October 3, Lyudi Baikala reported that plague antibiotics are hardly distributed to Irkutsk pharmacies, and where they are available, they are sold strictly on prescription in small quantities — there are at maximum five packs in stock. This is because the Irkutsk Oblast is not among the regions known to have natural foci of the plague.

What measures have the authorities already taken?

According to Lyudi Baikala’s report, on the evening of October 1, Irkutsk authorities held a meeting attended by the heads of law enforcement and administrative agencies. FSB officers were assigned to escort ambulances transporting people who had been in contact with Daria on their way to undergo examinations. On the first day alone, 90 people were placed in quarantine at a COVID-19 centre. On October 2, according to the Izvestia newspaper, there were 200 people.

The regional governor, Igor Kobzev, reported that Russia’s Chief State Sanitary Doctor, Anna Popova, was also present. According to Kobzev, everyone who had been in contact with the infected woman was under medical supervision, and so far no signs of the disease have been observed in them. However, he did not specify the cause of Daria Shipilova’s death.

It has been indirectly confirmed that the cause of death was the plague by Alexei Tsydenov, the head of the neighbouring Russian region, Buryatia. He stated that the deceased laboratory technician had not visited the Buryatia republic and that the source of the infection lay outside the region. Following this, Baikalsk (a town 145 km away from Irkutsk) authorities urged residents to refrain from travelling to Shelekhov (the town where Daria died) and its neighbouring settlements. Later, they deleted the post.

The Irkutsk Oblast authorities have not acknowledged the outbreak of plague yet. However, quarantine measures were introduced in the region: three city clinical hospitals (Nos. 1, 3 and 10), the Ivano-Matreninskaya Children’s Hospital and the city maternity hospital were placed under quarantine. On October 3, the Irkutsk Aluminium Plant in Shelekhov introduced a mask mandate for the first time since the pandemic began.

The press office of Rospotrebnadzor finally commented on the situation on October 4. The agency announced that the sanitary and epidemiological situation was stable and cited the cause of Daria Shipilova’s death as “pneumonia of unknown aetiology.” No “microorganisms linked to her professional activities” were detected in samples of her biomaterial, the agency stated.

Are such measures enough?

As the authorities are providing little information about the measures taken and deny that Daria was infected with the plague, it is difficult to assess whether their actions have been adequate.

“We do not know what happened there. If we are talking about the pneumonic form of the plague, then yes, preventive quarantine is a good measure to prevent transmission chains, even the short ones. <...> When all contacts are preventatively isolated and monitored, it is possible to cut the chains of transmission at the very start and avoid further deaths,” Yakutenko told the BBC Russian Service.

Read on istories.media →

Russian companies are hampered by excessive regulation: Russia’s “sovereign internet” concept prohibits storing Russian citizens’ data abroad, and the state can seize the businesses of data center owners if they fail to protect their infrastructure from drone raids. IStories examine the potential consequences of Ukraine’s new air campaign and look into Russia’s ability to manage the potential crisis for the country’s IT market.

What happened

On the night of October 8, Ukrainian drones attacked the Yandex data center in Sasovo, Ryazan Oblast. The data center is located next to the workshops belonging to Sasta, a machinery manufacturer working for Russia’s defense industry, so at first there was no certainty that this attack marked the beginning of a new Ukrainian tactic. 

However, later that evening, Ukrainian President Volodymyr Zelenskyy described the strike as a retaliation for Russian attacks on Ukrainian data centers. The next day, October 9, drones struck a second Yandex data center situated in Kaluga Oblast. Yandex then stated that operations at the Sasovo data center had been completely halted, and part of the infrastructure in Kaluga had been disabled. On the night of October 11, drones attacked the company’s third data center in the city of Vladimir. Its operations were also halted. No employees at the facilities were injured.

Following the attacks, more than 30 Yandex services became temporarily unavailable, and, following the strike on the Vladimir data center, disruptions have been reported in the company’s apps in Kazakhstan and Kyrgyzstan. Russians have been complaining about their Yandex Drive photos and Kinopoisk watch history disappearance, meanwhile Yandex Pay customers were unable to access their bank accounts.

Millions of Russians have also felt the impact of these attacks even beyond the Yandex ecosystem: users have complained about disruptions on such websites as the Russian Railways, Cyan (a real estate database), Avito (an advertising platform), VK (a social network), Twinby (a dating website), etc. It is likely that part of their infrastructure was located in the burned-down data centers. Yandex suggested that customers migrate their data to other infrastructure providers, such as Selectel, K2Cloud, and VK Cloud.

In addition to disruptions to the day-to-day operations of its services, the Russian IT giant may face yet another serious problem. The Ryazan and Vladimir data centers house some of Russia’s most powerful supercomputers — the Chervonenskis (ranked 101st globally), the Galushkin (ranked 134th), and the Lyapunov (ranked 161st) supercomputers which Yandex used to train neural networks with billions of parameters.

The company has already taken down its supercomputers information webpage, but a copy can be found on the Web Archive. Yandex has also attempted to conceal its data centers information on the company’s own maps platform: their locations are now blurred on satellite images. At the same time, information about dozens of other Russian data centers is publicly available, and these facilities could become new targets for the Ukrainian Armed Forces' attacks.

How the data center market works in Russia

There are nearly 200 data centers operating in Russia. On March 1, 2026, the Ministry of Digital Transformation launched a non-public registry of data centers and divided them into two types: commercial data centers and those serving companies’ internal needs. The damaged Yandex facilities likely served both roles, supporting both the company’s internal services and its clients’ resources.

A total of five companies — RTK-TsOD , IXcellerate, Rosatom, DataPro, and Selectel — account for two-thirds of the commercial data center market in Russia. They also own the largest data centers, alongside the companies building data centers for their own needs, such as Yandex, Sber, Megafon, MTS, VK and Wildberries.

According to a Kommersant source in the data center market, 80 to 90% of the commercial facilities for data storage are concentrated in the European part of Russia, primarily in Moscow and St. Petersburg. Publically available data analyzed by IStories indicates that there are not many large data centers located outside these major cities.

The key facilities in Moscow, along with the manufacturing, military, energy facilities, etc., are protected by three rings of air defense, which Ukrainian drones have managed to successfully breach twice: in June 2026, when the lid of a Moscow Oil Refinery tank picturesquely flew into the air, and once again in September.

Yandex operates six data centers with a total capacity of over 200 MW. In addition to the three attacked ones, the company’s smaller facilities are situated in the towns of Mytishchi and Ivanteevka in the Moscow Oblast. There’s also one more data center in Vladimir, which began operations in March 2026.

The attacks struck Yandex’s busiest facilities — the Ryazan one consumes up to 34 MW of energy, the Vladimir one — up to 28 MW, and the Kaluga one — up to 13 MW, meanwhile its design capacity reaches 63 MW. All of these centers are located outside Moscow’s air defense “umbrella.”

What else might be targeted besides Yandex

Data centers that support Russia’s government services may end up on the Ukrainian Armed Forces’ list of targets. Key government systems, such as Gosuslugi (the citizen services platform), Gosoblako (a cloud service for government agencies), EGRN (the real estate registry), GAS Vybory 2.0 elections platform, etc. are hosted in Rostelecom’s data centers. However, most of these are located in Moscow and are protected by the three air defense rings, so they are unlikely to be top-priority targets.

One of the most vulnerable civilian facilities for Ukrainian drones could be the Russia’s Federal Tax Service’s large data center in Dubna, Moscow Oblast. The Ukrainian army has already successfully attacked the military Satellite Communications Centre in the same town. The tax service’s backup data center is also located within the reach of a possible Ukrainian strike — in Gorodets, Nizhny Novgorod Oblast. A defense plant was successfully attacked in neighboring Dzerzhinsk in August 2026.

The ERA military technopolis in Anapa, Krasnodarsky Krai, where Russia’s Ministry of Defense tests its latest weapons prototypes, has not yet been targeted. Another data center based on a supercomputer is also located there.

The Russian Armed Forces’ key data center is located at their Moscow headquarters on Frunzenskaya Embankment and appears to be the most complex target for Ukrainian strikes. As IStories previously discovered, this is where Russia’s Unified Military Registry infrastructure is housed.

The National Defense Management Center’s supercomputer, which can be compared to Yandex supercomputers in terms of processing power, is also located there. According to Russia’s former Defense Minister Sergei Shoigu, the Russian military planned to use it to “predict the course of armed conflicts based on historical data.”

What will happen to the data?

It is difficult to say exactly how many data centers would need to be destroyed for the internet to stop working in Russia. The main question is whether those center’s clients have backup copies of their data elsewhere, experts interviewed by IStories say.

The expert team from the Na Svyazi project notes that only multiple backups physically distant from one another and located in different countries can ensure data safety. “Take Yandex, for example — it has five data centers. If we put one [backup] file in each one, that sounds secure, right? But now that two are gone [because of the data center attacks], that’s no longer the case. If the other buildings are destroyed, the data will be destroyed too,” says a team member. According to Na Svyazi, a significant share of Russian services will be affected, and the loss of data could become critical if such attacks continue.

A source familiar with the Yandex infrastructure, in his conversation with the BBC Russian Service, explained that the majority of Yandex services had been hosted in the three attacked data centers. The IT giant had been preparing for a potential shutdown of its data centers and had conducted several drills during which traffic was rerouted through other facilities.

“Yandex has a strong infrastructure, and the Yandex Drive data is most likely secure,” says Leonid Yuldashev, project coordinator at eQualitie. “But there’s always some data that's stored in just one place, so a huge number of vibe coders have already lost access to their servers. Sometimes people don’t even create backups properly — they’re either missing or a year out of date. That data will inevitably be lost.”

Small businesses that rely on cloud storage and do not keep copies of their data separately — customer databases, for example — may face the most serious consequences. “Yesterday you knew you have to produce five custom-made desks, but today everything has been destroyed, and not only do you not know the dimensions of the desks, but you also won’t be able to call the client to clarify the details, unless have your own independent backup,” the Na Svyazi team explains.

Is It possible to safeguard against the attacks?

Russia’s attacks on Ukrainian data centers have been persistent since mid-September. Russia has struck about ten sites in Kyiv, where more than half of the country’s data centers are concentrated. After one of the attacks, 100,000 households were left without internet access. The owners of one data center announced it completely shut down, but the customer data remained intact thanks to backups stored at facilities in the EU.

In February 2022, a week before the Russian invasion, Ukraine’s parliament passed a law allowing government data to be stored in foreign cloud services. In the first months of the war, petabytes of data from Ukrainian government registries were migrated to AWS (an Amazon subsidiary). PrivatBank, one of Ukraine’s largest banks, also transferred its customer data there. Some data was moved to European data centers operated by Microsoft, which allocated $400 million of aid to Ukrainian companies.

This option is not available to Russian companies due to the law requiring personal data to be stored within the country. The largest foreign cloud service providers — Amazon, Microsoft, and Google — withdrew from the Russian market in March 2022 of their own accord.

“Russia has backed itself into a corner: now its data centers store information that can only be kept within the country,” says Leonid Yuldashev from eQualitie. “Because of this law, it’s not even possible to backup the information in Kazakhstan. This only multiplies the destructive power of the attacks.” 

Yuldashev speculates that the attacks may prompt some response from the government: “They could loosen the regulations and allow Russians’ data to be stored in the Eurasian Economic Union countries . I think all the parties are currently considering this: the server and data center owners and the Ministry of Digital Development. Everyone understands that if there have been two attacks, there could potentially be 22 more.”

On the eve of Ukraine’s first strike on a Yandex data center, it was reported that the Ministry of Digital Transformation and the business community were discussing relocating Russia’s AI data centers to “friendly” countries. This was reportedly prompted by the market participants' complaints about energy shortages in Russia. 

Meanwhile, however, the legislation has been shifting in the opposite direction. According to the new AI law, the so-called sovereign and national AI models will be required to process and store data exclusively in data centers located within Russia, starting in March 2027. The government plans to use such sovereign AI models at “significant critical infrastructure facilities.”

“Any centralization, any one-button centralized control, any single-location data storage solution is a massive vulnerability,” Na Svyazi experts explain. “What’s happening now is a consequence of ignoring the problem.”

Businesses will suffer 

The authorities had shifted responsibility for protecting data centers to their owners prior to the first Ukrainian drone attacks. A decree signed by Vladimir Putin in late August allows for imposing temporary state management on critical infrastructure facilities if the owners have failed to provide adequate drone protection. Data centers are listed among such facilities.

Russian data centers have begun upgrading their equipment protection systems “to meet the demands of modern challenges,” Nikita Tsaplin, the CEO of RUVDS hosting provider, noted in a conversation with Kommersant. Back in July, VSK, one of Russia’s largest insurance companies, set a requirement for the data centers to be prepared for drone attacks. According to it, a facility had to be able to withstand a collision with a drone weighing up to 350 kg.

The idea of equipping data centers with anti-drone nets is currently being discussed among hosting providers, says Leonid Yuldashev. Not everyone will be able to afford it: “I can imagine that Yandex might at least install the nets, but for a small data center in Chelyabinsk, it will be more difficult to do so. And at the same time, you wonder [about the rationality of it]: I’ll spend all this money now, then a drone crashes into the data center, and it’ll be taken away [by the state]?”

The costs of protecting the infrastructure will ultimately fall on consumers, Nikita Tsaplin says. At the same time, prices will rise most significantly for the critically important telecom, government, and financial data centers which face the highest risks.

Equipment losses will also hit the data center owners, as they’ll have to purchase replacements from abroad at higher prices. The future of Yandex supercomputers remains unclear as they rely on foreign components, such as AMD EPYC processors and NVIDIA A100 graphics accelerators, the import of which has become difficult following Russia’s invasion of Ukraine.

Standard server equipment supplies are also declining, and due to a global memory supply shortage, their prices are rising. “All of this has become quite difficult to buy. Of course, people are buying Russian-made servers, but the problem is, they’re not actually ‘Russian-made,’” says Leonid Yuldashev. “Because of the storage crisis, it’s almost impossible to purchase equipment promptly."

Building a new data center is, in itself, a costly and complex project involving significant transaction costs, Yuldashev says. It won’t be possible to quickly relocate the facilities to Russia’s Far East, beyond the range of Ukrainian drones.

Alfa-Bank’s data center market review confirms this: by 2025, the rate of new facility launches had halved, and some projects already under construction had been put on hold due to the Central Bank’s high interest rates.

A blow to the “sovereign Russian internet”

Ukraine’s choice of Yandex as a target cannot yet be explained by the fact that its data centers have been directly used in warfare — there has been no direct evidence of this. The company, however, helps the Russian army recruit new contract soldiers. In 2024, through the social advertising mechanism alone (which means it is free for the advertiser), the ads for contract military service in the Russian army were displayed more than 1 billion times on various Yandex platforms. More than 12 million of these impressions happened in Uzbekistan, Kyrgyzstan, Belarus, Kazakhstan, and other foreign countries. In 2025, Yandex concealed the military service ad impressions statistics.

The Yandex data centers may have been targeted based on the same logic as the Wildberries and Ozon warehouses had been months earlier. If popular services — some of which hold a monopoly position in the market — become unavailable, it could hurt Russia's economy as a whole and upset Russians’ daily lives.

According to Leonid Yuldashev, Yandex was chosen as the first target not because of its position in the cloud storage market — there are other, larger players in Russia that most Russians are completely unaware of. Attacks on Yandex primarily harm the state.

“This undermines the main promise of the sovereign Russian internet,” he explains. “The authorities say they’ve blocked Telegram and YouTube, but Max ‘works even underground,’ and RuTube is up and running. [The government stated they] ‘have set up all the sovereign services, and everything works.’ And it turns out that if YouTube doesn’t work, but Yandex Video always does, maybe you’ll just use [Yandex]. But if both Yandex Video and YouTube fail to work, then you might start thinking, ‘Maybe I should set up a VPN [to be able to watch YouTube]?’”

Read on istories.media →

For his part, Putin, speaking at the Valdai Forum on October 1, once again threatened the West with the use of nuclear weapons in the event of an attack on Kaliningrad . This statement sounded as though he was warning Europe in advance not to even consider isolating the exclave as a possible response to Russian hybrid attacks.

The number, the frequency and the intensity of today’s warnings about an impending Russian attack on Europe are comparable to the accumulated signals preceding the invasion of Ukraine in February 2022. Does this mean that a new escalation is inevitable?

On the one hand, the very idea that Putin is seriously intending to start a war with NATO seems implausible. But the idea that he would send tank columns towards Kyiv seemed equally crazy five years ago. And yet he did.

On the other hand, there are many sceptics who perceive the numerous reports of an imminent Russian attack on the EU as either European alarmism or a Russian psyop aimed at intimidating the West and undermining its support for Ukraine.

At first glance, the arguments put forward by the sceptics sound convincing:

• the West’s economic and military potential is incomparably greater than that of Russia. Given that in four and a half years of war Russia has still not managed to capture the village of Mala Tokmachka , how can it possibly compete with NATO?

• according to Ukraine’s General Staff, throughout the war Russia’s forces have lost more than one and a half million personnel (killed or wounded), as well as over 12,000 tanks, 25,000 armoured fighting vehicles, 50,000 artillery systems, around 800 aircraft and helicopters, as well as a third of its strategic air force and a third of the Black Sea Fleet;

• Russia’s stagnating economy is unlikely to withstand the costs of yet another “special military operation”;

• a two-front war will only worsen Putin’s already precarious position: if he fails to achieve success on both fronts, he risks losing power.

However convincing these arguments may sound, they fail to take several important factors into account.

Firstly, we are not talking about a full-scale invasion of the EU similar to that of Ukraine. European leaders and intelligence chiefs are referring to drone and missile strikes and an intensification of hybrid and sabotage operations, and Russia has sufficient forces and resources for this.

Secondly, whatever military capabilities NATO may possess, the question remains of how determinedly and collectively the Alliance is prepared to respond to Russia’s threats.

Thirdly, over the course of its war against Ukraine the Russian army has not just suffered losses, but also gained invaluable experience. The importance of such experience has already been demonstrated on several occasions during the joint NATO–Ukraine training exercises where Ukrainian drone operators have been defeating entire NATO brigades. The Russian army has drone operators that are similarly well-trained.

And, finally, before asking whether Putin is capable of succeeding in a confrontation against NATO, it is worth considering what is understood by “succeeding.” By all accounts, the Kremlin is not aiming for deep tank breakthroughs or taking over huge areas of Western countries’ territories. “The aim will be to weaken NATO’s integrity as a whole and, above all, to convince its members that Article 5 is more theoretical than practical,” Polish Prime Minister Donald Tusk warned. Referring to European politicians, he said that no one is “going to die for Latvia or Lithuania.” According to Tusk, Russia will use repeated incidents designed to erode confidence in the alliance without ever quite triggering a unified response.  

In my view, today such a scenario seems not just likely, but alarmingly obvious. Not only because of the reasons listed above — although each of them is undoubtedly significant — but rather because Putin appears to have no other options (acceptable for him) left for retaining his power. It’s not an external objective, but one inside Russia that I would describe as the main one for any potential Russian aggression against Europe.

All autocracies share a common vulnerability: the leading figure. As long as the leader is strong and successful, the political system can be highly efficient: no voting, no negotiations, no disputes and no doubts — everything is subordinated to the vision of the leader, whose orders are carried out without delay or objection. But as soon as the autocrat begins to lose power or, what is worse, suffer defeats, the system built around this figure falls into a state of imbalance.

All this applies to Russia as well. Putin’s regime is a syndicate run by the KGB and the criminals, which operates by the underworld’s rules. The power is divided amongst silovik clans that are free to plunder, kill and, in essence, commit any kind of atrocities as long as they remain loyal to the leader and devoted to his course, which means supporting the genocide of Ukrainians and the (yet) undeclared war against the West — in word and deed. Putin is the big boss of this criminal syndicate, the capo di tutti capi, the one to whom the clan leaders would go to pay their respects so that he could settle their disputes with a single nod.

But in the fifth year of the war, Russia’s big boss found himself in a position more vulnerable than ever. Even the “silent majority” don't believe the mantra that “the special military operation is going according to plan” any longer, let alone the security forces leadership and the top officials. No one understands what the plan is or where we’re heading next either. More and more of the Russian government gang’s members are beginning to suspect that there is no plan as such — only the leader’s maniacal conviction that “we’ll push them to their end,” because “we are Russians, and God is with us.”

Putin is increasingly and ever more frequently coming across as a delusional old man. One day he is bragging of having captured Kupyansk or a “record” amount of land, and the next one — of having surrounded “record” numbers of Ukrainian soldiers, all of it meanwhile the Russian horde has been losing 30,000–40,000 soldiers killed or wounded every month, unable to seize the cursed Tokmachka and other settlements in the Donbas for five years now. Unable to achieve his objectives by military means, Putin has unleashed his fury on the civilian population of Ukraine and resorts to bombing schools, universities, shopping centres, the sewage systems and the energy infrastructure of Kyiv, Kharkiv, Odesa and other Ukrainian cities round the clock, in the hope of freezing and depriving children, the elderly and all the civilians of water, communications and food.

The history of warfare shows that terrorising the civilian population does not help to achieve military objectives and results in failure more often than not. But Putin’s knowledge of history is limited to the Polovtsians and the Pechenegs , so how could he possibly know that the genocide he has orchestrated will rather serve to cement his name once and for all amongst the most despised scum of the human race, alongside Chikatilo, Hitler, Stalin and other mass murderers of the defenceless?

When a gang leader becomes a scorned laughing stock, he quickly loses his power. Not necessarily by a violent coup (although such a scenario is entirely plausible, given the heightened tensions between Russia’s ruling clans and the fact that many of those have their own private armies); the more likely outcome is the loss of that element — intangible yet extremely important in any political system, especially in an autocracy — as the magic of power. When no one listens to what the leader is muttering; when no one believes what he promises; when, instead of the awe-struck terror he evokes a condescending smirk, his system crumbles under silent sabotage like a house of cards — much like in the late Soviet Union, where citizens would pretend to work whilst the authorities would pretend to pay them.

In such a situation, in order to retain (at least temporarily) their power, most mob bosses tend to resort to violence — showy violence, preferably. If we’re talking about a small gang, similar to Tony Soprano’s, it’s enough to pick a young, strong bodyguard nicknamed “Muscles Marinara” and beat him to the ground in front of the other gang members beginning to lose respect for the leader: not to let them forget who the “alpha male” is.

In the case of a government gang, especially as large as Russia's one, everything is more complicated, but the principle remains the same. Putin needs a new wave of violence to stay in power: violence both against those in his inner circle daring to say something inappropriate in a private conversation (and it doesn’t matter whether such a conversation would actually take place; what matters is whose name the leader underlines on his list) and against “the enemies of the Russian people”: in this case, it will be the FSB operatives across Russia who will designate the enemies and underline the names at their own discretion.

Another difference between the mob in power and a street gang is that a more widespread violence requires extensive powers and, as Russia’s mob boss puts it, “action” . A war with NATO could become such 'action’ which would allow Putin to divert attention from his setbacks in Ukraine, expand the security and intelligence services authority, isolate the country and increase repression. He believes he will be able to wage this missile, drone and sabotage acts war against the West long enough until the weary Western public ends up electing Russia’s far-right allies. Unfortunately, as the September elections in Germany and opinion polls in France are showing, this part of the plan has a realistic basis and might come to pass quite soon.

If one looks at this scenario from Putin's perspective, he stands to lose very little:

• the sanctions pressure potential has been exhausted; Russia is already the most sanctioned country in the world, and its economy is entirely dependent on China;

• Europe is unlikely to dare to invade Russia; in the worst-case scenario for Putin, NATO might respond to hybrid attacks and drone strikes with identical strikes, which is something the Russian population has long become accustomed to;

• blocking Kaliningrad or the Baltic Sea would perhaps be the most painful potential response, which is why Putin is already warning against it, using his nuclear threats: it remains to be seen whether Europe believes them or they are dismissed as yet another bluff.

But what about the negotiations and the “deal of the century” with the Americans? This scenario strikes me as far less likely.

Firstly, we mustn't forget that prior to the invasion of Ukraine Putin issued an ultimatum to NATO, demanding that the alliance’s infrastructure be withdrawn to the 1997 borders (meaning a withdrawal from Poland, the Czech Republic, Hungary, Romania, Bulgaria, Estonia, Latvia and Lithuania). It is already clear that the Napoleonic ambitions of the Russian big boss have ended in a spectacular failure; however, this by no means implies that he has abandoned them, and certainly not for the sake of a deal with the Americans. He wouldn’t have started all this “action” in the first place otherwise.

Secondly, the Kremlin obviously follows American news and is well aware that Donald Trump’s approval ratings are hitting all-time lows and that his Republican Party is highly likely to suffer a crushing defeat in the upcoming November midterms. Trump will then lose much of his leverage, and his initiatives will be paralyzed by the Democrats.

That is why Russia’s mob boss realizes that the American wheeler-dealer’s words are worthless: all the papers he signs today will be revoked tomorrow.

Which in the logic of Putin means there is only one path left — the escalation of violence both within Russia and beyond its borders.

Read on istories.media →

What methods is Russia using to wage its hybrid warfare against Europe and why is the Kremlin doing all of this at all?

Direct aggression: drones, aircraft, and beyond

Starting in the early months of the full-scale war, Russian drones have been entering the airspace of countries neighbouring Ukraine. As early as mid-March 2022, a Romanian farmer found an ‘Orlan-10’ reconnaissance UAV, brought it home on his tractor and reported it to the police.

Since then, Russian drones or missiles launched at Ukraine have repeatedly flown into the airspace of Romania, Moldova, Poland, Latvia and Lithuania. The Romanian armed forces alone have recorded around 80 instances of drones or their debris falling. Usually, it happens either due to the guidance system errors or because the munitions trajectories are affected by Ukrainian air defence or electronic warfare systems. Sometimes drones and missiles leave the third country’s airspace after a short while.

In September 2025, 19 Russian decoy Gerbera drones carrying no explosives flew into Poland all at once. Some of them were shot down by NATO aircraft; this was the first time since the start of the Russian invasion of Ukraine that the Alliance’s air force had destroyed Russian UAVs. One of the missiles fired at the drones fell onto a village house due to a guidance system malfunction, but did not explode. No one was injured.

Prior to this, isolated incidents of drones falling in European countries were usually described as accidental, but the aerial incursion into Poland was deemed deliberate, which was stated by Polish and German authorities. The American Institute for the Study of War (ISW) suggested that Russia may have been preparing this operation for several months.

Since the war began, the number of incidents involving Russian military aircraft at NATO’s air borders has increased. For example, in July 2026, NATO aircraft would be scrambled to intercept Russian aircraft 3.5 times more frequently than in July 2025. Interception refers to identificating the aircraft, establishing visual contact and escorting it. In most cases, NATO scrambles the jets when the Russian ones approach the Alliance’s border without a flight plan and with their transponders switched off. However, sometimes Russian aircraft do cross the air border.

The most notable incident occurred a year ago, when three Russian MiG-31s (the aircraft Russia uses to launch ‘Kinzhal’ missiles at Ukraine) spent 12 minutes in Estonian airspace. A few days later, European diplomats privately warned Russia that they were prepared to shoot aircraft down should such incidents recur, according to Bloomberg. On 18 March 2026, a Russian Su-30 spent approximately one minute in Estonian airspace.

Sabotage acts within Europe

Since the beginning of the full-scale war, there have likely been hundreds of Russian sabotage acts within Europe. By August 2025, the International Institute for Strategic Studies (IISS) had reported 66 operations linked to Russia’s hybrid war. The International Centre for Counter-Terrorism (ICCT) and GLOBSEC estimated 151 incidents linked to Russia by the first four years of the war.

In 2026, dozens of sabotage acts have taken place at defence enterprises and infrastructure sites across Europe. The most prominent case was the Leipzig Airport incident, when a drone carrying explosives was discovered near a Ukrainian transport aircraft carrying ammunition intended for the Ukrainian Armed Forces. US intelligence concluded that the design of the explosive device and the explosive itself were typical of those used in operations by GRU, the main intelligence directorate of the Russian general staff. Germany officially accused Russia of involvement in the attempted attack.

In addition to the direct acts of sabotage, Russia also launches its reconnaissance drones over Europe — not only to gather intelligence, but also to create economic and psychological pressure on Europeans, according to the IISS. The Institute estimates that between August 2024 and February 2026, Russians launched 144 drones into European airspace, sometimes using shadow fleet tankers. UAVs have been spotted both over military bases and civilian facilities such as airports. Trouw and DroneWatch, however, recorded more than 50 cases where the information following drone sighting reports was inconclusive between 9 September and 27 November 2025. IStories explained why this happens.

Fibre-optic cables on the seabed of the Baltic Sea have also become a target for sabotage attacks. From October 2023 to the end of 2025, at least 11 instances of cable breakage or damage were recorded. In April 2026, NATO ships disrupted Russian exercises in the Arctic where the Russians were testing a ‘new technology’ designed to damage deep-sea cables, sources told Reuters. The weapon was being tested by the Main Directorate of Deep-Sea Research (GUGI), which is part of the Russian Ministry of Defence.

Other ways Russia is waging hybrid warfare

• Cyberattacks. This is one of the main directions of Russia’s hybrid warfare against Europe, according to the Centre for Strategic and International Studies (CSIS). Some notable operations include a large-scale attack on energy infrastructure in Poland and an attack on a Norwegian dam which hackers were able to take control of and open its floodgates for four hours.

• GPS jamming. Most often, this happens because of Russian electronic warfare against Ukraine's drones. However, experts suggest this might also be an attempt to create a ‘sense of unease’ in Western countries. The Russians use both ground-based jammers (which can interfere with signals up to 450 km away from the Russian border) as well as those in space.

• Disinformation. The European Union has recorded thousands of instances of Russian disinformation aimed at discrediting Ukraine and Ukraine-friendly politicians as well as at praising Russia. The ‘Storm-1516’ project is described by Bloomberg as the most powerful weapon in Russia’s disinformation arsenal. The GRU is likely to be behind the project, while the content is created by the late Yevgeny Prigozhin’s ‘troll factory’ ex-employees. Often, the aim of these information campaigns is election interference. Here you can read more on how Russian propaganda’s fake news actually influences voting results.

• Sending migrants to Europe. Russia is smuggling citizens of various Middle East and Asia countries into the EU via Belarus. In particular, tunnels from Belarus to Poland are being used for this purpose, according to The Telegraph.

• Assassination attempts. The most high-profile operations (the murders of Alexander Litvinenko and Zelimkhan Khangoshvili, and the attempted murders of Sergei Skripal and Emilian Gebrev) had been carried out before 2022. Since the full-scale invasion began, Russia has murdered Maxim Kuzminov, a Russian pilot who had defected to Ukraine. An unsuccessful plot to kill Armin Papperger, the head of Rheinmetall, a major German arms manufacturer, is another example.

Why is Russia doing all of this?

There are relatively few instances of Russian hybrid attacks in Europe able to directly influence the volume of military support for Ukraine. But those have happened — for example, the fires and explosions at factories producing weapons and ammunition. However, whilst the damage caused by a single sabotage act may not be extraordinary, it is wrong to view it in isolation from the overall military strategy, Pavel Luzin, a military analyst, says: “Every successful sabotage act builds up the damage.”

Usually experts refer to broader objectives when speaking about Russian hybrid attacks.

The first objective is to intimidate Europe and force it to withdraw its support for Ukraine. The Kremlin believes that it can defeat Ukraine if Russia’s military capabilities ultimately outweigh the support Kyiv receives from Europe, the Institute for the Study of War reports. According to this logic, sabotage acts and other hybrid warfare tools are intended to force the European governments to withdraw or at least reduce their military and diplomatic support for Ukraine.

Russia cannot influence the European ruling establishment directly, which is why the Kremlin is attempting to intimidate European voters, Abbas Galliamov, a political analyst, believes. The expectation is for Europeans to cast their votes for parties similar to the far-right ‘Alternative for Germany’ or the French ‘National Front.’ “[The members of these parties — Ed.] say: ‘We mustn’t upset Putin; we need to negotiate with him, or it will be bad for us, and there will be war.’ This is betting on an ostrich-like stance, where you simply want to bury your head in the sand without thinking about the future,” Galliamov explains. The situation in Ukraine is, of course, not the main issue for European voters; the problem of migration, for example, is far more pressing. But for many, the far-right parties' stance on the war may well become an additional reason to vote for them, Galliamov says.

The second objective is to test the limits of what can go unpunished. A month ago, Hanno Pevkur, the Estonian defence minister, said Russia was constantly testing the limits of Article 5 (of the North Atlantic Treaty — Ed.), trying to find the “red line.” The article Pevkur referred to states that an armed attack against one NATO member shall be considered an attack against them all, and each member will assist the party attacked. However, this does not necessarily mean military aid.

The problem with Article 5 is that there’s no clear criteria for its invocation. In the entire history of NATO, the article has been invoked just once — following the September 11 attack in 2001. Currently, all of Russia’s hybrid war attacks are carefully calculated so as not to provide grounds for Article 5 invocation, according to The Telegraph's sources within Western intelligence.

“Every successful sabotage act serves as a test of the limits and of the way the target reacts, and a test of the strengths and weaknesses in the target’s defence, which can be used to plan and carry out further actions,” explains Pavel Luzin, a military analyst.

So far, NATO member states have only invoked Article 4 in response to Russia’s actions (twice). This article only provides for mandatory consultations in case one of the member states considers its ‘territorial integrity, political independence or security’ under threat. Last year, such consultations were requested by Poland (following the drone incursion) and Estonia (following the aforementioned airspace violation by Russian aircraft). The invocation of Article 4 should not be regarded as a serious step; tangible measures to counter Russian provocations would be far more effective, says Gleb Bogush, an international law expert.

The third objective is to lay the groundwork for a possible invasion. The Kremlin might not have explicitly decided that it is in its best interests to fight a conventional war with NATO, but it is “undoubtedly setting conditions to do so in the future if it so chooses,” according to ISW. The hybrid warfare attacks are aimed, amongst other things, at sowing division within NATO, as its officials acknowledge. This could affect NATO’s willingness to defend a member state in the event of a Russian invasion.

Furthermore, ISW reports, the Russian military may be violating NATO’s airspace in order to gather intelligence; in particular, to understand the alliance’s air defence response patterns.

Read on istories.media →

The election was accompanied by numerous violations. Observers were denied access to polling stations, beaten, detained, and prohibited from recording videos. There were reports of ballot stuffing, voter coercion, ballot tampering, and other violations.

The authorities had created the conditions for an uncontested election from the start. A month and a half before the vote, Russia’s Supreme Court barred Yabloko, the only anti-war party, from running in the election. The authorities launched repressions against the party members. Twelve of them have been charged with criminal offenses, and eight are in custody. The party’s deputy chairman, Lev Shlosberg, was sentenced to 11 years in prison. Two Yabloko members, Konstantin Smirnov and Elena Perepelitsa, remain in pretrial detention.

Voting took place on September 18–20 using the new GAS Vybory 2.0 (‘Elections 2.0’) system, which was used for federal elections for the first time. IStories had published a detailed investigation into the system and discovered that it allows for results tampering, voter rolls fraud and uploading unverified results from remote electronic voting systems.

In this article, we report on the anomalies we were able to identify in the voting results using statistical methods.

United Russia got no more than 35% of the real vote share

According to IStories calculations, instead of the claimed 58% of the vote, United Russia may actually have no more than 35%. Novaya Gazeta Europe reached a similar conclusion. Boris Ovchinnikov, an election analyst we consulted, also agrees with this assessment.

We arrived at the 35% estimate based on the voting results analyst Petr Zhizhin compiled from the Central Election Commission’s website data by the evening of September 21. At that time, 94% of the vote count had been entered into the database. The commission had not yet published the complete data for Bashkortostan with its 3 million voters, for the Leningrad and Smolensk Oblasts and the occupied territories of Ukraine (apart from Crimea).

We excluded Moscow from the analysis: approximately 80% of the votes there were cast via electronic voting, and the results were published without a breakdown by polling station. We also did not include the results of electronic voting in 32 regions. Based on this calculation, it appears that approximately 18.4 million of the 30 million paper ballots cast for United Russia — according to the data as of September 21 — may have been falsified. This means that more than 60% of the “paper” votes for the ruling party may be fabricated.

The method we used to analyze the data was first applied to Russian elections by Sergei Shpilkin, a physicist and election analyst. The method is based on the premise that the ratio of votes cast for different candidates and parties should not change depending on voter turnout. When commission members stuff the ballot boxes, they thereby increase voter turnout numbers. And since they stuff the boxes in favor of pro-government candidates, United Russia’s result would be rising alongside voter turnout.

The polling stations where the voting was fair should be forming a dense “cloud” on the chart, meanwhile the polling stations where ballot stuffing occurred are located at the top right and look like a comet’s tail. In the 2026 State Duma elections, the cluster of fraudless polling stations is located around the 35% vote share for United Russia. Most polling stations are in the “comet’s tail” zone, which indicates widespread ballot stuffing. You can read more about Sergey Shpilkin’s method in the explainer.

We defined the real turnout range — at which United Russia’s result does not yet correlate with the turnout numbers — at 20–29 percent. Based on the vote ratio for different candidates at this turnout level, we calculated the potential number of fraudulent ballots.

In fair elections, the graph showing the relationship between the number of votes and voter turnout resembles a bell curve. For example, this is what the turnout distribution looked like in the 2000 presidential election. Experts call those elections the fairest in the history of modern Russia. A different picture emerges in the 2016 State Duma elections and further on, where “peaks” appear on the right side of the graph. Those peaks are what votes rigged for the ruling party look like, as its share of the vote increases along with voter turnout.

Turnout fabrications

According to the Central Election Commission, turnout stood at 59.32 percent. This is a record for State Duma elections since 2011 (60.21 percent). “The Kremlin went too far with its another wartime election,” Mikhail Komin, a political analyst, notes. “In 2024, Putin achieved a result more typical of Latin American and Central Asian dictatorships (87% with a 77% turnout) than of his own previous term's results. Now, in the 2026 State Duma elections, the results are no less historic.” Analysts Roman Udot and Boris Ovchinnikov believe that the actual turnout was around 40%.

Election commissions began falsifying turnout figures from day one, analyst Ivan Shukshin pointed out. For example, by 8:00 p.m. on September 18, an unusually high number of commissions reported a turnout of 30%. The same thing happened on the second day of voting, when the most common reported turnout figure was precisely 40% — and 85% on the third day. In normal circumstances, people across decide to go to the polls randomly and independently of each other, so the turnout distribution among law-abiding commissions should follow a simple bell curve,” Shukshin explains. “Peaks at round numbers (40%, 60%, 65%, etc) appear when the figures are fabricated.”

Virtually all voters at unusually high turnout polling stations — those where the turnout neared 100% — voted for United Russia members. Mikhail Matveev, a State Duma candidate from CPRF who had been temporarily barred from participating in the election, drew attention to polling station 0618 in the Borsky District in Samara Oblast. The commission reported a turnout of 98.53%; according to the same data, Matveev received 14 votes, while Alexandr Zhivaykin, his opponent from United Russia, received 704 votes. The Yabloko initiative group also reported similar results favoring candidates from the ruling party in New Moscow .

During previous elections, election commissions artificially increased turnout numbers in order to be able to falsely add votes for the ruling party's candidates. According to sources cited by Meduza, ahead of this election, officials from the presidential administration demanded that regional administrations ensure turnout numbers of more than 50 percent.

On the first day of the election, neighboring polling stations under the “Sovetskaya” Territorial Election Commission in Dagestan submitted reports showing identical voter turnout figures—another sign of vote rigging also noted by Shushkin. Similar unnatural turnout figures were also detected at election commissions in the Ivanovo and Leningrad Oblasts, in Kuzbass, in the Primorsky and Krasnodar krais and in St. Petersburg. In Kabardino-Balkaria, virtually identical turnout figures were recorded by every single polling station in the republic.

Anomalous turnout and United Russia’s share in the final hours of the voting

According to the official data, at some polling stations, election commissions may have added votes for United Russia right before the polls closed. For example, at two neighboring polling stations 322 and 338 in district 48 in the Kamchatka Krai, two hours before polls closed (from 6 to 8 p.m. on September 20), turnout suddenly jumped from their respective 7% and 17% to 100%, as noted by IStories. Irina Yarovaya, co-author of the law on internet surveillance, was running for the State Duma in this district. During the last two hours of voting, she identically received a record-breaking 97% of the vote at both polling stations and was re-elected to the State Duma. Yarovaya has held a seat in the State Duma for 19 years, and she now has five more years to go.

Identical results at neighboring polling stations

Another sign of fraud is when neighboring polling stations report virtually identical results. This may indicate that they are following a directive handed down from the authorities. In a fair election, votes at neighboring polling stations cannot be distributed identically down to hundredths of a percent. The probability of this is extremely low, but we have identified numerous regions with this anomaly.

For example, in Dagestan, the results at 11 out of 53 territorial commissions are practically identical. At 45 polling stations in Derbent, United Russia “won” with their results ranging from 93.84% to 95.03%. This is statistically impossible in a genuine voting process.

Vote manipulation

Observers recorded commission members transferring votes for other candidates to United Russia by literally putting ballots in a different pile. “The chairperson takes a ballot with a vote for candidate No. 4, New People's Zharkova, but reads out the surname of the United Russia candidate, Romanenko. The same thing happens with the next ballot,” Daria Bagina, an observer, reports. A Yabloko observer at polling station 440 in Moscow noticed that ballots used for voting for the Yabloko candidate Viktor Kogan-Yasny, as well as for other candidates, were being placed in the United Russia pile.

But most of the vote tampering takes place without observers present. “At Moscow polling stations, they did indeed shift ballots in favor of United Russia candidates during the vote count, but this is apparently only the first level of fraud,” Boris Ovchinnikov notes. “I am certain that virtually all result reports showing a turnout of more than 75–85% (but less than 100%) were filled out with no connection to the actual count of completed ballots whatsoever. This explains the recurring vote shares across different polling stations as well as other anomalies. Where there were no actual observers present, they could have entered any numbers into the protocol and then further alter the results when entering them into the digital elections system.”

Vote transfer is evident in the data. It occurs at polling stations with a turnout of more than 82%. Until then, United Russia’s results are rigged through ballot stuffing: its share increases along with turnout, while the results of the other parties remain unchanged in absolute numbers. But starting at a turnout of 83%, votes for all parties except “United Russia” begin to disappear. Their results drop by more than half. At the same time, the ruling party’s results rise in a corresponding manner. This may indicate that at such polling stations, ballots for candidates from other parties are being counted as votes for United Russia.

On the graph, this pattern of votes resembles a pair of tongs. Some of the 18.4 million falsified votes may have been obtained through such vote transfers.

At the same time, when the turnout approaches 100%, United Russia’s share of the vote declines, while that of all other parties, on the contrary, rises. Boris Ovchinnikov explains this by the fact that there is usually no fraud at such polling stations: “A turnout of exactly 100% automatically occurs at ‘special polling stations’: in hospitals, detention centers and on ships. Anywhere where there are no permanent residents, everyone votes on a temporary voter list. Those who do not vote simply do not make it onto the list.”

In addition to United Russia, votes for A Just Russia party may also have been rigged in these elections. Election analyst Stanislav Andreychuk noted that on September 21, A Just Russia suddenly gained 60,000 votes, which allowed the party to reach the 5 percent threshold needed to enter the State Duma. “Just one phone call, a decision was made, and the numbers were rewritten right away,” Andreychuk suggests.

Results abroad: emigrants against United Russia

The New People party received 43% of the vote and came first at polling stations abroad, according to independent exit polls conducted by the Vote Abroad project. Surveyors interviewed those voting in 22 countries and collected 15,700 responses.

United Russia only got 5.5% of the vote. The New People party also leads according to the exit polls conducted by Vesna and Progress movements.

At the same time, according to preliminary data from the Central Election Commission, United Russia won at polling stations abroad, with 45.49% of the vote. New People came in second, getting 22.42% of the vote. A total of 212,000 Russians cast their ballots abroad.

United Russia lost the elections in at least 40 out of 152 countries. In 39 countries, New People came first; they got their highest vote share in Slovenia, Serbia, and the Netherlands. United Russia also lost in the anti-war emigration hubs, such as Armenia, Kazakhstan, and Montenegro. Previously, Russians living in these countries would mostly vote for pro-government candidates and parties. The ruling party also lost to New People in those countries in the Middle East and Asia where thousands of Russians have also moved since 2022: the UAE, Israel, Vietnam, Thailand, and China.

United Russia received its highest share of the vote abroad (79%) in the Central African Republic. Its vote share was also high in Moldova (77%), Russian-occupied South Ossetia (73%), Lebanon (70%), and Tajikistan (70%). United Russia also won in a number of Western countries: Greece (56%), Estonia (50%), Italy (40%), Switzerland (36%), and the United States (34%).

Unverifiable remote voting results and the occupied territories of Ukraine

Anomalies in the remote electronic voting system at the elections were detected as early as on the first day of voting. The Belgorod Territorial Election Commission closed remote voting in District No. 80 just three hours after it began, Ivan Shukshin noted. Approximately one-third of the voters who had registered for electronic voting cast their ballots in those three hours. This was later attributed to a “technical error.”

In addition, Petr Losev detected three simultaneous spikes in the electronic ballots generation within the remote voting system — one on the afternoon of September 18 and two on the morning of September 19. For two to three minutes, the number of ballots allegedly issued to online voters increased by 2.5 to 4 times in several regions at once.

Electronic voting has long been difficult to subject to public oversight. But in the 2026 election, the blockchain data on electronic voting in Moscow was completely removed from public access. “For the first time since electronic voting began in Moscow, the ability to view or download records was disabled. In previous years, we would be able to create graphs showing how a candidate’s vote share depended on the time,” says Petr Zhizhfin, a remote voting expert. As a result, this voting method opens up numerous opportunities for manipulation. United Russia received 3.5 million electronic votes in Moscow and elsewhere, but it's not clear how many of those are genuine.

Voting results in the occupied territories of Ukraine also remain completely unverifiable. There is no independent observation there, and the results are only published as overall totals not broken down by individual polling stations or election commissions.

Read on istories.media →

The results were predictably boring. After the election weekend, the media has been full of headlines saying that United Russia will form the largest parliamentary faction in the party’s 25-year history. The voter turnout was at 59.32 percent: 62.6 million people cast ballots, which is a ten-year record with nearly 10 million more than in 2021. Russia has been living in the state of full-scale war for more than four years — and in the first parliamentary elections since the war began, people have once again voted for the party of war. What conclusion can we draw from this?

All of IStories sources in the Russian government say the same thing: holding the election was incredibly difficult — both in Moscow and anywhere else. Officials and political strategists note fatigue and apathy — almost unanimously. “Everything is predictable and even boring,” says one source. “The only impression is, it was hard,” another echoes.

It’s important to keep this in mind when looking at United Russia’s “triumphant” statistics. Yes, achieving these results would have been a triumph had there been genuine political competition, but in 2026 Russia, it would be surprising for the ruling party not to achieve them. At least it turns out that securing those results was difficult despite the fact that the ruling party had its entire usual arsenal at its disposal: the public sector employees , early voting and electronic voting (allowing for easier election fraud) mechanisms, money and media resources.

The campaigns of the other parties were subject to strict self-censorship: it was forbidden to talk about what was really weighing on people’s minds, which meant the parties couldn’t distinguish themselves from one another either. Before the election, the New People party got scared that the real protest electorate would flock to vote for them, so they chose to remain silent on those forbidden issues (such as the war) even though it was precisely from them, a staged Yabloko substitute, that people expected statements from. A source among the authorities says that in the end they had to inflate the numbers of votes New People actually had in order to liven up the election picture: “to make it more interesting.”

Another source notes that Leonid Slutsky, the LDPR party’s leader, had persuaded his friends in the Kremlin to improve his party’s results as well. CPRF’s results worsened, but it remained the second-largest party in the State Duma. A Just Russia party barely reached the 5 percent threshold and became the laughing stock within the system: why and for what reason did they decide not to finish it off after all?

All of this took place against a backdrop of high public anxiety, talks of a new mobilization following the vote, and — let’s not forget this — not a single generous promise made to voters. Given these circumstances, the authorities had to fraud a very significant amount of votes, and they succeeded in doing so. One source explained the Kremlin’s obsession with records in human terms: aside from the fact that all parliamentary parties were instructed to frame a high voter turnout as a sign of “national unity in the face of external threats” and war, Putin simply still likes big numbers. “And does he have many other reasons to be happy at the moment?” the source asked.

Did the 62 million Russians who went to the polling stations under these conditions truly demonstrate support for the current course? It sounds paradoxical, but Russian elections are perhaps the least reliable tool for assessing public sentiment today.

At the same time, the trendy skepticism toward the very institution of political parties and elections is currently working in the government’s favor rather than against it. Clearly, a portion of the pacifists decided in advance to stay home after Yabloko was removed from the election, while today Russia’s system conveniently relies on both the lack of political competition and the resulting belief that there’s no point in voting: they say elections in Russia are like seasons changing and winter will come regardless of your choice. I’ve personally seen this logic expressed on social media by acquaintances who decided not to vote this time around. 

Let’s look for something encouraging — in places where people had the chance to vote without fear: United Russia lost in most centers of the anti-war diaspora. The emigrant community, of course, is not a representative sample of Russian society. But it’s nice to know that when the rules of the game change, different scenarios emerge immediately.

All of this, of course, is no cause for great optimism. But the reasonable part of those citizens who did show up at the polls on Sunday hardly expected that their ballot would actually determine the composition of the next State Duma. It was rather a matter of getting to “see some like-minded people” once again Russians must not despair or look away, losing sight of the value of our own vote and renouncing our civil rights, for this is precisely what the authorities remain most interested in. Despair does not free us from our responsibility, and life under dictatorships is usually a long-term struggle.

Read on istories.media →

“We have fully transitioned to the new architecture built on domestic hardware,” — Pamfilova told Putin, — “It has no equivalent anywhere in the world in terms of data storage capacity and of the operational subsystems number. It remains autonomous from the global network belonging to the enemy; it is fully centralized. In other words, the enemy won’t be able to get to it — that’s for sure.”

Just before the State Duma elections, hackers breached the infrastructure belonging to Tsifrotek, the company that developed the GAS Vybory 2.0 system. The hackers passed the obtained documents on to the IStories editorial team. We examined nearly 200 gigabytes of technical documentation, internal correspondence and the developers’ conference calls; independent technical and electoral experts assessed the archive at our request. Who created the new system, how was it made and how reliant and transparent is it?

The names of those involved in the development IStories spoke to are not disclosed for security reasons.

“An intricate work of art.” The origins of the GAS Vybory 2.0 system

Development of the new digital system for conducting elections in Russia began in 2019. First and foremost, the Central Election Commission (TsIK) wanted to replace the old platform created back in the late 1990s. It had been updated several times, but it was still ‘morally, physically and technologically’ outdated, TsIK head Ella Pamfilova noted.

The aim was to launch the new version in 2022, but development was delayed. According to IStories calculations , this project cost the state at least 20.5 billion rubles ($250 million approx.) from 2019 to 2025. During the same period, the Electoral Commission spent 18.8 billion more on supporting the first version of the system, which was operated simultaneously with the development of the new one and was only abandoned in early 2026.

The GAS Vybory 2.0 system became one of TsIK’s most expensive expenditures. During the 5 years with no federal elections, when TsIK was not spending money on running such campaigns, the GAS Vybory 2.0 system accounted for over 40 percent of the agency’s total annual expenditure.

In autumn 2024, TsIK approved the updated system's development plan up to 2030. Oleg Kachanov, the project’s chief architect, explained that the platform would be moved to a centralized architecture with a shared database located directly at TsIK, and that it would run on Russian software exclusively. Furthermore, the new system would be integrated with other government services (such as the public services platform Gosuslugi, the Ministry of Internal Affairs and the Federal Tax Service’s platforms, etc.) to ensure that voter data is updated in real time. Electoral law experts criticized this approach, arguing that it would be impossible to monitor independently.

Only one TsIK member was discontented with the new concept — Yevgeny Kolyushin, a representative of the Communist Party of the Russian Federation (KPRF). He raised questions about the lack of transparency regarding voter lists and electronic vote records, and attempted to find out how secrecy and lack of fraud would be ensured, but his concerns were ignored. The concept was adopted by a majority vote.

Despite the extensive development work, the new system largely replicates the old one. This decision is understandable, says an anonymous technical expert who examined part of the developers’ archive at our request: “It is extremely difficult to rewrite a huge legacy system from scratch whilst elections are taking place continuously, so the old stack was retained for the sake of compatibility,” they note. Ella Pamfilova also spoke about this: “GAS Vybory 2.0 took all the best features from our first system,” the Election Commission chair said.

According to the expert’s assessment, the developers spent most of their time trying to understand the old system, getting it up and running on new hardware and making a few tweaks, and then fixing the errors that would emerge. They describe the essence of the contractor’s work as follows: “to change things in a way that doesn’t change anything” and to migrate the system to domestically produced infrastructure.

The Election Commission is particularly proud of this shift to domestically produced systems (a part of the general “import substitution” campaign — Ed.), which was one of the project’s key principles: the commission’s chair, Ella Pamfilova, and both key development coordinators (Nikolai Bulaev, the commission’s deputy chair, and Oleg Kachanov, the chief architect of the system and deputy head of the Ministry of Digital Development) have repeatedly emphasised that the updated system exclusively runs on Russian software.

The developers of the system were sceptical about such statements. Here is how they commented on the TsIK executives’ remarks in their work chat groups:

“What domestic software are we talking about? We only use foreign software in development”

“How unpatriotic. The platform owner said it’s domestic, so that’s what it is”

“Well, we’re no longer using Kafka [a foreign platform for data transmission and processing], it’s Кафка now. And it’s Джава instead of Java, the domestic version”

Internal documents reveal that the developers also use foreign platforms (Jira and Confluence) to set and track tasks and store documentation. The team discussed plans to switch to ‘Yaga’ (a recently developed “import substituting” Russian equivalent of Jira developed by Rostelecom — Ed.) — on several occasions, but, according to the team members, “it didn’t take off, and the idea was shelved.”

At the same time, the GAS Vybory 2.0 developers must comply with the import substitution requirements set for state-owned companies. “We have to buy Russian laptops, and, since recently, keyboards, mice and monitors as well. We’re trying to purchase the highest-quality, most functional equipment possible,” they write in chat rooms. The developers bear the cost themselves. They complain that the import-substituting hardware heats up too much, whilst domestic software is not particularly reliable: “To put it mildly, this can be described as low reliability infrastructure; in other words, anything can crash at any time and at any scale.”

In early 2026, the GAS Vybory 2.0 was put into permanent operation. “It's the birth of a beloved child,” Nikolai Bulaev, the commission’s deputy chair, commented at the time. He also described the new system as an “intricate work of art.”

TsIK was delighted with its ‘beloved child’: at the end of 2025, more than 20 people involved in its development received medals, certificates of honour and letters of thanks from the institution. “A huge, full-scale effort was made to develop a completely unique system with no global equivalents. We were navigating a ‘digital minefield’; everything was being done for the first time. The practically impossible was achieved,” Pamfilova praised the new system.

“You have to work in the basement.” The system’s developers

The main developer of the updated system is Tsifrotek, a subsidiary of Rostelecom, Russia’s state-owned digital service provider. This is a single-project company created specifically for developing the GAS Vybory 2.0 system. Tsifrotek states that its mission is to create a “comprehensive solution for digitizing the Central Election Commission of Russia and the country’s electoral commissions at all levels” and to completely replace the old version of the platform.

The company is operating at a loss. According to Tsifrotek’s financial statements, losses had reached 1.7 billion rubles ($20 million approx.) by the end of 2025. The company's revenue was 426 million rubles ($5 million approx.) lower than planned, whilst the operating loss was 304 million rubles ($3,5 million approx.) higher than expected, as Alexey Gusev, the CEO of the company, explained to the staff during an internal conference call.

Tsifrotek explicitly states that the reason for the losses is its “work on a complex, years-long project of national importance — the development and maintenance of the GAS Vybory 2.0 system.” In its early years, the company was actively engaging contractors using borrowed funds, as it lacked the in-house expertise to carry out such work, but needed to meet “high reliability and security requirements.”

The company’s budget was also hit by fines from the state customer. In 2025 alone, the contracting authority imposed fines totalling 152 million roubles on the company (for the system maintenance, the CEO told staff whilst explaining the ‘bonus payments issues’ in the final quarter of 2025). According to him, the fines arise partly due to red tape: even if the developers meet the system maintenance requirements on time, “because of paperwork not filled in on time, the state customer has no choice but to issue fines.”

By 2025, Tsifrotek had already employed more than 300 people. That is also when the company began laying people off, according to its financial statements. One of our sources says this happened because the company “hadn’t calculated the budget properly”: “Firstly, there were a lot of fines following the unified voting day (in 2025, local elections in many regions of Russia were scheduled for the same day, September 14 — Ed.) Secondly, the staff had been paid generously for overtime work, even when it wasn’t actually necessary, and the budget ended up in a mess.”

“At the end of 2025, they simply sacked most of the team,” ex-employees complain in their reviews. They also mention the difficult working conditions: “A very challenging place to work, with a whole lot of services operating in a complicated, confusing way. You have to work in the basement.” One of those interviewed by IStories described the atmosphere within the team as follows: “The attitude towards subordinates was offensive, they didn’t hold back much in their language or jokes, let alone valuing [employment] rights. They were always short-staffed.”

According to reviews, Tsifrotek developers earn an average of around 300 thousand rubles per month ($3,500 approx.) The leaked data shows that the salaries are higher: in 2025, an ordinary developer would earn around 500 thousand rubles a month ($6,000 approx.), whilst a senior developer would earn up to 650 thousand rubles ($7,700 approx.). During the unified voting day campaigns, earnings could increase two- to threefold due to paid overtime.

“For some, the monthly income reached almost a million rubles (up to $12,000), even though their salary only amounted to 300 thousand. And yet, a developer could show up and just loaf around all day,” says one person engaged in the development. In addition, staff are paid quarterly bonuses. According to the leaked documents, in certain months even ordinary developers received over a million roubles. However, since the 2025 unified voting day, the company has had bonuses issues, the staff say: they either do not pay them in full or do not pay them at all.

“It’s just a regular IT company,” an employee tells IStories. “It’s not like everyone has to exercise every morning while listening to the Russian national anthem.” According to another employee, the company is staffed by “ordinary people” — “there’s no sign of some kind of mass Z (pro-war — Ed.) sentiment.” He describes most employees as an “amorphous, apolitical mass”: “Neither supporting [the war and the government policies in general] nor against it.” Sometimes at conference calls, he says, less-than-flattering comments about the authorities can be heard — especially upon VPNs being blocked en masse in 2025–2026 (since 2022, Russia has been blocking international social media and services, hence VPNs have been widely used to access most of them — Ed.) The team communicates on Telegram, so after the crackdown on VPNs remote developers had to “figure something out” to stay connected. It’s easier to access the Internet in the TsIK building itself: “There’s access, so at work you can chill and watch YouTube.”

“The staff would sleep at work.” The development process 

Tsifrotek joined the project in 2023. According to internal conference calls, the company took over the development work from the Systematica company when it was underway.

“At the initial stage, no one had the source code — not Rostelecom, not the Electoral Commission, nobody. Deliveries were chaotic; it was unclear which version [of the system] was being used. The different versions were incompatible with one another. It was a real mess,” Alexander Minchenko, Tsifrotek’s then-director of development told employees at the time.

In 2025, the developers were due to carry out two system trials and then test it in a real election during the unified voting day in September. Alexey Gusev, Tsifrotek’s CEO, admitted during an internal conference call that, as of early 2025, the system was essentially not ready: “To say it’s not ready yet is an understatement.”

“The quality of the system was poor. We identified around 7,000 issues, of which around 500 were critical. There wasn’t a single report that functioned properly,” Alexander Minchenko, then Head of Development at Tsifrotek, said. “How did we conduct elections in such a situation? Well, it was an extremely risky move.”

The team handled the 2025 unified voting day thanks to working overtime — the staff “lived at work” and “carried the unified voting day on their shoulders,” Minchenko noted during a conference call. According to him, ‘a lot of things went wrong’ during the vote, but the developers quickly fixed the bugs — so quickly that the Central Election Commission didn’t notice any problems.

“The whole team simply gave it their all, pushing themselves to 1,000 per cent. I saw people sleeping whenever they could, right here in Room 110 of the data centre in the basement,” Yuri Sakun, Director of Integrated Digital Projects at Rostelecom, described the voting day.

The GAS Vybory 2.0 system features a closed network that cannot be accessed from the internet; consequently, Tsifrotek staff sometimes work within the TsIK building itself. According to one of our interviewees, all staff members are security checked by the Federal Protective Service (FSO) before being issued with a permanent pass to the TsIK. Not everyone passes the check.

The strict access regime has sometimes led to direct clashes between the developers and the FSO. “Today, FSO officers tried to detain an employee and hand them over to the police for leaving late,” one such incident was described in chat rooms in the summer of 2026. Sometimes passes are revoked without any explanation — one can only speculate about the reasons, says one of the Tsifrotek staff: for example, it can be accidentally “taking down the prod [the operating version of the system] at the wrong time,” liking a “wrong” video on YouTube, or simply somehow falling out of favour with the customer to find out later that their pass was no longer valid.

According to an internal conference call at the company, work on setting up the information security department at Tsifrotek only began in 2026. “We have the department, but no staff,” the company’s then-technical director admitted at the time, adding that Tsifrotek lacked the resources and expertise to oversee the contractor responsible for the project’s security, Rostelecom’s subsidiary Solar.

The staff have had basic security training by Rostelecom, an employee told us. “But if work-related communication takes place on Telegram, that speaks volumes,” they add. In the internal chat groups employees mention one of them being hacked. They also regularly discuss suspicious files infiltrating into the code base of the system.

The Central Election Commission states that the upcoming State Duma elections will take place in “extremely challenging conditions,” and that the agency’s top priority is security. According to Oleg Kachanov, TsIK is successfully combating digital threats, such as DDoS attacks. This fight leads to malfunctions and obstructs work, says a person involved in the development of the system: the internal services frequently crash, and the IP addresses used by the portal’s team themselves get blocked—“this has caused several outages.” “There’s a constant struggle when it comes to security. The client plays it safe and says, ‘Let’s block it,’ but because of that, we can’t work,” the developer says.

The development progress would be demonstrated at special presentations for the customers from TsIK’s Federal Center for Informatization, the government and Ella Pamfilova personally, according to internal discussions among the developers.

Errors were sometimes corrected at the last minute before demonstrations and report submissions. “We have an urgent problem <...> An error in mapping the campaign reports — the FCI is coming for the report at 9:00 a.m., and we won’t be able to provide it to them,” they wrote in the chat just 30 minutes before the deadline. The employee responsible for this replied that the cause was a misspelling of the “United Russia” party name: “They wrote ‘RUSSSIA’ with three S’s <...> But for the report, you can temporarily correct the mapping <...> Make it say ‘UNITED RUSSSIA.’”

On the customer’s (the FCI) side, the development was overseen by Rodion Shchekuteev, the deputy head of the agency, and Dmitry Gundin, head of the Department for the Collection and Processing of Information Resources at the GAS Vybory 2.0 system. New versions were personally approved by the FCI Director, Alexander Sokolchuk.

In 2023, the Tsifrotek employees discussed raising money for New Year’s gifts for several representatives of the customer: three of them, including Sokolchuk and Shchekuteev, were to receive “VIP gifts.” According to the chat logs, only 30 employees “voluntarily decided to financially contribute to the gifts” for the client’s representatives, and 2,350 rubles ($30 approx.) were raised from each of them.

“We had systems that were completely unfinished, but we had to submit what we've done according to the contracts,” says one of the sources interviewed by IStories. According to him, they would succeed in part thanks to such gifts: “We would come and say, ‘Yes, yes, we’ll definitely get everything done, but it’s not working right now. Here’s a nice gift, by the way. Please sign here; we need to close the contract.’” Most often, they would present alcohol in large amounts: “Not exactly bribes, but gifts. All those huge trunks were X-rayed by the Federal Protective Service at the entrance.”

“The systems are being refined as we speak.” Is the platform ready for its first federal election? 

According to one of the Tsifrotek employees interviewed by IStories, the GAS Vybory 2.0 system is almost ready and operational, but some systems were “being refined literally as we speak.” After the 2025 unified voting day, the developers had many tasks, but the client’s requirements changed frequently. The staff had to find compromises, which is why many things don’t work the way they should, our source explains. Meanwhile, the developers are “working an awful lot of overtime,” and the terms of government contracts are often not being followed — “they turn a blind eye to what needs to be documented.”

This year, for the first time, State Duma elections will be held in the Ukrainian territories occupied by Russia since 2022. Before making this decision, the Central Election Commission consulted with the Russian FSB and the Ministry of Defense.

According to the sources interviewed by IStories,” the digital infrastructure needed to conduct elections in these territories was still not set up. “It’s total garbage, to put it mildly,” says one of the employees. “This is where it’s really possible to manipulate and alter things — it’s very difficult to verify the data coming in [from the occupied territories].”

The idea of voting in the annexed regions places an additional burden on the GAS Vybory 2.0 system — for example, in terms of communicating address data. At a call, developers discussed the way the system had to process larger address information files because of the occupied territories being included in the voting process. “If, for example, a long street is renamed, or a new region is annexed or separated — I don’t know, anything like that — the [address] file will take up over a gigabyte (at that time, the respective part of the system could only handle files smaller than 800 MB — Ed.).”

Confusion over addresses in the occupied territories has led to widespread malfunctions in the subsystem used to keep track of the voter registry. In the occupied parts of Ukraine’s Donetsk, Luhansk, Zaporizhzhia, and Kherson Oblasts, there were more than 95,000 “address-related incidents,” which amounts to about 10% of all current malfunctions in the subsystem, the developers noted. Problems with addresses have also been arising in the annexed Crimea. “There are now ZERO residents on the street,” “all voters from both addresses are gone” — Crimean Sevastopol system administrators wrote in their technical support requests in 2025 and 2026.

System tests continued until September 2026. Just a few weeks before the election, developers were still sorting through dozens of requests to fix errors, according to the internal documents. The system incorrectly calculated the percentage of election commissions that had submitted reports and produced values exceeding 100%; errors occurred while determining winners in multi-member districts and while generating the voting records.

In the region of Bashkortostan, deceased individuals have appeared on voter lists on several occasions. The most recent report on this issue was received on August 31. It is unknown whether the problem had been resolved before the election began. There were also candidate verification issues: the Bank of Russia reports would not arrive, and inaccurate tax information based on tax data would not be successfully generated.

To resolve some of the issues, developers changed the database manually, bypassing the standard protocols. Manual edits were performed during the testing process, but it remains unclear how such problems will be addressed during actual elections and who will be authorized to edit the result fields in the database.

This is just one of the potential vulnerabilities in the system.

The structure and vulnerabilities of the system

Doubts about the integrity of Russian election results have existed for a long time. As far back as 2011, Sergei Shpilkin’s calculation of fabricated votes cast in favor of pro-government candidates went viral. 

Eight years later, Moscow tested the electronic remote voting system developed by the Moscow City Hall’s IT department for the first time, and this raised more questions: observers could not verify that the electronic votes had not been tampered with at any stage, or that voters had cast their ballots in person and did it voluntarily. At the same time, Rostelecom developed another remote voting system — a federal one — for other regions. In the September 2026 State Duma elections, the federal remote voting system will be used in 32 regions.

IStories examined the operation of the GAS Vybory 2.0 system, including the components involved in compiling voter rolls, interacting with the remote voting systems, and counting the votes. At our request, the documents from the Tsifrotek leak were also examined by Ivan Shukshin, an election analyst, and two technical experts who requested to remain anonymous. Together we identified the main vulnerabilities in the system the Central Election Commission could exploit to influence election results.

Our analysis is based on the documents and the module code available to us. It is possible that, as of the time of publication, the system’s components may function slightly differently than it was described there.

Vulnerability #1: tampering with the results

After the votes are counted at the polling station, the election commission prints and signs the final document containing the results. The voting results can then be entered into the GAS Vybory 2.0 system in two ways: automatically (by scanning a QR code or uploading a PDF file) or manually.

According to the documentation, manually entered data is not cross-checked against the original documents. However, results uploaded to the GAS Vybory 2.0 via a QR code can also be edited manually. The system stores previous versions of the documents and the username of the user who made the changes.

It was the loose treatment of the result transferring process that made it possible to rig the results at a polling station in Saratov in 2024. At that time the old Elections system was still in use. Vladimir Putin received 300 more votes than the local commission had recorded in their voting results documents. More than two hundred unused ballots were rewritten in his favor, while the number of spoiled ballots and votes for other candidates was underreported.

“Our election law states that results must be published at all polling stations; they’re always public,” explains a Tsifrotek developer interviewed by IStories. “Next, the final aggregate results must be published. Given that we now have AI, having the AI verify everything isn’t a problem at all. If someone wants to change something, it will be easy to spot.”

The results are indeed published in electronic format on the TsIK website. However, this data does not let one verify that the published results match the signed physical documents (which can also be falsified).

According to the discussions in the Tsifrotek chat, the result calculations in the system raises doubts among the developers as well: “Colleagues, you’ve apparently been working with TsIK for a long time now — why would anyone at a polling station need to assign or manipulate [votes] when there’s the wonderful PAIP, which aggregates the data and produces the results, and no one knows how it does it?” one of the developers wrote.

Vulnerability #2: voter list manipulations

In the leak, IStories discovered the data on 111.3 million voters from the RUIP register — including their names, dates of birth, residential addresses, and the polling stations to which they are assigned. This suggests that developers — and likely the election commission staff as well — can export unencrypted personal data of Russian citizens.

“Security experts were very concerned that personal data was being transmitted in plain text, with no one encrypting it,” one of the developers involved in the project told us. “There are opportunities for leaks, and there are a lot of them.”

The metadata from the voter files indicates that the data was uploaded in July 2026. The numbers of voters broken down by region largely match the Central Election Commission’s figures as of July 1 — discrepancies do not exceed 1%, except for the territories annexed in 2022 .

We compared the voter lists from the leak with the civil registry offices’ death registration data since 2022, which was provided by the Manticore project. According to our estimates, the data from the GAS Vybory 2.0 system included at least 104,000 people declared deceased in the occupied territories, including Crimea, as well as in the Kursk and Bryansk Oblasts.

The process of preparing voter lists for remote voting is one of the vulnerabilities in this subsystem. According to the documentation for the nationwide training session on using the GAS Vybory 2.0 system, system administrators at the territorial election commissions can manually enter applications for remote electronic voting into the database.

With direct access to voter rolls, system users could likely artificially inflate the number of e-voters. Such manipulation may have occurred in 2021, when several people interviewed by Meduza were surprised to discover that they had been registered for remote voting without their knowledge.

After the application file is uploaded, the system checks its structure, its compliance with reference databases, and whether the voters are present in the RUIP database. However, the origin of the file is not tracked: a user with privileged access can manipulate the voter list — according to the documentation available to us, no digital signature is required to upload it.

Vulnerability #3: remote electronic voting

The remote electronic voting (DEG) system is a “black box,” and observers can only evaluate its actual operation based on official statements from the developers. Two remote electronic voting systems will be used in the 2026 elections: the federal system and the Moscow system.

Tsifrotek is not involved in the development of either the federal or the Moscow remote electronic voting systems. The GAS Vybory 2.0 system receives votes that have already been processed from the blockchain. However, in their documentation Tsifrotek clarifies that the term “blockchain” in this case does not correspond to its generally accepted meaning, and they cannot guarantee that the remote electronic voting system operates exactly the way it was explained to them.

Results from the remote voting system are exported as a ZIP archive containing XML files, which must correspond to files with electronic signatures. In this case, altering the results in the XML file is supposed to trigger an error during verification. The archives containing the results are then uploaded to the GAS Vybory 2.0 system: the federal one to the MV DEG module; the Moscow one, to the MV Moscow module.

According to the DEG MV documentation, when a result archive is imported, a verification process starts: each XML file must have a corresponding signature file. It is unknown whether this process actually works as described.

However, the code for the MV Moscow component, where electronic voting results from the capital are uploaded, contains a significant vulnerability. The system locates the signature files but does not verify them, allowing files containing results to pass through even if they are not confirmed by an electronic signature. When the remote voting results reach the protocol, the system does not record the fact that the original results were not backed by an electronic signature.

“There’s no point in talking about vulnerabilities, because this software doesn’t record votes, it processes the finalized results, and those can be altered at every step: files can be manually edited, and changes can be made in the database after they’re imported,” a technical specialist who analyzed the MV Moscow module code told IStories. In his opinion, for the system to be trustworthy, its components must be independent: “If all of this is happening within Rostelecom, will Rostelecom argue with itself about fraud?”

Is the updated GAS Vybory 2.0 system trustworthy? Developers weigh in

The people who created the new version of Russia’s election platform have mixed views on whether its results can be trusted.

Some sincerely believe in the project: “I have a great deal of confidence in the new system. We’re building a fair tool that lets people vote however they want,” says one of our interviewees. “As for what happens outside the system, we can only speculate. I believe the system calculates [the election results] correctly. Then we look at the results, and everyone starts shouting, ‘It’s fraud!’ For me, this isn’t fraud, but the sad truth, unfortunately: apparently, [the election results] reflect the will of the people.”

“I still think that the fairer results wouldn’t affect anything. It’s just that, apparently, the number isn’t actually 80, but rather 60 [percent of those voting for ‘United Russia’],” he adds. “I did what I could to make an impact on my end. But from here on, it all depends on the people.”

Another Tsifrotek source interviewed by IStories disagrees: “You can rig or steal the votes in any system you have access to. As far as I’m concerned, the outcome is clear to everyone — we know who will win the election and who won’t.”

At the training sessions where developers tested the system, the outcome was also known in advance — the majority of seats went to the “United Russia” party.

Read on istories.media →

This is how Ivan Kirsanov, a 24-year-old programmer, describes starting his former job at one of the companies within the Citadel holding group, the main manufacturer of the surveillance system for the FSB, Russia's Federal Security Service. Kirsanov has since quit and now works as a shepherd on a farm in France earning four euros an hour.

Ivan left Russia in 2025, taking with him a technical documentation archive related to SORM, a system of interception interfaces used for surveillance in Russia, produced by Citadel. IStories spoke with Ivan and examined the archive.

The traitor

Ivan grew up in the small town of Zelenodolsk, not far from Kazan, Russia. He is the youngest of three children. The Kirsanovs lived modestly: the father worked as a driver, and the mother as a cleaner at a factory.

“I wouldn’t even ask them to buy me anything because I knew it was impossible. For example, I wanted a new computer because I played games and did some programming. Finally it was my sister who bought it for me, not my parents.”

Ivan began learning the fundamentals of programming at the age of 11. He would watch YouTube tutorials on how to write cheat codes for Minecraft, and YouTube was where he came across Alexei Navalny’s videos. Kirsanov began to “delve into the subject and take interest in politics.” In one of Navalny’s livestreams, the late politician had mentioned that Russian schoolchildren weren’t given textbooks at schools, and this, according to Ivan, “hit the nail on the head.” His school had the exact same problem.

Kirsanov then wrote a complaint to the Ministry of Education, which was forwarded to the school. The administration did not appreciate the initiative. “They started telling me that I’d let the whole school down, that I was a traitor, and that the school would face major problems and trouble because of me. My parents were asked to meet with the principal, even though I was doing well in school as I valued my reputation,” Ivan recalls. His relationship with the teachers deteriorated, but they did provide him with textbooks after all.

Kirsanov realized that taking action worked, so he kept doing what he saw as working. A complaint to the housing and utilities department helped restore hot water in his friend’s home, and a complaint about the summer obligatory work program at school helped escape the obligation to shovel out basements. In ninth grade, Kirsanov and a friend attended their first protest in Kazan — the “Voters’ Strike” against Navalny being banned from the 2018 presidential election. Kirsanov’s parents did not support their son’s political activism: they threatened to take away his pocket money and cut off his internet access.

After ninth grade, Ivan was told that his family couldn’t afford his university education. Following his parents’ advice, he enrolled in a college in his hometown to study shipbuilding, a discipline that didn’t interest him at all. In his third year in 2021, Kirsanov attended another Navalny support rally when the politician was arrested upon his return to Russia .

This time, Ivan was detained and fined. The administration of his college threatened to expel him. “You screwed me and the principal over, do you understand? I don’t need students causing problems! We just need to get rid of you,” the academic dean would scold him.

Kirsanov was not expelled from college, but the consequences of the protest did not end with that. The then student began receiving the prosecutor’s warnings on the “unacceptability of participating in unauthorized protests,” and in the fall of 2021, the Center for Combating Extremism officials visited the college. Ivan was called in for a “chat” and asked about his views on Navalny. By that point, Navalny's Anti-Corruption Foundation (FBK) had already been added to the Russian extremist and terrorist organizations list, and some protesters had received actual prison sentences.

“After that interrogation, I finally realized that if I kept doing something like that, they would simply ruin my life… I was very scared. I knew I would have to keep quiet because I wanted to protect myself.”

The way out of poverty

Acting on a friend’s advice, Ivan enrolled in School 21, a Russian franchise of École 42, a French programming school. The curriculum at School 21 differed from typical Russian education. The students are taught for free, and there are no lectures or teachers — they learn the material on their own, submit their projects and grade each other’s work.

“The school changed me. In college, I was surrounded by very strange people who, basically, didn’t really need anything in life. I felt very lonely; there was no one to have interesting discussions with. But at School 21, there were enthusiastic people of different professions and ages. It was as if I had stepped into some different world.”

Ivan devoted all his free time to programming, and six months later he landed an internship at Sber, Russia’s biggest bank. “It was just amazing for me,” the developer recalls. “At 19, I was working as a programmer at one of Russia’s top companies. At the time, I was making about 50,000 rubles ($650 approx. as of 2021) a month. That was more than both my parents would earn combined.” At first, he didn’t even spend his salary: he just saved it and “felt better.”

Three months later, Kirsanov was offered a full-time position. His salary nearly doubled, but it was getting harder and harder to keep up: there were a lot of uncompleted college tasks, and his professors were threatening to not let him take his exams and to expel him.

“My life was falling apart. If I’d been expelled from college, I would have been drafted into the army. If I’d been drafted, I would have lost my spot at ‘School 21’ and my job at Sber, which was my only way out of poverty.”

Ivan felt alone: his parents weren’t supportive of him, and his relationship with his girlfriend fell apart. He was diagnosed with an adjustment disorder and prescribed antidepressants. In June 2022, he finally managed to graduate. His problems with the college were over, but so was his student military service deferment. To hide from the military enlistment office, Ivan moved to Moscow.

A life the way it should be lived

Kirsanov began building a “richer life” in Moscow. He rented an apartment, took up horse riding lessons, bought a motorcycle and rode it across Russia; for the first time in his life, he flew to Sochi on vacation.

“I saw the sea and realized that besides the life I’d been living — constant work, constant studying, a pretty low-income life — there’s another kind of life out there. And that’s the norm; that’s the way it should be lived by everyone.”

His friends from School 21 would find better jobs and start getting bigger paychecks. Ivan had got promoted several times, but he wouldn’t catch up with his friends. In the summer of 2023, he quit a position where he was earning three times his starting salary — which, just a year earlier, had seemed “something out of a fantasy” to him.

Kirsanov found a higher-paying position within three weeks. MFI-Soft, a company based in the Russian city of Nizhny Novgorod, promised shared workspaces equipped with kitchens and breakfasts provided, a company laptop, and the net salary of 200 thousand rubles ($2.200 approx. as of 2023). Neither the job responsibilities nor the company’s line of business were of decisive importance to Ivan at the time. During the interview, he was told that the job was related to the Yarovaya Law Package compliance, the infamous regulation of continuous data storage for the purposes of Russian state security and law enforcement agencies. ‎

“At that moment, I just nodded and said, ‘Wow, that sounds great.’ But I didn’t actually care. I’d never even heard of that company.”

The FSB’s poor quality code

The company unknown to Ivan had been developing technical tools for the SORM surveillance system practically since Kirsanov’s birth. The enterprise had been called MERA back then. In 2003, a division dedicated to developing the SORM solutions was created within the company. That division later became a separate company, MFI-Soft.

In 2016, the Russian telecom industry was taken aback by the Yarovaya Law Package which required Russian internet providers and mobile network operators to store (and share with the FSB) massive amounts of their customers’ traffic: their correspondence, phone calls recordings, and the photo, video, and audio files they share. From the telecom companies it required spendings several times greater than their annual revenue.

Six months earlier, major changes had begun in the SORM systems development market, as those were private companies responsible for the software. Anton Cherepennikov, an entrepreneur, the Virtus.pro esports club owner, and billionaire Alisher Usmanov’s business partner (Usmanov himself is a close associate of Putin) founded the Citadel group and began acquiring firms supplying equipment and software for the SORM system. The 2017 acquisition of Nizhny Novgorod-based MFI-Soft made Citadel the largest player in the SORM market . A year later, the group owned five of the seven companies whose services the Russian Ministry of Communications had recommended to the internet providers and mobile operators to be able to comply with the Yarovaya Law, accounting for up to 80% of the market.

“We certainly stood out from our competitors in the SORM market—at that time, they were mainly former state scientific research institute employees or state security services officers,” Cherepennikov said in 2019.

Ivan Kirsanov had to work on improving a product of one of such companies, Nika-X, which became part of Citadel. In correspondence with his colleagues, he discussed the poor quality code written by “the developers from the FSB”. “They’re well-trained, but they lack real-world experience because they can’t work at normal commercial companies,” a senior colleague explained to Ivan. When the war had begun, the “FSB developers” had resigned. As Ivan assumed, they were “needed by the state in a related field.”

In July 2023, when Ivan was already working at MFI-Soft, all the holding company’s SORM-related subsidiaries were consolidated under the Citadel brand.

From the user to the FSB

In the summer of 2023, Kirsanov joined the MFI-Soft department that handled internet traffic as a senior software engineer. The documents archive he shared with us shows in detail what happens to the internet traffic data on its way from the user to FSB employees.

We examined these documents with the help of Leonid Yuldashev, a cybersecurity expert and project coordinator at eQualitie. What can FSB officers learn about Russians’ online activities using SORM, according to the documents, and how does the system identify services and messaging apps?

The SORM equipment is installed within the operator’s network to intercept the complete copy of all the users’ traffic. This is a massive volume of data. To extract useful information from the raw data, the traffic must be parsed. SORM has a special component for this, called the extractor. This is what Ivan was working with.

The traffic is parsed layer by layer. One of the first stages is accounting, during which SORM links the traffic to a specific subscriber. In a mobile network, this is done via the phone number and the user’s IMSI; for the wired access, it is done via the login used for authentication with the provider. Therefore, all online activity via home Wi-Fi is linked to the person who signed the contract via the subscriber identification.

Next, the extractor monitors the traffic flow and attempts to identify the nature of the connection — whether it was a message app call, a file transfer, an email, or a website access. In the documentation, this process is called “tasting.” The type of connection can be recognized by:

•  signatures, patterns or distinctive features distinguishing one type of traffic from another;
•  server name identification (SNI);
•  indirect statistical characteristics.

Finally, the content of the traffic is analyzed. Here, the system’s capabilities are severely limited. Modern services encrypt traffic, and, according to Kirsanov, the developers at MFI-Soft and Citadel were not tasked with decrypting it. The message text, the conversation audio, and the transferred files remain inaccessible for decryption.

But even encrypted traffic leaves some metadata traces. The metadata can reveal when a person logged on, which websites they visited, how much data they transmitted, how long their messenger call lasted, and when it began and ended. By analyzing metadata, one can discover one's interests, and by comparing the call start and end times of different users, one can determine who is communicating with whom. It is unclear from the documents whether the FSB engages in such traffic analysis.

The FSB officers access SORM through control consoles. This is how they filter out the information they need from all the traffic. A SORM operator can set various parameters for intercepting the traffic: the IP address, the phone number, the email address, or the server domain name. E.g., it is possible to collect all traffic identified by the system as “Telegram,” or to monitor everyone who visits the FBK website, or the “Freedom of Russia” Legion website. ‎

Technically, it is possible to filter traffic by a specific word mentioned. In the training presentation example, the word “blow up” appears among the filtering criteria. However, according to a former SORM developer, full-text search was rarely used — neither in the test environment nor with the real data — as it consumed a lot of resources and slowed down the performance. Moreover, there is very little unencrypted traffic data for the full-text search to process.

The analyzed traffic which did not reach the control panels based on the selection criteria is not lost. Statistics on all connections and the available content of messages are sent to the Yanvar data storage system, where they are stored for six months to three years, depending on the type of data according to the Yarovaya Law. During this entire period, the government security and intelligence agencies can access the stored traffic, but it is unknown whether they do so or to what extent.

Telegram, Signal or Google: How well can SORM see encrypted services data?

To extract the valuable information from traffic more effectively, the developers use decoders: software modules designed for a specific service or app. These decoders do not decrypt the traffic, but they allow the developers to identify the services and collect more detailed metadata.

Such decoders exist for many messaging apps — for example, Telegram or WhatsApp — as well as for traffic anonymization services (Tor or various VPN services) and for certain cryptocurrencies. If no decoder has been written for a particular service, information will still be collected. But in that case, some data may be lost, and the traffic will be marked as unrecognized, Kirsanov explains.

Upon reviewing the decoder documentation, we figured out how well SORM can “see” the data in some popular messaging apps.

• There are decoders for Telegram, WhatsApp, IMO, Zoom, Viber, WeChat, and Discord. SORM detects the mere fact that these services are being used and collects call metadata, but it does not know what you are discussing.

• There is no decoder for Signal. Based on the available documents, it is the most inaccessible service to SORM out of the entire list: it's even questionable if the system can reliably detect its use. Apparently, the system views its traffic as a standard encrypted connection without specifically identifying it as Signal.

• Outdated, unencrypted services such as ICQ, Mail.ru Agent, or Jabber are the most transparent to SORM. The system can even access the message content. According to cybersecurity expert Leonid Yuldashev, activists occasionally come up with the idea to revive such services and use them for secure communication. The documentation we reviewed shows the opposite.

• Search queries and results on Google are invisible to SORM. However, the system knows that a user accessed the google.com domain.

• There are no decoders for Google Meet and Google Drive. All of these services appear as Google traffic, which SORM identified by domain names in secure connections. The conversations, files, and search queries themselves remain inaccessible. The system can likely distinguish a Meet video call from a file upload to Drive, but only based on indirect characteristics: the domain and the type of data flow (a long two-way exchange looks different from a one-way file upload).

• SORM can detect some VPNs being used. There are decoders for the classic OpenVPN protocol — which most such services use — and the outdated PPTP protocol. However, modern protocols like WireGuard or VLESS are not mentioned in the documentation. The services designed to bypass Russian restrictions are currently switching to these very protocols. VLESS disguises itself as regular HTTPS, so to the system it most likely appears as some ordinary encrypted web traffic. It is unclear from the documents how WireGuard is perceived by the system.

The data on Russians’ online activities that SORM is capable of collecting is of little interest, since a significant portion of the traffic is encrypted, Yuldashev concludes. But with messaging apps blocked, users rely on VPNs, and if a VPN doesn’t work and there’s no access to messaging apps, people switch to phone calls and text messages, which are already transparent to SORM, the expert points out.

Many Russian services, including Yandex and VK, also use encryption. The documents reviewed contain no information suggesting that SORM can decrypt or analyze Russian encrypted services in greater detail than foreign ones. This is also confirmed by Kirsanov as a former developer of the system. But this does not mean that communicating via such messaging apps is safe: SORM is far from being the only weapon in the security forces’ arsenal.

The tasks from FSB

The main SORM users are the FSB officers. From them, developers get tasks to make improvements and fix bugs in the system, yet their own security requirements prevent these bugs from being fixed promptly.

Without the full access to detailed error logs, the developers cannot immediately understand the cause of the problem and spend significantly more time resolving it, Kirsanov explained.

The security service was not very quick to adopt the improvements from the developers. “The FSB still has not tested them or put them into operation. They don’t have time,” one of Ivan’s colleagues described the status of the settings that had been submitted for approval a year before.

Not only did the FSB give the developers tasks, but expressions of gratitude as well. In the first half of 2024, Citadel completed the system implementation in the newly-annexed regions of Kherson, Zaporizhzhia, Donetsk, and Luhansk. Those responsible for the project received a letter of appreciation from the FSB, and all Citadel employees were notified of this via corporate email, Kirsanov explained.

Other government agencies do not have direct access to the system. The Ministry of Internal Affairs officers must submit reasoned requests if they want to place someone under wiretap, Andrei Zakharov shares in his book, Russian Cyberpunk.

However, regular Citadel employees do have access to the data. Ivan recalls intercepting the internet traffic of the Tele-2 operator in Nizhny Novgorod to complete one of his tasks. “I could analyze it, or do whatever I wanted with it. Without any special authorization, I could effectively monitor real people. In reality, every developer at the company has been able to do so,” says the former SORM developer.

“We make the world a better place.” What SORM developers think about their work

The authorities state that SORM’s purpose is to help solve crimes, track down criminals, and prevent terrorist attacks. Some developers see this as the end goal of their work as well.

“What do you like about your work?”

“The creative approach. We make the world a better place by using cutting-edge development and testing tools.”

“Have you ever considered that SORM could be used for political persecution, not just to fight crime?”

“There are people who manufacture weapons; they provide the technical means to physically eliminate both enemy forces and civilians. I can’t be held responsible for who pulls the trigger of the gun I made. I make guns. I like it.”

This is how Alexei (the name has been changed) — a current Citadel employee who spoke with IStories on condition of anonymity — describes his work. Another employee’s position might be understood from his messages in public Telegram chats.

“The FSB always acts strictly in accordance with the law. <…> It is technically impossible to incorporate selection criteria into the operational and investigative system without a valid court order number. Therefore, when it comes to organizing illegal surveillance, the FSB’s technical capabilities (and the FSB itself) are absolutely no help at all.😉”

However, in the video depicting the control panel in action, there is no field for a court order number to be seen. Kirsanov has also confirmed that he had never heard of such a requirement.

He, too, quickly came to embrace the same idea of his work’s mission. “At first, I went there for the money, but then I started to capture the overall spirit: we do something useful, we fight crime by writing great software which is used to catch murderers and terrorists,” the developer recalls.

Six months after starting the job, Kirsanov even suggested creating a regular motivational newsletter with the information about crimes solved using SORM to an HR department colleague. She told him that this was classified information and the company didn’t have access to it.

The extent to which SORM is actually useful in criminal investigations is not publicly known. As far back as 2020, researchers from a department of criminology in Perm noted that in all the years SORM had been in operation, there had not been a single official statement regarding its use in solving prominent crimes. Back then, the researchers recommended introducing a formal report system on the efficiency of SORM by law.

After the March 2024 terrorist attack at Crocus City Hall, when terrorists killed 147 people, it became completely clear that SORM was not performing the way it was supposed to, The Bell reported. After the attack — which SORM failed to prevent in any way —the control over the internet surveillance systems shifted from the FSB’s Scientific and Technical Service to its Second Service, which is known for persecuting the opposition and Alexei Navalny's attempted poisoning.

IStories reported more on the way the FSB is attempting to achieve total surveillance over the citizens with the help of newly-introduced big fines.

From Paris to Mariupol

At Citadel, Kirsanov would perform routine and not-so-exciting tasks related to product improvements, working remotely and seeing his colleagues only during conference calls, so he was unable to find friends among them. He decided to seek new experiences outside of his work and the country.

In the first year of the war, the French École 42 ended its partnership with Sber. Students could either transfer to the French branch or remain at the Russian School 21. Ivan chose the French school, was granted a French student visa, and went to Europe by bus in the fall of 2023, a month after starting work on SORM. The upcoming autumn military draft was a significant factor in his decision to leave.

Ivan would switch his IP addresses to Moscow-based ones and develop software for the Russian intelligence right from his apartment nearby Notre Dame, and at night he would walk over to the Eiffel Tower. His first emigrant experience turned out to be far from easy. “I was under constant stress because I was working illegally from abroad; I knew it could be discovered, and I would be fired. I had to take antidepressants and couldn’t sleep properly,” the developer recalls. Neither his family nor his colleagues knew he had left. A month later, he had to return as he was invited to a work conference.

A few months after returning from Paris, Kirsanov set out on a new journey. This time, he headed to Mariupol, a Ukrainian city which had been heavily destroyed and then occupied by Russian troops in 2022. “I wanted to see the war. I could monitor it online, but I wanted to see it with my own eyes, to experience what it’s like to live in a state of war,” he explains, describing his choice of destination.

Kirsanov got scared by the sight of the ruined city and the completely destroyed Azovstal plant , along with the local residents’ accounts of how they collected rainwater for their children to drink and sheltered from the bombing in their homes. He left the occupied territories that very same day, but even after the trip, he would still avoid thinking about the war. “I understood that something terrible was happening, but I didn’t support either side. I tried not to think about it and to keep all those thoughts locked away in some separate box so I wouldn’t have to face them.”‎ ‎ ‎ 

Resignation

In March 2024, Ivan received a letter from the European Court of Human Rights. The ECHR ruled Russia violated the European Convention on Human Rights when Ivan was detained at a January 2021 rally along with the other protesters, and he was granted a EUR 4.000 compensation. However, neither Ivan nor the other applicants received the money because by March 2024 Russia had been outside the jurisdiction of the ECHR for two years.

Nine years earlier, in December 2015, the ECHR had ruled that the SORM usage legislation in Russia was violating the European Convention on Human Rights and the right to respect for private life covered by it. Russian regulations did not provide “adequate and effective guarantees against arbitrariness and the risk of abuse which is inherent in any system of secret surveillance,” the court’s ruling stated.

Ivan didn’t know about the ECHR ruling on SORM; he was 13 at the time. But the ruling regarding his own detention made the developer think. “I remember I wanted to tell my friends about it, but I didn’t know how to approach it. On the one hand, I basically work within this system; on the other, a ruling like this emerges. I never told anyone,” he recalls. ‎

Kirsanov resigned a few months later, but the reason was the same as the one that had originally brought him to the company: he asked for a promotion and was told to wait.

“They want loyal employees. They were counting on people who would work quietly for eight years and never ask for anything, never seek promotions, and just be a cog in the machine,” Kirsanov describes. An example he gives is his former colleague who had been with the company for about 10 years, earning below market the entire time. Leaked data shows that in 2025, this employee was earning just over 130 000 rubles a month ($1.500 approx as of 2025), which is a third less than the salary Kirsanov started with.

Money wasn’t the only reason for his resignation. Kirsanov described he “didn’t grow much as a programmer” during his year at the company. He recalls suggesting implementing new solutions, from AI to optimizing error handling. But the management was not enthusiastic about these ideas. “It was a company with good working conditions and up-to-date processes, but there was no innovation as such,” Ivan describes Citadel.

After being denied a promotion, he began looking for a new job and having online interviews right from the company’s office. Management noticed this fairly quickly. He was given a choice either to quit or to stay agreeing to never seek employment elsewhere and to exclusively work at Citadel. Ivan decided to quit.

“If they had promoted me back then, if they had given me the opportunity to grow professionally, most likely I would keep working there, climbing up the career ladder and doing increasingly worse things. I would sincerely believe I do the right things, just as I believed back then.”

Abduction

After he quit, Ivan recalls, he quickly found a new job and began gradually reconnecting with old acquaintances, following independent media, watching the oppositioners' and military analysts' blogs on YouTube and donating to human rights activists — “getting back to himself after many years,” in his words.

On the first anniversary of the murder of Navalny, Kirsanov went out to a one-person protest. He knew that being detained could lead to problems with the military registration office, as he still didn’t have a military ID {a document proving a Russian citizen’s status regarding the obligatory military service}, but he felt it was important to him not to remain silent, he says.

“By early 2025, the big picture had become absolutely clear, and I realized that something horrible was happening in Russia — a war going on, the growing isolation. I began to understand that I could no longer stay there.”

While preparing to leave, Ivan listed his car up for sale. A meeting with a potential buyer was scheduled for April 24, 2025. Instead of the prospective buyers, two men in plain clothes approached him, showed their police IDs and forced Ivan into their car. Kirsanov figured he was being abducted. He opened the car door and unsuccessfully tried to get people’s attention, then decided to tear up his passport, recalling Belarusian opposition activist Maria Kolesnikova doing the same . But that didn’t stop his captors taking him to the police station in Khoroshevo-Mnevniki .

Ivan recalls throwing himself to the ground outside the police station, screaming for help, and threatening to kill himself. The police officers clearly weren’t expecting such a reaction. They began to mock him, then tried to persuade him to enter the station and call his parents or a lawyer, but called an ambulance after the suicide threat.

The doctors took Kirsanov to a mental hospital, where, after being questioned, he was released due to his friend agreeing to take responsibility for him. Ivan didn’t know why he had been abducted, but he suspected it might be related to his involvement in political activities over the past few months. Two days after the abduction, he flew out of Russia.

The departure and a new life

Kirsanov flew to Serbia and moved to France six months later, as his studies at École 42 enabled him to obtain a French residence permit. This time, he wasn’t facing the threat of getting fired; his savings allowed him to not work, and the threat of persecution vanished. “From the very first days, I began to feel the freedom that everyone should have,” recalls the former surveillance software developer.

Ivan enjoyed long walks, went on short trips within France and became a volunteer with the Get Lost human rights organization. He worked on the hotline, giving instructions on how to obtain a military ID and avoid conscription, providing emotional support and referring people to counselors in the more complex cases.

The life of an unemployed emigrant and his attempts to legalize his status quickly ate up all his savings. Since the fall of 2025, Ivan has been living “a minimalist lifestyle”: he stays in a trailer on a farm and herds goats and picks strawberries there. In his free time — of which he now has plenty — he plays video games, reads books and rides his bike.

Kirsanov plans to enroll in college and enjoy a “peaceful student life” without having to combine it with working. He wants to learn the language and integrate into French society. However, first he needs to resolve his documentation issues. His student residence permit is about to expire, and the French authorities rejected his asylum application: they did not believe he faced a risk of persecution in Russia. Currently, Kirsanov is getting ready to file an appeal.

Meanwhile, the Russian Ministry of Internal Affairs has issued a statement explaining that in 2025 Ivan was “voluntarily” taken to the police station to be interrogated as a witness in a criminal case in accordance with Article 119 of Russia's Criminal Code, Threat of Murder or Infliction of Grave Injury Health. The case is being handled by the St. Petersburg Center for the Security of Persons Subject to State Protection.

Kirsanov suspects that the case may be linked to his messages to a former Federal Penitentiary Service (FSIN) employee, Igor Potapenko, who later became St. Petersburg’s vice governor for security. Ivan had learned that Potapenko had been involved in torturing Ukrainian prisoners of war, so he sent him private messages on VK requesting a comment on the allegations — according to him, he wanted to “generate public pressure.”

“I don’t see any scenarios in which I would definitely return to Russia. Some people have told me I shouldn’t tell my story without hiding my identity. But I’m not the only one; the others remain silent and don’t speak out. Yes, I had no control over how these systems would be used. I created them with good intentions. Nevertheless, I became somewhat complicit in it all. I was also scared and afraid, but I think people need to know the truth.”

Read on istories.media →

When they almost reached their destination, they saw two vehicles in the forest belt: "We thought those were two ‘UAZ Hunters’ and headed over there, [thinking our platoon was there].” We heard an unintelligible shout from there, and then shooting started.

“After that, everything was like slow motion,” Maxim recalls. “My fellow soldier turned toward me, and I saw three bullets hit him in the head. I just fell onto the asphalt, looked at my comrade’s body, and realized there was no way to help him. The first thought that crossed my mind was that this was a dream, that it wasn’t real. And then I came to my senses when they started shooting at me.”

*****

Maxim’s fellow soldier is just one of dozens of young conscripts who died as a result of the Ukrainian incursion campaign into Kursk Oblast. IStories and Verstka have counted at least 77 conscripts who died in the region’s border zone in 2024. As of this publication, over 30 more remain missing. It is likely that over time they will also be officially recognized as dead. According to our data, in 2026, Russian authorities have been still registering the deaths of conscripts who went missing two years ago.

IStories and Verstka have spoken with surviving conscripts and relatives of those who served on the border, analyzed open sources, and reconstructed the course of events in the Kursk Oblast in August and September 2024.

How the conscripts ended up at the border

Starting in late March 2024, the conscripts drafted in the autumn began arriving at the border in the Kursk Oblast. At some locations, they replaced the demobee conscripts — those approaching the termination of their service. “We learned from them that there’s nothing much going on there, but you’re sitting at point zero, at the ‘ribbon’ [front line], so you see the enemy, and they see you,” Nikita Litvinyuk recounted after being taken captive by the Ukrainian Armed Forces (UAF). “You stay still and so do they.”

At a military unit in Klintsy, Bryansk Oblast (where the 488th Regiment is stationed), the soldiers were assured that they would be stationed behind the border guards and contract soldiers. “To be honest, I was happy because I knew it would be a bit more relaxed than at the unit,” said a captured conscript. “At the unit, they push us hard: marching, drills, all that stuff. But everyone says it’s calm at the border — nothing too demanding, you just sit around, go on guard duty, and that’s it.”

Some of the people involved in the events in Kursk had other motivations: for example, Ruslan told us that he deliberately volunteered to be sent to the border, and at first, his commanders were reluctant to send him there. “There’s nothing to do at the unit, and nothing interesting there,” Ruslan explains. “I wanted to join the army and really understand what it’s all about.” When asked about the risks of serving at the border, he replied: “I wasn’t particularly worried. I had thought [the Ukrainian forces] might advance, but not the way it actually happened.”

Some of the conscripts did not tell their relatives that they were serving right at the border. “It turns out they only found out in September, when I returned [from captivity],” Andrei told IStories. “All that time, I’d been saying that I wasn’t there, that I was 40 kilometers away.”

Sometimes the conscripts’ commanders went along with this cover story. “My mom would call them and ask where I was. They’d say 'he is fine, he is in the unit', even though I was at the border. So they were lying, so it turns out,” said one of the captured soldiers. Some relatives tried to keep conscripts from being sent to the border. “They sent letters to the prosecutor’s office and to every possible authority,” Eduard Shulz told. “But [the commanders] sent us anyway. They said there weren’t enough people, enough mobilized soldiers and contract soldiers.”

The training level of the conscripts varied significantly. According to one of our interviewees, at the training unit they had been trained intensively for four months, were taught to utilize various types of weapons, and were trained to identify drones by sound. Another conscript recalls that even instructors from the Russian Army's elite Special Operations Forces were brought in to help with the training. At the same time, there were conscripts stationed at the border who, by their own account, had only fired a few bullets at a basic training course.

The conscripts' daily routine at the border was almost identical. They served at strongpoints — well-fortified underground facilities with a network of tunnels and observation posts. The soldiers would dig trenches and build dugouts, and they regularly went on guard duty.

Contract soldiers and mobilized troops — reservists drafted due to the war — also served alongside them, but in much smaller numbers. According to our interviewees, conscripts made up the majority at many positions, accounting for 50 to 85 percent of the personnel.

The beginning

Nikolaevo-Daryino

Nikolaevo-Daryino is a border village five kilometers west of Sverdlikovo, where by August 6, dozens of conscripts had already been under daily shelling for several days.

Around 1:00 a.m. on August 6, the conscripts defending two strongholds near Nikolaevo-Daryino heard military vehicles moving near the very border. Then came a barrage from all types of weapons: mortars, “Grad” multiple-launch rocket systems, FPV drones, and UAVs carrying mines. By the morning, when everything had quieted down, the Ukrainian military vehicles had already passed the Russians’ border positions.

Maxim and his late fellow soldier were unknowingly walking toward them. According to the conscript, it was there that he “saw death up close for the first time.” Once the shock had worn off, Maxim turned back and found himself in a wheat field: “It seemed to me that if I stood up in the middle of the field and ran, they wouldn’t notice me. I was just starting to get to my feet when several bullets whizzed past my head again. In the end, they set the wheat field on fire with a drone. I kept crawling; the field was quite large — almost a kilometer. As I was reaching the edge of the field, the fire was already a meter away from me. There was a gully, so there I stood up and started firing roughly in the direction of the forest belt from which they’d been shooting at us. I put my rifle on safe and tumbled down that gully.”

Maxim ran back to his position and reported his fellow soldier's death to the commander. “He was in a state of shock himself,” recalls the conscript. “He kept asking if he’d misheard me, then started contacting the headquarters. He said, ‘Fucking hell, I’ve already suffered casualties.’ And the headquarters commander was like, ‘Calm the fuck down! Pull your shit together, you bitch.’ And the connection cut out. Then the headquarters commander gave us the order to launch an assault — and there were only seven of us.” Maxim convinced everyone that heading toward the border was dangerous, so he stayed at the strongpoint with his fellow servicemen.

On the third line, in the village of Nizhny Klin, there was stationed a medical platoon. It was mostly made up of conscripts. As one of them told IStories, the nighttime artillery barrage did not affect them, but around 7 a.m., the soldiers heard gunfire and put on their gear. “There were no specific orders, so we had to improvise. The commanders weren’t prepared for such situations either,” our interviewee recalls. The conscripts and the platoon command abandoned their positions and took cover in the forest.

The 30th Artillery Brigade's position was located 10 km from the border, in Novoivanovka. Following the Ukrainian advance, nine conscript artillerymen would be listed as missing in action; five of them were later declared dead. Their official date of death is August 6, 2024. It is likely that their position became a priority target and immediately came under fire from the Ukrainian Army.

First POWs

The Sudzha border crossing point

One of the most heavily fortified strongholds was the Sudzha international road border crossing: several buildings that in peaceful times had been used by the border service to inspect the vehicles crossing the border.

According to one of the captured soldiers, only the conscripts, along with their commander, were stationed on the front line, right at the border. They did not receive the order to retreat from the border toward the Sudzha crossing point until the evening of August 6. Вy then, the shelling had lasted all day, and more than 50 people had gathered at the crossing point — conscripts from the “Oleshnya-2” position in a neighboring village had arrived there that same evening. It was ordered not to surrender the point, and the soldiers were denied evacuation.

The next morning, Ukrainian forces launched an assault on the checkpoint. “The first wave was more or less over, then came the second. That was it — nothing was left of the facility except for a concrete room,” one of the soldiers recalled. He said the conscripts were loading magazines for the border guards, who were firing back at the advancing Ukrainian troops.

“We were sitting in some small room in the very center,” another conscript recounted. “There was essentially nothing left around us. And the tank firing at our left and then at our right. We knew that if it hit us directly just once or twice, it would be a mass grave right there.”

“Someone said, ‘Count the shells — the tank can’t keep firing endlessly,’” recalled a captured soldier. “So I counted them.” The shelling continued for about an hour; the fifteenth shell hit the room where the wounded were lying, and they were trapped under the rubble. After the sixteenth shell, the surviving officers decided to surrender, and, on the evening of August 7, several dozen people were taken captive, according to videos published on Ukrainian media.

Sverdlikovo

Just seven kilometers to the north, the Sputnik stronghold — which was also mostly filled with conscripts — ended up surrounded quickly. The UAF were not attempting an assault. “They were just shelling us to keep us from sticking out,” the conscripts’ commander, Major Bykov, told. “The company commander contacted us, and I asked if he knew anything. He said, ‘There's no communication with the higher [command], none at all.’”

After several days of shelling and negotiations with the Ukrainian forces, Bykov convinced his comrades to abandon their position without a fight. According to him, a total of 29 people (including 23 conscripts) from Sputnik surrendered.

The next day, August 10, the Ukrainian Armed Forces launched an assault on the second stronghold, Styk (“Junction”), near Sverdlikovo. Until then, a group of conscripts had been stationed there in relatively calm conditions, reinforced by mortar crews who had retreated from near Daryino. According to IStories estimates, at least four conscripts may have been killed during the Styk assault on August 10.

Some of the survivors, following orders from the senior staff officer, managed to withdraw to the third strongpoint, “Moscow.” There, Captain Kuzmenkov’s troops held their ground until August 14. After several assaults, he also resolved to surrender: “When there are no other options left, the choice is to sacrifice the men or try to save their lives. Maybe at my own expense. But I think their mothers will be grateful.”

Oleshnya

According to our estimates, the heaviest losses — at least 15 people killed or missing — were suffered by conscripts holding positions near the village of Oleshnya.

Similar to other locations, the shelling there began as early as August 2–3. “At night, they started bombing everyone; we couldn’t do anything at all — we just sat there. Then they started shelling us with artillery, it seemed,” recounted a conscript from the Oleshnya-2 stronghold. “A radio message came through saying they’d taken over all of Oleshnya-1 and were heading our way.” The commander ordered the conscripts to withdraw to the Sudzha crossing point, where they faced the major offensive there.

At least four conscripts were killed near Oleshnya on the second day — August 7. Mikhail Zelensky and two other soldiers managed to escape from their position and reach a command post further back from the front lines. However, Ukrainian troops had already taken up positions there. Zelensky and his comrades hid in a wooded area and did not leave it.

Magomed was one of the conscripts stationed at Oleshnya and killed during the operation. According to his relative, Magomed’s position was attacked on August 6. The command ordered the soldiers not to leave the strongpoint and promised to send in reinforcements, but no one except a zampolit — political commissar, an officer responsible for indoctrination and morale issues — arrived at the position. Later, in a conversation with Magomed’s family, the officer claimed that he had to abandon the conscript and two other soldiers at the strongpoint in order to save a group of 22 conscripts. According to the conscripts who broke out of the encirclement, Magomed and his comrades managed to retreat to Gogolevka, where they were killed by a grenade explosion in a dugout.

Another captured conscript shared a similar story about the zampolit who had arrived at the border. They and the border guards split into four groups and headed for Gogolevka. On the morning of August 7, Ukrainian troops attempted to capture one of the groups. In the firefight, the conscript said, nine people were killed, and only three survived.

On the run

Small groups of conscripts with some border guards and a handful of officers among them went on to hide in the forests for weeks and would be captured by the Ukrainian military almost daily until the end of August.

Andrey from the Vologda Oblast told IStories that he spent about six days in the forest with other soldiers. The conscripts would drink swamp water and eat grass, nettles, and rowan branches. “Nettles actually taste the best,” says Andrei. “Rowan branches have a soft tip at the end. You can chew on that, too.” Some conscripts were luckier, if near the forests where they hid there were sunflower or soybean fields.

Sergey Yershov and another soldier split from their medical platoon in Nizhny Klin and spent more than 50 days in the woods. In late September, they made their way to Russian troops, after which the conscripts were sent to a hospital. The medical platoon where Yershov served had surrendered on August 12. One of his fellow soldiers told IStories that he had returned to Russia via a prisoner exchange as early as August 24.

On the eastern flank, where the 252nd Motorized Rifle Regiment was holding the line near the villages of Plyokhovo and Borki, the Ukrainian troops broke through the border as well, but were unable to advance further. The retreating conscripts wandered through the forests and swamps for several days, being hit by artillery fire and drones, one of them, Alexander, told us.

Finally, on August 14, they made it to Borki, where a local resident sheltered them: “He was quite an interesting character. As far as I could tell, he hadn’t left because he was on a drinking bender. He brought us whatever food he had at home, and some water to drink. Getting water was really hard: all we had was water from the outdoor shower, and also from a bathtub that had been filled.”

By that time, Ukrainian troops had already taken over the village. Alexander and his sergeant kept an eye on the vehicles passing by the house, noting down the coordinates on a piece of paper and texting them to their command: “They would strike those pickup trucks with drones, and those houses the Ukrainians stationed in as well.”

A few days later, the water in the tub was gone, so the soldiers removed the water heater and took apart the pipes to drain the remaining water from there. Meanwhile, the homeowner was cruising around the village on a scooter looking for alcohol. “This is a guy who doesn’t care what’s going on around him; all he wants is to find some moonshine,” Alexander says. “The Ukrainian soldiers had to warn him: ‘Don’t ride here. It’s mined; don’t go there.’”

The soldiers took turns on duty, and spent the rest of their time reading the books in the house. By the time active fighting reached Borki, there was hardly a single building left intact in the village.

“They started searching the houses, just in case someone had slipped through,” the conscript recalls. “I was in the annex at the time [on duty], with no ballistic vest and no helmet. I mean, what was the point?? We were in the middle of nowhere with God knows how many of them around. I just put my rifle on the ground and sat down. They opened the door, and there I was, just sitting. They were very surprised and said, ‘Don’t make any sudden moves; everything will be fine.’ And then they started searching the whole house.”

The Ukrainian soldiers told Alexander and the other captives that one of the conscripts had shot himself: “We had a conversation [with the soldier who shot himself] about how you mustn’t [surrender],” says Alexander.

The captured Russians were given food and cigarettes. “When [the Ukrainian soldiers] realized that we were conscripts and that we’d been stuck here for about a month, they were surprised and said, ‘Wow, you guys are tough,’” Alexander recalls.

Veseloye

In mid-September, the Ukrainian Armed Forces broke through the border in Kursk Oblast once again, this time about 30 km west of the existing front line. Despite the fact that the incursion had been going on for over a month, recent Russian conscripts from Airborne Forces units were still stationed at the border positions. Later, those of them taken captive explained that, officially, they were located at a training ground in Pskov Oblast, not in the combat zone.

A new Ukrainian offensive in another sector of Kursk Oblast was faced by Russian conscripts from the 234th Airborne Assault Regiment, the 217th Parachute Regiment, and the 1140th Artillery Regiment.

In the first days of the Ukrainian breakthrough in the Glushkovsky District, at least eight Airborne Forces conscripts were killed. Some of them were likely stationed at a rural school building in Veseloye, 3.5 km from the border, according to their relatives' posts on social media.

According to the “Russian Spring’s War Reporters” Telegram channel, the school building was destroyed by a U.S. precision-guided air bomb. The UAF unit Khorne Group published a video of the strike. Our estimates indicate that the total losses among conscripts in this area of the front may have exceeded 20 people since August 2024.

Capture, exchange, and demobilization

Andrey, a conscript from Vologda Oblast, recounts that he was taken captive after several days in the woods. “They brought me to some house. There, some Ukrainian women started bandaging my wounds again. The whole time, they kept saying that I had come onto their land, that I was killing their children, killing their husbands, that ‘you’re all so bad, but we’re still helping you — although we could have abandoned you,’ Andrei recounts their conversation. “I told them I was defending my country. I didn’t set foot on your land. I was on my own.”

Conscripts who were taken prisoner were called in for interrogations, another interviewee told us. “Some would be called in and tell everything — absolutely everything: the positions, the roles, — he says. — Sure, they were threatened and beaten, but there were no bruises, the specialists know how to beat people with no bruises. But I was lucky. I once wandered into the SBU [State Security of Ukraine] office by accident. They decided to interrogate me, and when they found out where I worked [as a train attendant], they asked, ‘Do you know anything about Metro-2?’ [the secret tunnels under Moscow intended for the country’s leadership]. I said, ‘Well, I just know stuff from books,’ — and that seemed funny to me. They said, ‘Why are you laughing? Face down on the floor, or we’ll beat you up right here!’” However, they didn’t do anything, and the conscript was released.

Several conscripts we managed to speak with describe the conditions in captivity as satisfactory. “The food wasn’t anything special — it was just what the other prisoners there ate. There were Ukrainians in the same prison as well,” says Alexander.

“They did feed us, but the food was not tasty at all,” Yevgeny recalls. “The tastiest thing we had there was bread. Since it’s warm there and trees grow, we would pick apples — we made a stick to reach the trees through the bars.”

“At one point, I was afraid [I would be tortured],” recalls Andrei. “The guys in the cell next to me said they would try to make them speak Ukrainian. They’d say something to me in Ukrainian as well, and I was supposed to answer, but I didn’t understand it and played dumb. I thought something [some kind of punishment] would follow. When I realized that they don't punish you, don’t even do anything of the kind, I understood that I was in a normal prison. Everything settled down for me, so I totally stopped being afraid.”

Two weeks after the incursion into Kursk Oblast began, on August 24, the first POW exchange took place, and 115 conscripts returned to Russia. They were seated on a bus and sent to the Belarus border. According to our interviewees, no one knew their destination until the very last moment: the prisoners thought they were being taken to some sort of a special settlement.

After returning to Russia, the wounded soldiers were sent to a hospital, but one of the men we spoke to refused to go there. “The guys I thought had died turned out to have been taken captives; they were exchanged along with me. I couldn’t bear to be separated from them for even a week,” Andrey explains. “Lying above me was my buddy, whom I thought had died, but he survived. To my left lay another buddy who had survived. I was so happy that they were alive, I didn’t need any hospital.”

After “investigative procedures” and a medical examination in Moscow, the soldiers who did not require hospitalization were reassigned to military units. There, they served out the remainder of their terms (six to eight weeks) and were then discharged, the conscripts who returned from captivity told us.

According to one of them, some of the conscripts who went through the exchange were then sent back to the border in Bryansk Oblast. They spent more than a month there.

The aftermath

The prisoner exchanges went on into 2025. In April, Mikhail Zelensky and the conscripts captured in the Glushkovo area came back to Russia. “I Want to Live” — a Ukrainian government project established for the Russian soldiers to willingly surrender into captivity — informed the IStories and Verstka that about 500 conscripts have been exchanged. Two years after the Kursk Oblast operation, none of the Russian conscripts remained in captivity.

On April 26, 2025, Chief of the General Staff Valery Gerasimov reported to Vladimir Putin about the “crushing defeat suffered by Ukrainian armed formations” in Kursk Oblast. The search for the bodies of the fallen conscripts and their extraction only became possible after Russian troops reached the border again.

The mother of a soldier who is still considered missing in action told us that her son’s body was never found at the position near Sverdlikovo. “I periodically call Rostov-on-Don [where the bodies are identified at the Center for Reception, Registration, and Transfer of the Deceased]. There’s been no DNA match,” she says. “[They say that] it’s impossible to carry out a recovery there — drones are flying, and the area hasn’t been cleared of mines.”

Conscripts listed as missing in action were being officially declared deceased one by one throughout 2025. The last known case of a status change occurred in May 2026 — nearly two years after the soldier’s death.

In total, at least 77 conscripts were killed in the first months of fighting in Kursk Oblast. According to IStories and Verstka's estimates, about 30 more people are still considered missing in action.

Life after the war

Alexander says that before his mandatory military service, he was seriously planning to sign a military contract [to go to war against Ukraine voluntarily], as he was “really eager” to. “But my mother is a very anxious person, and we agreed that I would serve my mandatory service first, and then, if I hadn’t changed my mind, I could sign a contract,” Alexander explains. “When I came back after all of that, of course, I thought about it for a long time; the officers were encouraging me to sign. For better or for worse, but I changed my mind.”

“The effects of the concussion haven’t gone away even though it’s been two years,” Mikhail tells us. “Emotionally, all [feelings] are gone. All that’s left is aggression. Maybe a little joy sometimes. It only takes a split second to set me off — and that’s it, I explode. It’s very hard to control all of this.”

According to Mikhail, his hearing was severely damaged. “I always wear an earbud — at least one — with music playing constantly,” he says. “There’s a very loud ringing [in my ears], and it won’t go away.” Mikhail has not received any government assistance, so he is currently paying for his treatment out of his own pocket.

The mother of one of these conscripts also told us that some of them have not received any support from the government. “His concussion was so severe that he was almost unconscious when he was taken prisoner,” says Ekaterina. “When he came home from the army, he practically refused to talk to me. He would just lie in bed, turned away. We spent a year struggling to get him recognized as a combat veteran because there were no documents on him. The documents were restored, and he underwent treatment, but his condition wasn’t recognized as a combat-related injury. He now suffers from constant high blood pressure, headaches and insomnia. I’m currently paying for all his treatment out of my own pocket.”

Some conscripts face similar difficulties in receiving the payments they’re entitled to for the injuries and participation in the “counterterrorism operation zone” (the CTO in Kursk Oblast was declared on August 10). “Until I went to the prosecutor’s office, they didn’t want to pay me the regional [injury compensation],” says Andrey.

“I didn’t receive my combat veteran status until December of 2025,” says Timur. “I haven’t received any payments for the days I spent in the CTO zone. I’m still working through these issues with lawyers.”

“It was specifically the 18th Battalion [of the 488th Regiment] that didn’t get a single ruble," Egor explains. “The guys who served in other units received decent payments. They paid the demobilized soldiers from our unit — who had already left long ago by August — but they didn’t pay us. We’re basically not counting on it anymore.”

According to other conscripts, they “weren’t wronged financially” — with the money from the government, some were able to buy a car or a plot of land to build a house. Andrey used the compensation he received to buy an apartment in his hometown and started a business with a fellow soldier. “If it weren’t for [the journalists’ questions], I wouldn’t even have remembered about the army time,” he says. “I used to go crazy at night. New Year’s Eve, fireworks — that’s it; I’d hide in some basement listening to them. Well, yeah, my mind goes into overdrive at night sometimes. Things just get scary in my head. You wake up covered in sweat.”

Andrey calls his experience serving in the army “a school of life.” “I come home, look at my uniform, and remember: it turns out I really was there. I became physically fit there, maybe more experienced, and started looking at things with a more mature perspective,” Andrey reflects. “You remember a lot of good things. We get together with our fellow soldiers and have fun — and everything’s great. We remember our jokes. Then we remember those who can no longer be here to hear those jokes. As the saying goes, we started by toasting to their health and ended by toasting to their rest in peace. Overall, it’s good that I’m here, on my own two feet, with both arms intact — everything’s fine, and I’ve got my head on my shoulders. Fate is such a thing: what if I hadn’t been in the army? Or, let’s say, what if things had turned out just a little differently? I probably wouldn’t be standing here. That’s just how things turn out, and sometimes it’s strange.”

Read on istories.media →

Between 2015 and 2022, a criminal group used dozens of pharmacies across the United States to bill medical insurance companies a staggering $2 billion for fraudulent prescriptions. The group collected over $758 million, laundering vast sums through offshore accounts before distributing the profits among themselves or reinvesting them in their operation. Fifteen people were sentenced in California for their roles in the scheme and seven pleaded guilty in federal court, with some later receiving ten-year prison sentences.

But the man prosecutors identify as the group’s ringleader, 34-year-old Los Angeles-born Brian Sutton, has not been tried. The U.S. Attorney's Office in Brooklyn describes the indicted Sutton as “at large,” and a felony case against him in California remains active.

IStories tracked him down in Russia. In a country under the cloud of war and dictatorship, he is living a life of unabashed luxury. His assets there include nearly two dozen Mercedes Benz cars and several other luxury vehicles, a villa in an exclusive area near Moscow (and another owned by a family member), several businesses, and even a stake in an MMA club tied to a member of Russian parliament whose family is considered close to Chechen strongman leader Ramzan Kadyrov.

“The American justice system will be unable to reach Sutton in Russia,” says Ilya Shumanov, the former director of the local chapter of Transparency International. “There is no extradition treaty between the U.S. and Russia, and cooperation between law enforcement agencies remains exclusively in the area of ​​counterterrorism … The chance of his extradition to the United States is zero.” “The choice of Russia as a safe haven for international criminals is understandable and is nothing particularly new,” Shumanov noted, citing the case of Rinaldo Nazzaro, the founder of a neo-Nazi paramilitary group who relocated to Russia in the late 2010s.

Sutton and members of his family did not respond to requests for comment. The U.S. Department of Justice, the Santa Clara County District Attorney’s Office, and the Russian Interior Ministry also did not reply.

“Mutant pharmacies”

Sutton’s name, and the operation he allegedly led, first came to light in California in 2015, when a CBS news employee noticed that his medical insurance company had paid a shocking $44,000 for a one-month supply of a nutritional supplement.

The Los Angeles pharmacy that filled the prescription and submitted the claim was owned by Sutton’s family, as CBS Evening News reported that June. When confronted there by a producer, Sutton ignored questions and shut the door.

Eventually, the authorities caught on. A 2020 California felony complaint alleged that the group owned five Los Angeles-area pharmacies. It described them as “mutant pharmacies” because they functioned as “mills for fulfilling fraudulent prescriptions for pain creams and durable medical equipment.”

“Many of the pharmacies were not stocked like normal pharmacies,” the complaint read. “The purchase of over-the-counter drugs was so rare that at one location the employees were unable to work the cash register.”

To feed these mills, prosecutors alleged, the conspirators ran an aggressive call center that harassed ordinary citizens with dozens of unsolicited calls, deceiving them into believing they were speaking with their own doctors or insurers. They then used the information they obtained to issue high-cost prescriptions, bombarding unwitting victims with shipments of unwanted medical gear and pain creams they had never requested. Fifteen co-conspirators eventually pleaded guilty, admitting to running a massive statewide scam and defrauding insurance companies of about $40 million.

A later federal case, prosecuted in Brooklyn, New York, covered what prosecutors described as a wider-ranging and more ambitious iteration of the scheme, tallying the much larger amount of nearly $2 billion in fraudulent medical bills, of which over $758 million was paid out.

The sophisticated operation involved calling patients to offer prescription medications at little to no cost, recruiting doctors to review nonexistent telemedicine visits, and billing insurance companies for drugs that in some cases were not even delivered. The conspirators bought many dozens of pharmacies across the country, expanding into states like New York, New Jersey, Pennsylvania, Texas, and Alabama. To avoid U.S. law enforcement, they set up call centers overseas, including in Russia.

Seven people ultimately pleaded guilty and were convicted for their roles in the operation. But not Sutton, who was out of reach of authorities.

A luxury life in Russia

The U.S. Department of Justice describes the group behind the telemedicine fraud as a “Moscow-based criminal organization.” Indeed, Russian land records and leaked databases show that Sutton and his family were establishing themselves in the country by 2019.

That year, leaked data from the Russian road police shows, Sutton bought and registered a Range Rover and a Rolls Royce Wraith in Russia, the first luxury cars of what would ultimately become an impressive fleet. According to a list of Sutton’s assets obtained by reporters, his collection ultimately included six BMWs, two more Rolls Royces, and 23 Mercedes-Benz vehicles produced over a 36-year span.

Also in 2019, a 64-year–old relative, David Sutton — presumably Brian’s father — purchased a luxurious villa near the Russian capital, according to land registry records. Nearly 600 square meters in size, the home includes a large private formal garden and a guest house on the property.

It is part of Barvikha 21, an “elite guarded cottage settlement” whose homes were built “in the style of American architect Frank Lloyd Wright.” Located in the elite Rublevka area to the west of Moscow, and adjoining a 20-hectare forested recreation area, the development is just five kilometers from Putin’s infamous residence at Novo Ogarevo.

Over the next few years, three members of the Sutton family — Brian, David, and a woman named Mila Sutton — listed the address as their residence, according to a leaked database. (Both David and Mila Sutton were also indicted for the medical insurance fraud scheme in California, but neither appears ever to have been arrested or tried. Neither responded to requests for comment.)

But Brian Sutton had ambitions for a larger footprint in Barvikha 21. In 2025, he bought another villa in the same development, combining its territory with an adjacent plot he acquired on which the existing villa had been demolished. His property there now stretches over more than 6,500 square meters, nearly the size of a regulation football field.

Meanwhile, the Russian commercial register shows, Sutton had founded a call center called Well Connect in Moscow in 2019. Though its website is now defunct, the company’s page in the Russian social network Vkontakte is still available.

“We do marketing in the sphere of medicine,” it reads, “moving diagnostic methods and the treatment of clients in a better direction.” According to leaks of Russian tax information, Sutton earned 125 million rubles ($1.6 million) from the company in 2020–2021.

Brian Sutton also tried his hand in the Russian coal-trading business. In 2019, he founded Coal Trade, a Moscow company that, according to its website, included among its partners some of the largest Russian steel manufacturing and mining groups, such as Evraz and its coal business, Raspadskaya. Sutton retained his 90 percent stake in Coal Trade until late 2022, after which it was acquired by a firm whose ultimate owners are unknown. The Evraz plants and Raspadskaya were sanctioned by the United States in 2024.

The available financial data shows that Coal Trade made a profit of about $4.4 million in 2021 and $1.6 million in 2022, but its business started collapsing after Russia’s full-scale invasion of Ukraine that year.

In November 2022, Sutton acquired Relaxzon, a small fitness and spa center in the village of Gorchakovo on the outskirts of Moscow.

United Russia Fighters

The full story of Brian Sutton’s relationship with Russia is unknown. According to leaked records, David Sutton is listed as being born in the Soviet Union, while Brian was born in Los Angeles and holds U.S. citizenship. Both men received Israeli citizenship in 2017. Brian also got a Russian passport in 2022.

Beyond that, Brian Sutton seems to have a connection to Chechnya, a republic ruled with an iron fist by strongman leader Ramzan Kadyrov that is barely reachable even for Russian federal law enforcement.

Sutton’s first known listed place of residence in Russia, according to a police database, was an address in Argun, a town not far from the Chechen capital of Grozny. Several subsequent entries also associate a Grozny address with him, while identifying another address in Moscow as his residence.

Corporate records show that in June 2022 he acquired a 10-percent stake in United Russian Fighters (URF), an MMA club and fighting team tied to Bekkhan Agayev, a member of the Russian Parliament with the ruling United Russia party.

On its Instagram account, the team describes Agayev as one of its “founders,” calling him “a true patriot of Russia who makes a significant contribution to our country’s development every day.” The account also notes that he continues to support the team. 

(Agayev does not have a personal stake in the company behind URF, since members of parliament are prohibited from conducting business. A 40 percent share is owned by his son Deni.)

As previously reported by IStories, URF is active in providing support for the Russian military in its war on Ukraine.

Agayev, who has been sanctioned by the United States since 2022, comes from a family that is considered close to Ramzan Kadyrov, the strongman head of Chechnya.

Kadyrov recorded a personal birthday greeting for Agayev’s father, Vakha, for his 60th birthday in 2013, calling him a “dear brother,” and also awarded him the title of “Honorary Citizen of the Republic.” That same year, a street was named after him in the Chechen town of Urus-Martan. Vakha Agayev, who died of COVID in 2020, ran a business that traded in Chechen oil.

Bekkhan Agayev did not respond to questions about the nature of his relationship with Sutton. His son also did not reply.

But Shumanov, the former Transparency International director, said that in the context of modern Russia, protecting one’s property rights or “avoiding pressure from security forces” was “virtually impossible.”

“There’s a high probability that the property and assets that Sutton acquired in Russia will [eventually] go to his influential Russian friends,” Shumanov added. “If he decides to leave Russia, I would venture to guess that many surprises await him. The FBI has a long list of cases of arresting individuals on the U.S. wanted list in other countries.”

Read on istories.media →

In December 2025, an anonymous hacker group breached Mikord’s infrastructure and obtained the documents on its other then-upcoming project, a digital military registry. The group passed the documents to Get Lost, an organization helping Russians evade conscription, who shared the data with IStories. Due to this leak, we have been able to publish investigations on the military registry work, as well as on other classified systems of the Russian Ministry of Defense.

We have also learned how, over a year and a half, Mikord worked on the Pauk (“Spider”) project commissioned to them by the FSB’s Second Service. The FSB was supposed to use Pauk to combine information from the media and FSB’s own databases to create a neural network assistant for intelligence officers.

Who commissioned the project

In the spring of 2024, a little-known Kazan-based company called Mikord was commissioned to create a new service for the FSB. Around the same time, the company was unexpectedly entrusted with the development of a military registry — one of the Russian Ministry of Defense’s largest projects which would consolidate dozens of data sources on millions of Russians in a single location.

As previously reported by IStories, Mikord’s success at the federal level may be linked to Nikolai Nikiforov, a Tatarstan native and former Minister of Communications of Russia. The families of Nikiforov and the Mikord founder Alexander Nikolaev had been in business together for a long time.

The contract for the Pauk system development listed Military Unit 43753 (the FSB’s Center for Information Protection and Special Communications) as main customer and the Kvant Research Institute as the contractor. In turn, Kvant contracted Mikord to carry out the work.

In the documents, this project is referred to as the “Portal for Analytics and Usage of Contents,” or, shortly, Pauk (“Spider”). A “spider,” or a crawler, is a term used for bots that scan webpages and automatically collect information from them.

It is likely that the Second Service of the FSB was intended to be Pauk’s end user, even though it did not commission the work formally. The Service staff were to participate in the key stages of the new service’s development and implementation, and the work schedule had to be coordinated with the Second Service as well. The ZKSibST abbreviation (short for “Defense of the Constitutional Order and Combating Terrorism” in Russian) used in the titles of project documents and the news content Mikord received to be used in the system at the development stage also suggest the Second Service’s involvement.

How the FSB intended to use the AI system

Pauk was supposed to automate the operations of a situation center presumably created within the FSB’s Second Service. As seen in the project documentation, the center’s shift staff monitor Russian and foreign media news on a daily basis. Every day they compile a news digest which is then sent to FSB leadership.

The web crawler was supposed to automatically collect all the news stories of interest to the FSB. These stories would then be published on an internal news portal, where the officer on duty could select which stories to include in the daily digest.

The compiled digests would be stored within Pauk’s closed (i.e. not connected to the Internet) network, where they could be viewed by the staff on duty as well as other FSB employees. Users would be able to search the reports for the information about specific people or events. Via an LLM and a chatbot interface, the users from FSB would also be able to work with “various closed sources information.” This required Pauk to receive information from certain “third-party data banks” and “data from text sources,” i.e. reports, scans, and the FSB’s own records.

The documentation does not reveal which specific classified sources the security service intended to use. According to an IStories source familiar with the FSB’s operations, the agency already has a similar data source — the Central Operational Database (COD). It can be accessed by the FSB headquarters staff. Rumors, reports, and criminal cases information are stored in this database. 

Additionally, a separate database containing information on Russian citizens has been created within the Second Service, Alexander Fedotov, a former FSB officer, previously told The Insider in an interview. This database contains activists' and protesters' personal data: their names, photos, and phone numbers.

The envisioned AI assistant could significantly simplify the security officers’ work concerning large volumes of unstructured information and an operational database on activists. 

The project documentation also listed the types of data that the AI assistant’s response to a “persons of interest” query might contain: their full name, date of birth, region, phone number, license plate number, and car brand. It is possible that the FSB has begun considering the use of AI in its routine operational work.

The Mikord documents contain correspondence between the project manager and an FSB supervisor, identified by the “A.G.” initials. In response to one of the developers’ questions, the FSB representative stated that the system would serve “30 main department users,” but its user load could eventually grow up to 400 people.

How the FSB tracks the media

The FSB project supervisors provided the Mikord team with a set of real news digests compiled by the Second Service from January 2024 to June 2025. The developers analyzed them to narrow down the websites and Telegram channels source list for Pauk to the most popular ones. 

Mikord used the June 2024 digests set to test an LLM in order to figure out how the chatbot would respond to a security service officer's potential questions. IStories examined the documents metadata and discovered that Ilya Oputin, a programmer at Ozon (a major Russian online marketplace — Ed.) who is believed to have graduated from the FSB Academy, might have worked on them. Oputin did not respond to the journalists’ questions.

Each digest is divided into two sections: Russian and international news. Several documents contain the following introductory paragraph: “As a result of monitoring online media on April 10, 2024, the following significant incidents and events were identified as those of interest in terms of defending the constitutional order and combating terrorism.” 

We have compiled the news into a unified calendar: there, you can view a specific day report, find a random news item, or search one by keyword. The calendar is available in the Russian version of the text.

It is unknown what criteria the FSB used to select the news items. In the same digest, a news item titled “Parliament Proposes Designating the Ukrainian Armed Forces, the Security Service of Ukraine, and the Defense Intelligence of Ukraine as Terrorists” may appear alongside a note about a Khabarovsk Krai village headman video appealing to Vladimir Putin. 

Many of the news items in the digests are copying the FSB’s own press releases and statements, such as the news titled “The FSB Reports an Ivanovo Resident Detained For Financing the Ukrainian Armed Forces” or “FSB Chief Speaks About Kyiv Recruiting Migrants to Commit Crimes in Russia.” 

We analyzed nearly 5,000 news items from FSB reports and grouped them into themed categories. Many of them are consistent with the Second Service’s traditional activities: combating Islamists, spying on the opposition and carrying out political assassinations. From these same digests, we learned that the service closely monitors news about pressure on migrants in Russia, strikes and protests abroad, and ethnic conflicts in Europe. A detailed analysis of the FSB’s Second Service news digests can be found here (in Russian).

Independent outlets have become some of the key sources of information about what's going on in Russia for the Second Service. According to our calculations, in the first six months of 2025, three of them — Activatica, RusNews, and Govorit NeMoskva — were among the five top cited media outlets in the FSB digests. 

Activatica — an outlet covering civic activism and repressions in Russia — tops this ranking by a wide margin. In the first six months of 2025, 244 of their news stories appeared in the FSB digests. Activatica was the source of one in every six news items in the Second Service’s reports.

Sometimes the digests are almost completely shaped by Activatica’s news items. The June 26 2024 report contained three Activatica stories: the protests against rising utility rates in Ufa; Moscow’s Mitino residents’ video appeal to Putin asking him not to build a packaging plant; daily protests in Arkhangelsk Oblast’s Yarensk, where residents opposed the decision to move the emergency medical services station 200 km from the village.

Overall, between January 2024 and June 2025, more than 550 articles from the uncensored outlets (mostly those operating in exile due to the official persecution on behalf of the government, e.g. being designated as “foreign agents” — Ed.) appeared in the FSB’s news digests — that’s more than 10% of all the news items included. Among others, the officers cited such outlets as OVD-Info, 7x7, Sirena and Meduza.

Independent media outlets’ reports about the FSB itself are also of interest to the security service. For example, a Meduza article about Sergei Dubov, a Second Service employee, made its way into a digest for the FSB high-ranking officials that very same day. 

Overall, in a year and a half the FSB’s Second Service monitored more than a thousand information sources: Russian federal and regional media websites, independent media outlets in exile, anonymous Telegram channels, VK news communities and YouTube channels. 

It is impossible to manually monitor such a wide range of sources on a daily basis. There are several references in the digests indicating that the Second Service is already using a solution similar to Pauk (made by a Russian company called Kribrum) to search and filter news. Kribrum is a service for monitoring media and social networks launched 15 years ago by Igor Ashmanov and Natalia Kaspersky. 

Ashmanov, a member of Russia’s Human Rights Council, constantly comes up with some new restrictive proposals. For example, he has proposed establishing a military censorship body in Russia as well as creating a “toxic content” registry. At a 2015 Kribrum presentation Ashmanov shared that the system analyzed 19 thousand media outlets and classified them into “liberal,” “neutral,” or “patriotic” ones.

It is likely that the Second Service had planned to replace the third-party solution with its own one. According to an IStories source close to the FSB, the Service’s units can create such solutions for their own use if they secure the necessary budget. Media monitoring, in particular, had previously been handled by the Department of Operational Information — a unit of the FSB’s Fifth Service responsible for intelligence in CIS countries (Commonwealth of Independent States, a regional organisation of post-soviet states — Ed.). 

What the prototype looks like

The Mikord document archive reveals a detailed description of how Pauk was supposed to work. In addition, IStories have found the design layouts of the project, which have been shared publicly and, at the time of publication, are still available to anyone interested. Using the data, we’ve recreated a clickable Pauk prototype: follow the link to try out the role of an FSB Second Service official. 

While working on the confidential FSB service, Mikord used foreign technologies and products. For example, the latest Pauk interfaces were stored in Figma, an American service. A US-made framework, LlamaIndex, was to be used for processing news reports and other classified documents.

The Llama 2 LLM by Meta (it’s worth noting that the company is designated as an “extremist organization” in Russia — Ed.) was supposed to respond to the security service officials’ requests. The dialogue sessions between the FSB officers and the AI assistant were to be stored in a MongoDB database (meanwhile its developers had declared they support Ukraine and had ceased operations in Russia).

The work was supposed to look like this: an FSB officer on duty supervises the list of sources whose news items get into the Pauk feed. At the same stage the user can edit the news items, rate them on a one-to-five scale, and comment. Selected news items make it into the daily digest for the higher-ranking officials.

Each news item is assigned a category and a list of tags, keywords, and personalities mentioned. FSB officers can use these to search. 

The Second Service officer on duty can also set up Telegram notifications for incidents of interest. The technical document provides a scenario for using such notifications: “for example, all news stories mentioning ‘a demonstration near the embassy’ or ‘a fight between migrants in Kazan.’” 

It is likely that the FSB had intended to use this tool to quickly respond to certain events in Russia among other things. “There was also an idea that if a selected news item contains words like ‘URGENT,’ ‘FLASH,’ and so on, we could choose to use it as an alert notification criteria,” — the FSB project supervisor identified as A.G. told a Mikord staff member. Another comment from the supervisor suggests that the news notifications were to be sent via a Telegram bot the officers were supposed to subscribe to.

Only the approved news items would enter the Pauk's closed environment where an FSB officer could compile a daily or monthly digest in a built-in editing tool. In addition, the same service was supposed to incorporate a CRM system to assign and track monitoring tasks. The FSB high officials would be able to order a report on a topic of interest directly within the Pauk system.

***

According to the plan, the first phase of Pauk’s development was to be completed by the autumn of 2025. That’s roughly when, after nearly a year and a half of work, a manager commented in Mikord's task tracker that the development of the project was suspended. “Goodbye, project…,” another employee replied. 

A source familiar with the development process told IStories that Mikord simply couldn’t deliver on this government contract. The company was not able to launch the service on time, which is why the work was shut down. 

The Mikord team likely lacked both the development experience and the necessary expertise to work with language models, an IT specialist interviewed by IStories suggested upon reviewing the project documentation, Mikord’s task tracker entries and other data.

Read on istories.media →

The human rights organization Platform to Protect Whistleblowers in Africa (PPLAAF), which is representing Yalike’s case, called the decision by the French authorities baffling and warned that the journalist and his family face the threat of reprisals.

“The French authorities made a baffling decision leaving Ephrem without protection against threats to him and his family’s safety. We urge them to reconsider this shameful decision and grant him asylum,” said PPLAAF Executive Director Jimmy Kande.

The organization has filed an appeal with France’s National Court of Asylum. Until it is reviewed, the decision on deportation should be suspended.

• From 2019 to 2022, Yalike worked for the Russian entity Africa Politology, established by structures linked to Yevgeny Prigozhin. He wrote materials prepared by Russian handlers in support of the CAR army and Russian mercenaries, refuted publications critical of Russia, and also arranged for these texts to be placed in local media for money. The journalist decided to leave the Wagner PMC structures after his employer took him into the forest and threatened to kill him over suspicions that he was leaking information.

• At 2024, IStories, together with the Forbidden Stories network and other international outlets, published an investigation, based on Yalike’s testimony and documents he provided. It revealed how Russian entities recruited journalists in the CAR, paid them for publishing pro-Russian materials, and created the appearance of broad public support for Russia.

• After the publication of the investigation, the European Union imposed sanctions on Mikhail Prudnikov — one of the key organizers of the Russian propaganda network in the CAR.

Read on istories.media →

IStories discovered this thanks to our participation in the OpenLux project, which allows the journalists access data on the ownership of Luxembourg-registered companies and funds. Le Monde and Organized Crime and Corruption Reporting Project (OCCRP) are partners in the project.

Kadyrov’s “dear brother”

Ramzan Kadyrov referred to Bekkhan and Batyr’s father, Vakha Agayev, the patriarch of the family, as “dear brother.” There is a video honoring Agayev on Kadyrov’s VKontakte page: on Agayev’s 60th birthday in 2013, Kadyrov awarded him the title of “Honorary Citizen of the Chechen Republic.” They are shown discussing something at a large table set with appetizers against a backdrop of golden furniture. In 2013, a street in the city of Urus-Martan was named in honor of the “dear brother” even though he was still alive back then.

Vakha Agayev built the family business empire, the Yug-Nefteprodukt, a Chechen oil trading company. With his children, Bekkhan and Batyr, Vakha also owned stakes in the largest oil refineries of southern Russia — the Tuapse and Krasnodar ones.

There is no doubt that the business has been a family enterprise: the Agayevs took turns owning Yug-Nefteprodukt. Vakha Agayev founded the company in 1998. He and his youngest son, Batyr, would successively control it through one German company (Interinol) and two offshore entities, Rutley Company SA and Okling Group SA, based in the British Virgin Islands, as revealed in the offshore leak documents obtained by the International Consortium of Investigative Journalists (ICIJ).

Starting in 2009, the family members have owned Yug-Nefteprodukt directly. Initially, it was owned by the younger son, Batyr Agayev (as both the father and the elder son were members of the State Duma at the time, which would not allow them to run the business — Ed.). From 2018 to 2021, the elder son Bekkhan was in charge. Vakha died of COVID-19 in 2020, and the following year Bekkhan returned to the Russian parliament, where he still holds a seat. Now it was time for the next generation of the Agayev family to take the reins, and Yug-Nefteprodukt was transferred to Bekkhan’s son, Ruslan.

The Agayevs business in Europe has also been a family affair. Interinol, a German oil and petroleum trader, is still owned by Batyr Agayev. Vakha Agayev was listed as managing director, and Bekkhan served as an authorized representative until 2015 (while still being a Russian Duma deputy).

In 2024, Interinol changed its name to Agom and switched to asset management, but this is still the company the Agayevs utilized to hold stakes in the Tuapse and Krasnodar oil refineries (as well as the offshore companies).

The Agayev family have invested their oil money in real estate — not only in Russia but, as it turned out, in Europe as well.

Batyr Agayev’s Luxembourg-based Everest

The Luxembourg registry records show that Batyr Agayev, the younger brother of the deputy Bekkhan, has become a Belgian citizen and splits his time between Berlin and Monaco. Batyr Agayev owns a 56.16% stake in a Luxembourg-based real estate investment fund Everest One, established in 2019. According to the fund’s website, it focuses on real estate investments (primary commercial and office real estate in Germany, but also on hotels, healthcare facilities and housing). Its assets amounted to €65 million in 2022.

The fund is managed by Mimco Group, founded by Swiss national Bernd von Manteuffel and Luxembourg national Christophe Nadal. The former has been dealing with European real estate for over 35 years, while the latter, according to the website, boasts 20 years of experience. The group currently manages assets of over €2 billion worth.

Batyr Agayev also holds a 43.5% stake in the Luxembourg-based Mimco Real Estate Holding. According to the 2022 data, the company invested about €35 million in German Mimco Real Estate Holding Se & Co Kg, which is intended for real estate investments, as indicated in the company’s financial report.

A fight club and the Wild Donbass Division

“Bekkhan Agayev is one of the founders of the URF [United Russian Fighters] team. <...> He is a true patriot of Russia who makes a significant contribution to our country’s development every day. <...> We are sincerely proud that he supports our team, motivates our athletes, and helps the community,” the URF mixed martial arts club posted on their Instagram page.

According to a company register, Bekkhan Agayev’s son Dany owns 40% of the United Russian Fighters club. Half of the URF is owned by its vice-president, Roland (Rocky) Kavali. Among those representing the club is, for example, the well-known Russian fighter Alexander Emelianenko.

URF and its associates assist Russian military forces in the war against Ukraine. “We’ve gathered a large shipment of humanitarian aid, which will be sent today to the ArBat, (“Armenian Batallion” — Ed.) within the Pyatnashka, [a military unit also known as] the Wild Donbass Division, from our team and our founders,” the club reported on its Instagram page in 2024. 

Roland Kavali, the Agayevs’ partner at United Russian Fighters and the club’s vice-president, as well as Vagab Vagabov, one of the fighters, were longtime friends of the late ArBat founder Armen Sargsyan, the battalion commander has mentioned in an interview. He thanked them for their support. Kavali contributes “a great deal to the battalion,” the commander explained: “He’s built us a gym where Vagab Vagabov trains the guys, gets them ready, and keeps them in shape.”

In January 2024, Vagabov told Match TV that he had signed a military contract to serve in the ArBat battalion. However, he is not fighting on the front lines, but rather 2–3 km away. “I’ve taken on the soldiers’ physical and firearms training,” Vagabov said in a Sport-Express interview.

Neither the Agayevs, nor Kavali, nor the Mimco founders Manteuffel and Nadal have responded to our questions.

Read on istories.media →

All the leading Russian propagandists have threatened the West with a nuclear strike — this comes as no surprise anymore. For example, back in 2014 Dmitry Kiselyov [a famous Russian TV propagandist — Ed.] said that Russia could turn the U.S. into radioactive ash. And Margarita Simonyan [RT editor in chief — Ed.] said in 2025: “There are no guarantees other than a nuclear bomb.” 

Vladimir Solovyov [another well-known TV propagandist — Ed.] has, on various occasions, threatened Ukraine, Europe, and the U.S. with nuclear weapons and even suggested setting off a nuclear explosion in space: “I don’t understand why, for example, Elon Musk’s satellites aren’t a legitimate target for us. One nuclear explosion in space, I believe, would solve this problem quite effectively.” There are also other examples.

But the propagandists won’t be the ones making the decision. It is Putin who has moved from discussing “getting rid of extensive weapons” to being ready to “employ all available means.” We describe his transformation in his own words.

Putin’s statements

Hereinafter, we use the Kremlin’s official translation.

March 2000. “We seek to make our world safer, to clean it of the stockpiles of weapons, of excessive weapons. <...> We should preserve and strengthen the Russian nuclear weapons capability. But this is not to say that we will increase its size, it is already excessive in some ways. We are talking about enhancing the security of the country and strengthening the nuclear “shield” of the Russian Federation.”

May 2002. “It’s more worthwhile perhaps to eliminate a certain part of nuclear potentials. <...> Any man who has at least once in his career dealt with arms, had arms in his hands, at least to hunt or a rifle or whatever, he knows that it's much better, much safer to have it in storage disarmed, disassembled perhaps, rather than to have it in your arms and charged with bullets in it and with your finger on the trigger at the same time.”

December 2014. “I think [sometimes — Ed.] that maybe it would be best if our bear just sat still. Maybe he should stop chasing pigs and boars around the taiga but start picking berries and eating honey. Maybe then he will be left alone. But no, he won’t be! Because someone will always try to chain him up. As soon as he’s chained they will tear out his teeth and claws. In this analogy, I am referring to the power of nuclear deterrence. As soon as — God forbid — it happens and they no longer need the bear, the taiga will be taken over.”

March 2015. In a film produced to commemorate the first anniversary of the 2014 annexation of Crimea, Putin answered whether Russian nuclear forces had been placed on alert during the crisis: “We were ready to do it. I talked with [the Western counterparts — Ed.] colleagues and told them that this [Crimean peninsula — Ed.] is our historic territory, Russian people live there, they are in danger, we cannot leave them <...> ‘Where are you? Thousands of kilometers away. And we’re here. This is our land. What are you going to fight for here? You don’t know? We do. And we’re ready.’”

March 2018. “If someone decides to destroy Russia, then we have a legal right to respond. Yes, for humanity it will be a global catastrophe, for the world it will be a global catastrophe. But still, as a citizen of Russia and the head of the Russian state, then I want to ask myself the question: ‘Why do we need such a world if there is no Russia there?’”

October 2018. “We cannot be the initiators of such a catastrophe because we have no provision for a pre-emptive strike. Yes, it looks like we are sitting on our hands and waiting until someone uses nuclear weapons against us. Well, yes, this is what it is. But then any aggressor should know that retaliation is inevitable and they will be annihilated. And we as the victims of an aggression, we as martyrs would go to paradise [Heaven — Ed.] while they will simply perish because they won’t even have time to repent their sins.”

February 2022. “No matter who tries to stand in our way or all the more so create threats for our country and our people, they must know that Russia will respond immediately, and the consequences will be such as you have never seen in your entire history. No matter how the events unfold, we are ready. All the necessary decisions in this regard have been taken.”

September 2022. “To defend Russia and our people, we will certainly make use of all weapon systems available to us. This is not a bluff. The citizens of Russia can rest assured that the territorial integrity of our Motherland, our independence and freedom will be defended — I repeat — by all the systems available to us. Those who are using nuclear blackmail against us should know that the wind rose can turn around.”

December 2022. “Concerning the threat of nuclear war. <...> The threat is growing, to be honest. Regarding Russia never using [nuclear weapons] first under any circumstances. Well, if it does not use them first, then it will not be the second to use them either, because in the case of a nuclear strike at our territory, our capabilities will be significantly limited.”

June 2024. “Somehow, the West believes that Russia will never use nuclear weapons. However, our nuclear doctrine clearly states that if somebody’s actions threaten our sovereignty and territorial integrity, we reserve the right to employ all available means in response.”

Nuclear doctrine transformation

As Vladimir Putin’s rhetoric on nuclear weapons has grown more heated, Russia’s nuclear doctrine has also transformed.

The first doctrine (2000) was approved by Putin immediately after he won the 2000 presidential election. The document was published (which hadn’t happened in Soviet and Russian history) on April 21. In the document, the Russian Federation reserved the right to use nuclear weapons “in response to the use of nuclear and other types of weapons of mass destruction against it and (or) its allies, as well as in response to large-scale aggression utilizing conventional weapons in situations critical to the national security of the Russian Federation” (English translation can be found here).

The second doctrine (2010) clarified the criteria for when nuclear weapons could be used by Russia. In the document, the circumstances allowing a nuclear strike were not described as “situations critical to the national security of the Russian Federation” anymore, but instead a situation “when the very existence of the state is under threat” (source: Carnegie Endowment English translation). 

The third doctrine (2020). Essentially, we could consider the 2020 “Basic Principles of State Policy of the Russian Federation on Nuclear Deterrence” decree a new nuclear doctrine. The criteria for nuclear weapons usage had not changed, but the four conditions determining whether it can be used were described for the first time:

“arrival of reliable data on a launch of ballistic missiles attacking the territory of the Russian Federation and/or its allies”; 

“use of nuclear weapons or other types of weapons of mass destruction by an adversary against the Russian Federation and/or its allies”; 

“attack by adversary against critical governmental or military sites of the Russian Federation, disruption of which would undermine nuclear forces response actions”; 

“aggression against the Russian Federation with the use of conventional weapons when the very existence of the state is in jeopardy.” (source: official English translation)

For the first time, Russia has listed the risks “that can evolve into military threats to the Russian Federation and that are intended to be neutralized by the implementation of nuclear deterrence.” These include, among others, buildup by a potential adversary of forces groupings that possess nuclear weapons delivery means in the territories contiguous to the Russian Federation and its allies; deployment of missile defence systems, medium- and shorter-range missiles and strike unmanned aerial vehicles; deployment of nuclear weapons and their delivery means in the territories of non-nuclear weapon states.

The fourth doctrine (2024). The current nuclear doctrine (in English) was approved on November 19, 2024. Compared to the 2020 version, several changes have been made, including the provision specifying the circumstances under which Russia reserves the right to use nuclear weapons. Whereas previously an enemy attack using conventional weapons had to pose a threat to the very existence of the state, the doctrine now refers to a critical threat to the sovereignty and (or) territorial integrity of the state: furthermore, the doctrine now covers attacks not only on Russia but also on Belarus, where Russia has deployed nuclear weapons (“as participants in the Union State” — Ed.)

Another condition for the usage of nuclear weapons added to the four mentioned above is “receipt of reliable data on the massive launch of air and space attack means” (aircraft, missiles, unmanned aerial vehicles, etc) and their crossing of the state border of Russia. 

The list of military risks that can potentially evolve into threats has also been expanded. In light of the Ukrainian military’s promises to isolate Crimea, this point seems to be the most relevant right now: “actions by a potential adversary aimed at isolating a part of the territory of the Russian Federation, including blocking access to vital transport communication.”

Are Russian nuclear threats a bluff or not?

From a rational point of view, using nuclear weapons in the war against Ukraine makes little sense. IStories have described why (here and here). In short, there are now no large concentrations of troops or equipment on the frontlines due to the usage of drones, so a tactical nuclear strike would not achieve any military objectives. An attempt to alter the course of the war with a strategic nuclear strike to shock the enemy and force them to surrender could result in the simultaneous death of tens of thousands (or even hundreds of thousands) of civilians. Russia probably won’t take such a step. But even a tactical nuclear weapons use would turn pretty much the entire world against Russia.

Neither Ukraine nor its Western allies have ever crossed the line beyond which Russia would seriously consider using nuclear weapons, says Maxim Starchak, Fellow at the Centre for International and Defence Policy of the Queen’s University (Canada): “Throughout this war, the parties have firsthand seen the limits of nuclear deterrence. Russia likely believed that its nuclear capabilities would deter the West in providing Ukraine with certain types of weapons. But that didn’t work out. On the one hand, the West has taken the nuclear factor into account in its actions. This affected the timing of delivery and the types of weapons supplied. On the other hand, it turned out that by gradually supplying the required weapons the West is not moving toward a nuclear conflict with Russia.”

Rather than exposing Russia’s bluff, the goal of Ukraine’s allies is to ensure that the nuclear weapons usage framework (the one that Russia established itself) keeps working, explains Pavel Podvig, the head of the “Russian Strategic Nuclear Forces” research project. Back in 2022, not only the Western countries, but also China, India, and the Global South countries expressed their sharp opposition to the use of nuclear weapons. In particular, the G20 2022 summit declaration stated that the use or threat of use of nuclear weapons is unacceptable.

Ukraine’s allies must continue intensifying the pressure on Russia, which means emphasizing that nuclear threats and the use of nuclear weapons are unacceptable, and that no one is posing a threat to Russia’s sovereignty and territorial integrity, Podvig believes. According to him, this pressure allows the West to ramp up the arms shipments and enables Ukraine to intensify the strikes against Russian territory: “The idea is to establish a framework and operate within its limits. And I see no reason why this would not keep working. If nuclear weapons are completely removed from this equation, the support for Ukraine could be even more intensive. The aid to Ukraine and the arms delivery have been successful for as long as the nuclear weapons have been removed from this framework.”

Read on istories.media →

Fontanka reports that the case is connected to the murder of entrepreneur and municipal deputy Aleksandr Petrov in the Vyborgsky District of Leningrad Oblast in 2020. He was shot by a sniper. Petrov was considered Traber’s right-hand man and the “owner of Vyborg.” Petrov’s son, Vitaly, is the first Russian Formula 1 driver to compete in world championships.

The Telegram channel VChK-OGPU, citing sources, writes that shortly before his murder, Petrov allegedly began selling off assets in Vyborg and wanted to move abroad to join his son, which led to a conflict with Traber. The case has been transferred to the central office of the Investigative Committee, and Traber and Danilenko will be questioned in Moscow.

Along with Traber’s detention, law enforcement also conducted searches at the home of Gennady Petrov, the leader of the Petrov-Malyshev organized crime group, a source in the Ministry of Internal Affairs specializing in criminal organizations told IStories. This was also reported by the VChK-OGPU. Details of the search are unknown.

Who is Ilya Traber

Traber has known Vladimir Putin since the 1990s, during Putin’s time working at the St. Petersburg mayor’s office. According to Novaya Gazeta, in the 1990s, St. Petersburg Vice Mayor Vladimir Putin helped Traber with the privatization of the St. Petersburg seaport, which was the subject of fierce competition among several criminal clans.

Ilya Traber is a former submarine officer who went into business in the 1990s. In retirement, he was involved in the antiques business in St. Petersburg, which is how he got his nickname. His company, Antiquary, quickly became a monopoly on the city market with the support of Mayor Anatoly Sobchak.

During the redistribution of property in the 1990s, Traber gained control over St. Petersburg’s port infrastructure, including seaport terminals, logistics structures, land assets on the Baltic Sea, and projects in the oil and gas sector.

This includes the St. Petersburg Fuel Company (PTK), the St. Petersburg seaport, and the aircraft refueling service at Pulkovo Airport. Traber was involved in the expansion of ports in Primorsk and Ust-Luga and participated in the creation of the Northern Sea Route. Among his subordinates was the current head of Gazprom, Alexey Miller. Traber was also considered the “shadow owner” of Vyborg.

Spain declared Traber internationally wanted in connection with the Malyshev organized crime group case. He is suspected of ties with its leaders, Gennady Petrov and Aleksandr Malyshev (both were detained during a major operation in Europe).

Traber’s former bodyguard, Sergey Gess, claims that before becoming president, Vladimir Putin would visit Traber’s office “for advice.”

“He’s still incognito. He never showed off: in the ’90s he drove a Zhiguli [cheap Soviet and Russian car model based on the Fiat 124]. And I didn’t understand why he drove [such a cheap car]? And once we’re driving, he’s behind the wheel, and coming toward us is a BMW, a Mercedes… And the Antiquarian says: ‘It’s too early to buy foreign cars, 1937 could still start again,’” Gess recalled about his boss’s habits.

• As IStories reported, after Russia’s invasion of Ukraine, Traber, together with Leningrad Oblast Governor Aleksandr Drozdenko, created “the Leningrad Frontier” foundation to support the Russian military. In the eight months of 2022, the foundation collected 56 million rubles in donations, but a significant portion of these funds ended up with the family of businessman Oleg Barzinsky, who is close to Drozdenko and Traber. A co-founder of the foundation is Traber’s charity foundation, “Starorusskaya, 12.” This is the address of Ilya Traber’s mansion, known in St. Petersburg’s criminal chronicles of the 1990s. According to official reports, in 2025 this foundation allegedly spent 46.1 million rubles on donations.

Who is Gennady Petrov

Petrov is known as one of the leaders of the Malyshev criminal organization. He is acquainted with high-ranking Russian security officials, for example with FSB First Deputy Director Sergei Korolev. Petrov also called Vladimir Putin his friend, and a Spanish intelligence officer described Petrov as an acquaintance of Putin from the KGB days.

In the early 1990s, Petrov was listed as a member of the Malyshev organized crime group. By the mid-1990s, companies associated with Petrov acquired stakes in the St. Petersburg Oil Terminal and the St. Petersburg Fuel Company. These businesses were also linked to Ilya Traber.

Petrov also became a co-owner of Bank Rossiya, which brought together Putin’s friends from the Ozero cooperative: Yury Kovalchuk, Nikolai Shamalov (his son Kirill is the former husband of Putin’s daughter Yekaterina), and developer Viktor Myachin. At the same time, Petrov became a neighbor to Putin’s friends in the famous house on Kamenny Island.

In 1996, Petrov moved to Spain, where he became the target of surveillance by local law enforcement. The Spanish investigation found that Petrov discussed appointments of senior officials and heads of state companies with leaders of the Investigative Committee, the Ministry of Internal Affairs, and the FSB. Petrov claimed that he had worked with Putin in the KGB. Former FSB officers told Novaya Gazeta that he could have been a KGB informant.

In 2008, Petrov and Aleksandr Malyshev were detained in Spain, but the case eventually collapsed. In 2010, Petrov was released on bail and later returned to Russia.

• As IStories found out, recently Petrov has been involved in two Russian projects worth hundreds of billions of rubles. These include the construction of the Tavrida highway in Crimea and the Scandinavia highway between St. Petersburg and Finland, as well as the supply of coal, pig iron, and iron ore raw materials across Russia and abroad through the largest trader that emerged on the market after Evraz was included in the sanctions lists.

Read on istories.media →

Russia’s economy is slowing down sharply. Regional budget deficits are growing, businesses are struggling under extremely high interest rates, and inflation continues to push prices upward. Disruptions of mobile communications and internet shutdowns across many Russian regions have added to public frustration, creating growing social discontent that the Kremlin can no longer easily dismiss.

Inside the Russian elite, tensions are also rising. According to an intelligence report recently published by IStories, Financial Times, and CNN, senior Russian security officials are increasingly blaming one another for failures in Ukraine. 

Ahead of the Victory Day parade on Red Square, Vladimir Putin asked Donald Trump to persuade Volodymyr Zelenskyy not to strike Moscow during the celebrations. A leader who wants everyone to believe he is winning the war does not ask his enemies for a temporary pause so he can safely watch a parade of a heavily depleted army.

Vladimir Putin has fallen into a trap of his own making — a system built not on democratic institutions, but on informal rules and competing clans organized around money, security structures, political influence, and personal loyalty to the Czar. For decades, Putin acted as the ultimate arbiter between these groups, balancing their interests. But as the pressure of war grows and Putin’s authority weakens, the balance inside the elite is beginning to break down.

Different factions are now quietly preparing for an uncertain future — strengthening their control over financial resources, security agencies, and even private military forces. To understand where Russia may be heading in the coming years, it is necessary to understand the key clans that dominate the Russian system today — and the struggle that may begin once the current balance of power finally starts to collapse. 

To understand the trajectory of the Russian state in the coming years, it is essential to map the primary actors who will likely participate in the inevitable Russian “Game of Thrones.”

IStories and CORRECTIV have built profiles of the most influential Russian clans, their leaders, and the assets they control. The project focuses mainly on groups that possess not only formal political authority but also real physical power through control over security services, armed structures, or other coercive institutions.

For that reason, the profile does not include figures often described by the media as “technocrats” — such as Russian Prime Minister Mikhail Mishustin, Central Bank chief Elvira Nabiullina, Finance Minister Anton Siluanov, and others. Although they occupy senior government positions, they do not appear to possess the kind of direct coercive power that could play a decisive role in a future struggle for power in Russia.

This profile covers some of the best-known and most powerful Russian clans and groups, but it is not a complete list of all potential actors in Russia’s potential “Game of Thrones.”

The Bodyguards

Viktor Zolotov (72 years old) met Vladimir Putin in the early 90s by a stroke of luck. According to the former head of the Security Service of Russia’s first president, Alexander Korzhakov, he hired Zolotov out of desperation — there were no people.

Therefore, when the then-mayor of St. Petersburg asked Yeltsin to provide him with protection against St. Petersburg gangsters in the early 90s, Korzhakov decided to get rid of Zolotov and sent him to guard Sobchak.

In St. Petersburg, Zolotov met Putin and soon became responsible for his protection and that of his family members. When Putin became president, he appointed Zolotov as head of the Presidential Security Service.

For many years, Zolotov remained in the shadow of his boss. However, after mass protests against election fraud broke out in Russia in 2011, which Putin perceived as a conspiracy by Western intelligence agencies with part of the Russian — primarily liberal — elite, he decided to promote his bodyguards to leadership positions in law enforcement and other government agencies.

Putin appointed Zolotov as head of the Interior Ministry’s Internal Troops, which in 2016 were renamed Rosgvardia and removed from the MVD into an independent paramilitary structure with 350,000 personnel.

In this post, Zolotov is essentially tasked with the same mission he has performed for the last 35 years — guarding Putin and his power. For these purposes, in 2023, following the failed mutiny of Yevgeny Prigozhin, Putin issued a decree transferring heavy equipment to Rosgvardia. Now, in the event of internal unrest, Putin’s bodyguard will be able to use heavy tanks against the Russian people.

There is no doubt Zolotov will decide to do so: as one of the leaders of the Russian criminal world told me, in St. Petersburg criminal circles, Zolotov had the nickname “The Pierced” (Probitiy) — for his cruelty and unquestioning loyalty to the Tsar.

Alexey Dyumin (53 years old) comes from a military family. In 1995, he joined the Main Guard Directorate (predecessor of the FSO), where he dealt with communications; in 1999, he joined the Presidential Security Service.

Since then, for 15 years, Dyumin served in Putin’s security detail, never leaving his side day or night, preventing him from drowning in the ocean, and guarding him from bears in the taiga. Initially, Dyumin owed his promotion to Viktor Zolotov: “Viktor Vasilyevich Zolotov is a person who did a lot for my destiny, taught me sense and wisdom… and I understood immediately that he is a very strong, spirited commander behind whom one can go to the end. And then there was an introduction to Vladimir Vladimirovich… and off we went!” Dyumin recalled. However, Dyumin subsequently became one of Putin’s main favorites and one of the most likely successors to the presidency. 

In 2014, as part of the campaign to promote bodyguards to the highest echelons of power, Putin appointed Dyumin as deputy head of the GRU and commander of the Special Operations Forces (SSO), which played a key role in the occupation of Crimea. According to a source acquainted with Dyumin, he received the Hero of Russia star for this operation.

In 2016, Putin appointed Dyumin as governor of the Tula Oblast, which he led for the next eight years. As soon as the Russian president’s favorite became governor, everyone began to help him: from the Ministry of Defense, which began building bridges in the Tula Oblast, to the Moscow government, which renovated the embankment in Tula. State companies and private businesses joined in.

In 2024, Putin returned his favorite to Moscow and appointed him as his assistant overseeing the defense-industrial complex, as well as the Secretary of the State Council. This once insignificant advisory body received constitutional status in 2020 during major amendments. According to many experts, Putin gave the body constitutional status to be able to lead it in the future and hand over power to a successor while retaining the ability to control their decisions.

Dmitry Mironov (56 years old) is a descendant of military officers whose career became a classic example of a “personal bodyguard” ascending to the heights of state power. Since the early 90s, Mironov served in state security (FSO), where he for many years held the position of Vladimir Putin’s adjutant. The degree of closeness to the president is evidenced by the fact that in narrow circles, Putin reportedly affectionately calls him “sonny.” 

Mironov’s public career began in 2014 when Putin appointed him head of the GUEBiPK of the Ministry of Internal Affairs. Already in 2016, similar to Alexey Dyumin, Mironov was sent for “testing” in a region — he headed the complex and protest-prone Yaroslavl Oblast. As governor, he enjoyed exclusive access to the president. 

In 2021, Putin returned Mironov to Moscow, appointing him as his assistant. Today, he holds one of the most non-public but strategically important positions — chairman of the commission on personnel policy in law enforcement agencies. Through Mironov’s hands pass the dossiers of all the country’s key siloviki, making the former adjutant the “chief HR officer” of the regime. 

Like other members of the “bodyguards” clan, Mironov also oversees mobilization resources, heading the Council for Cossack Affairs and supporting Cossack units in the war with Ukraine.

Alexey Rubezhnoy (53 years old) is a career officer of the “Alpha” special unit who replaced Dmitry Kochnev as head of the Presidential Security Service (SBP) in June 2016. Rubezhnoy focused on creating powerful economic influence, using the SBP as a tool for lobbying and control over strategic assets.

Rubezhnoy heads the Supreme Supervisory Board of the Russian Boxing Federation, led by Umar Kremlev (Lutfulloev) — a businessman with a criminal past. Rubezhnoy and Kremlev are relatives; they are married to sisters. Through Rubezhnoy’s patronage, Kremlev gained access to personal communication with the president. Their partnership allowed them to take control of multi-billion dollar markets: from monopolizing the betting business to managing the country’s largest lottery operator. After the full-scale invasion in 2022, Rubezhnoy became one of the main beneficiaries of the process of deprivatization and “nationalization” of private property. 

It was Rubezhnoy who lobbied Putin for the decree transferring the assets of Russia’s largest car dealer, Rolf, to the temporary management of Rosimushchestvo; the new owner effectively became Rubezhnoy’s protégé, Kremlev.

Dmitry Kochnev (61 years old), director of the Federal Protective Service (FSO), is one of the most secretive and least-known silovik within Vladimir Putin’s inner circle. In 2021, Kochnev was promoted to General of the Army — Russia’s highest military rank (excluding Marshal) — underscoring a status that places him on equal footing with Sergei Shoigu, Alexander Bortnikov, and Viktor Zolotov.

Kochnev began his career in state security during the Soviet era, joining the KGB’s 9th Directorate in 1984, which was responsible for protecting the country’s top leadership. Following the collapse of the Soviet Union, he continued his rise through the structures of the Federal Protective Service.

In the early 2000s, Kochnev entered Vladimir Putin’s orbit, gradually becoming one of the most trusted officers in the president’s personal security detail. He oversaw the operational work of the Presidential Security Service (SBP) and was responsible for organizing the protection of top officials and strategic facilities.

In 2016, Putin appointed Kochnev as director of the FSO. While the agency is formally responsible for guarding high-ranking officials, the Kremlin, government communications, and strategic sites, it has long since transformed into an independent center of influence with vast financial, technical, and operational capabilities.

Following the invasion of Ukraine, the FSO’s role expanded significantly: thanks to constant access to Putin and information on top officials, Kochnev and his agency wield immense influence.

Alexander Kurenkov (53 years old) is a career intelligence officer whose biography exactly repeats the path of “adjutants” who became state ministers. From 2002, he began service in the FSO, and from 2015, he became Vladimir Putin’s adjutant.

In 2021, Kurenkov was transferred to Rosgvardia to Viktor Zolotov, where he became deputy director. However, in May 2022, Putin appointed him head of the MCHS. Putin characterized him as a “hard worker” (sluzhaka) in the best sense of the word, capable of bringing strict order to the structure. 

In June 2025, Kurenkov was promoted to Colonel General. Under his leadership, the MCHS is integrating into the military agenda, actively restoring the civil defense system and shelters, for which over 150 billion rubles is planned.

The Consiglieri

Yuri Kovalchuk (74 years old) is called the “personal banker” and chief ideologue of the president, responsible for forming the media agenda and strategic planning. Kovalchuk is the informal curator of Russia’s internal policy. 

Through the National Media Group (NMG), led by Putin’s mistress Alina Kabaeva, Kovalchuk controls the country’s largest media resources: Channel One, Fifth Channel, REN TV, and Izvestia. 

The economic foundation of the clan consists of Bank Rossiya and the SOGAZ insurance group. 

Yuri Kovalchuk’s role reached a new level after 2020: according to many sources, it was he who spent the most time with Putin in isolation during the pandemic, sharing his views on “restoring historical justice” and confrontation with the West. 

Through Sergey Kiriyenko, they control the presidential administration, and through Mikhail Kovalchuk (Yuri’s brother), they control fundamental science and the budgets of the Kurchatov Institute. 

In 2024, the clan’s influence was secured by the appointment of Yuri’s son, Boris Kovalchuk, as head of the Accounts Chamber.

Mikhail Kovalchuk (79 years old) is the elder brother of Yuri Kovalchuk and the chief ideologue of Russia’s scientific and technological development. 

Since 2005, he has led the NRC Kurchatov Institute, which has turned into a “scientific empire,” absorbing dozens of the country’s leading research institutes. 

Kovalchuk serves as Putin’s guide to the world of “science of the future” and global threats. He is the author of theories about the creation of “nature-like technologies” and “biological dangers” coming from the West. 

After 2022, Mikhail Kovalchuk became a key figure in ensuring “technological mobilization,” promoting the idea of the complete isolation of Russian science from Western institutions.

Sergey Kiriyenko (62 years old) is the curator of the Putin regime’s internal policy, serving as First Deputy Head of the Presidential Administration since 2016. His alliance with the Kovalchuk clan is strategic: Kiriyenko provides administrative resources and personnel selection, while the Kovalchuks provide financial and media support.

His influence is built on total control over meanings and personnel. He is the ideologue of the “Leaders of Russia” system. In the digital environment, the clan is anchored through Sergey’s son — Vladimir Kiriyenko, who headed the VK holding. This turned the country’s largest social network into an instrument of state control and propaganda. After 2022, Kiriyenko became a key “civilian” face of the war, overseeing the creation of a new ideological layer in society.

Boris Kovalchuk (48 years old) is the son of Yuri Kovalchuk, embodying the process of transferring power and assets to the “heirs” of the president’s inner circle. From 2009 to 2024, he led the Inter RAO holding — one of the country’s largest energy companies. In 2024, he was appointed head of the Accounts Chamber of the RF.

This appointment turned him into the country’s chief “auditor,” giving the Kovalchuk clan an unprecedented lever of control over the entire vertical of power, allowing them to oversee the financial discipline of potential competitors.

Alexander Beglov (69 years old) is considered a direct appointee of Yuri Kovalchuk, ensuring the clan’s interests in their “base” region. As governor of St. Petersburg, Beglov acts as an operator of large infrastructure and investment projects in which Bank Rossiya and Kovalchuk-linked contractors are interested. 

In 2024, having been re-elected for a new term, Beglov maintained full administrative control over the country’s second most important city for the Kovalchuk clan.

Alexander Gutsan (65 years old) is a trusted person of the Kovalchuk clan in the law enforcement vertical. In September 2025, Gutsan’s political weight reached its peak: he was appointed Prosecutor General of the Russian Federation. This appointment allowed the Kovalchuk clan to gain control over the main supervisory body in the country. 

In league with Boris Kovalchuk (head of the Accounts Chamber), the family now has the ability to not only audit financial expenditures but also immediately initiate criminal and administrative prosecution of any officials or businessmen. Gutsan plays the role of a key tool in the legalization of property redistribution.

The KGB Colleagues

Sergey Chemezov (73 years old) is one of the most influential people in Putin’s circle, whose connection with the president dates back to the mid-80s in Dresden (GDR). 

Since 2007, Chemezov has led the state corporation Rostec. Under his control are hundreds of enterprises of the military-industrial complex. 

After 2022, Chemezov’s role as the main arms producer for the Russian army became critical. He actively participates in the process of “creeping nationalization”: assets of private owners who fail to cope with state defense orders or are recognized as “disloyal” are systematically transferred to the management of Rostec.

Nikolay Tokarev (75 years old) is a member of the “Dresden group.” Tokarev traditionally belongs to Sergey Chemezov’s orbit of influence. 

Under his leadership, Transneft turned into a key tool of the Kremlin’s energy diplomacy, managing the world’s largest oil pipeline system. 

After 2022, Tokarev’s role became critical in the context of reorienting oil flows from the West to the East. In the clan hierarchy, Tokarev acts as the “guardian of the pipe” — the regime’s key financial artery.

Denis Manturov (57 years old) is the key conductor of Sergey Chemezov’s interests in the government. Chemezov publicly called Manturov a “reliable friend.” 

In May 2024, he received the status of First Deputy Prime Minister, making him the chief curator of the entire real sector of the economy and the military-industrial complex. 

For the successful supply of the front in 2026, Putin awarded Manturov the title of Hero of the Russian Federation. Manturov plays the role of a strategic operator who legalizes Rostec’s expansion and puts civilian industry on “military tracks.”

Sergey Kulikov (50 years old) is one of the most trusted young technocrats in Sergey Chemezov’s system. In December 2020, Kulikov replaced Anatoly Chubais as head of Rosnano.

His appointment marked the final transition of the innovation sector under the control of the Rostec group and the siloviki. 

In the context of the war, Rosnano was reoriented toward the needs of the VPK, particularly for creating new materials and microelectronics for the front.

The Oilmen

Igor Sechin (65 years old) is known in the media as “Darth Vader” for his tough management style. Since 2004, Sechin has headed Rosneft, turning it into the world’s largest oil company through a series of aggressive takeovers. He became the main ideologue of state capitalism. 

Power support for Sechin is provided by the so-called “Sechin’s Spetsnaz” — the 6th service of the FSB’s Internal Security Directorate, which he helped form for the Yukos case. 

Former head of the “Six,” Ivan Tkachev, now heads the Department of Military Counterintelligence of the FSB (DVKR), which gives Sechin unprecedented levers of influence over the army leadership.

Gennady Timchenko (73 years old) is a heavyweight of the Putin elite. According to official statements by the US Treasury, Vladimir Putin personally had investments in Gunvor, which made Timchenko the actual manager of the president’s personal oil income. 

After 2022, Timchenko’s role became critical for the regime’s survival under the oil embargo. His structures and former managers switched to managing the “shadow fleet” — numerous tankers with opaque ownership. 

Timchenko acts as the architect of parallel export corridors.

Lieutenant General Ivan Tkachev (55 years old) led the 6th service of the FSB’s Internal Security Directorate, created with Sechin’s direct participation to purge the political and economic field of opponents. The “Six” gained a reputation as an “Oprichnina.”

After UMB, Tkachev headed Department “K” of the FSB, and then moved to the post of head of the Department of Military Counterintelligence (DVKR) of the FSB.

During full-scale war, the DVKR exercises direct oversight of the Ministry of Defense and monitors the distribution of giant defense budgets.

Eduard Khudaynatov (65 years old) is a key business partner of Igor Sechin, performing the role of “trusted person” for managing private assets. 

In 2013, he formally left Rosneft to create his own private holding — the Independent Oil and Gas Company (NNC). 

NNC became a unique tool in the architecture of Sechin’s clan, systematically buying up oil fields and refineries that are then integrated into general logistics chains with Rosneft.

NNC is effectively a “private branch” of the state oil monopoly.

Alexander Novak (54 years old) is a key technocrat in the management system of the Russian fuel and energy complex. Despite his “technocrat” status, Novak is deeply integrated into Igor Sechin’s orbit of interests.

Since 2015, he has been a member of the Board of Directors of Rosneft.

In May 2024, Putin re-confirmed him as Vice Prime Minister. Novak plays the role of Sechin’s “state interface,” legalizing Rosneft’s initiatives through government decrees and international agreements.

The Rotors

Arkady Rotenberg (74 years old) is a childhood friend of Putin. He built a giant construction empire specialized in the most ambitious state projects, the main symbol being the Crimean Bridge.

Rotenberg operates through private structures that depend entirely on budget funding. 

After 2022, Arkady Rotenberg and his clan members became key beneficiaries of property redistribution and nationalization.

According to the Financial Times, Rotenberg-linked company “Roskhim” has already acquired at least three Russian companies after they were nationalized. In 2020, Putin awarded him the title of Hero of Labour of the RF.

Igor Rotenberg (52 years old) is the eldest son of Arkady Rotenberg. 

His main asset is a stake in RT-Invest Transport Systems, the operator of the Platon system, which collects fees from heavy trucks on federal highways. This project is a classic example of public-private partnership in the interest of a narrow circle of people. 

Igor Rotenberg also controls Gazprom Burenie, Gazprom’s largest contractor. He manages “digital rent,” providing the family’s long-term financial stability.

Boris Rotenberg (68 years old) is the younger brother of Arkady.

Boris was traditionally responsible for the financial block and the management of the family’s personal assets. 

He also acts as the main curator of sports projects, which are an important channel for informal communication with Putin. 

After 2022, SMP Bank was integrated into Promsvyazbank (PSB), allowing family assets to be integrated into the system for servicing state defense orders.

Oleg Belozerov (56 years old) has headed RZD since 2015. His career is inextricably linked with St. Petersburg and the interests of the Rotenberg brothers. 

Under his leadership, RZD became the main customer for Rotenberg construction holdings, including projects for the expansion of the Eastern Polygon (BAM and Transsib). 

Belozerov ensures the smooth operation of military transport logistics.

The Military

Andrey Belousov (66 years old) was appointed Minister of Defense in May 2024.

He is the main architect of the concept of “Military Keynesianism,” whereby huge military spending should become the engine for the entire Russian economy. 

Belousov’s main task is to conduct a “total audit” and eradicate corruption schemes. He does not claim the role of commander but fully controls financial flows. 

He is an ideal tool for Putin to control the security block.

Valery Gerasimov (70 years old) has been Chief of the General Staff since 2012.

He is one of three people in the country with access to the “nuclear briefcase.” 

Since January 2023, Gerasimov has personally led the Joint Group of Forces in the conflict with Ukraine. 

He remains the key link between the political leadership and the fighting army.

Admiral Igor Kostyukov (65 years old) has led military intelligence since 2018.

Under his leadership, the GRU turned into Russia’s main instrument for sabotage abroad. 

In 2024–2026, the GRU became the main operator of “hybrid war,” including cyberattacks and sabotage at logistics hubs supplying aid to Ukraine. 

In January 2026, he led the Russian delegation at talks in Abu Dhabi, highlighting his status as an influential political player.

The Chekists

Alexander Bortnikov (74 years old) has headed the FSB since May 2008.

He acts as the main “guardian of the regime,” responsible for internal stability and fighting dissent. 

After 2022, his influence became existential for the Kremlin.

Despite facing criticism for misjudging the situation in Ukraine at the onset of the invasion, Bortnikov retained his post and was reappointed as the service’s director in May 2024. His main task is to ensure total political sterility within the country.

However, according to sources of IStories, Bortnikov is losing influence due to his health and spends more time in sanatoriums than at work.

Sergey Korolev (63 years old) is the “Gray Cardinal” of the Lubyanka. 

Despite a reputation for being close to leaders of the criminal world (helping Gennady Petrov and the hitman Aslan Gagiev), such connections are interpreted as “operational work” in the Putin regime. 

Today, Korolev is the First Deputy Director of the FSB and effectively manages the day-to-day activities of the service due to Bortnikov’s health.

General Alexey Sedov (71 years old) has led the 2nd service since 2006, which human rights activists call the “political Gestapo.”

This service oversees the fight against “extremism” and “internal threats,” which in practice translates to the persecution of opposition leaders, journalists, and activists.

The 2nd service of the FSB is responsible for the physical and legal elimination of political opponents: its employees were behind the poisoning of Alexei Navalny.

Sedov has the right of direct reports to Putin. 

In 2026, Sedov remains the key architect of total political control.

Nikolai Patrushev (74 years old) served as Secretary of the Security Council for 16 years (2008–2024), transforming the body into a “shadow government” that shaped an aggressive foreign policy and an anti-Western vision for the country’s development.

His positions were shaken after the Yevgeny Prigozhin mutiny. 

In May 2024, he was moved to the more modest post of assistant to the president overseeing shipbuilding. 

Nevertheless, he retains significant influence within the state security system through a network of his appointees, including Alexey Sedov.

The Orthodox

Konstantin Malofeev (51 years old) is known as the “Orthodox oligarch.” He was at the origin of the 2014 events in Donbas and Crimea. 

After 2022, his significance grew due to the financing of numerous private armed units and volunteer battalions. Possessing his own mini-army, Malofeev could become a “jack-in-the-box” in the 2026 struggle for succession.

Igor Shchegolev (60 years old), the Presidential Envoy to the Central Federal District and former Minister of Communications, is a former intelligence officer of the KGB’s First Chief Directorate (PGU) who served under TASS cover. Shchegolev’s ties to Putin date back to 1999; he served as an advisor when Putin headed the government and ran the presidential protocol department in 2002.

In 2008, Shchegolev was appointed Minister of Communications. Between 2009 and 2010, a fund managed by his longtime friend, Konstantin Malofeev, acquired roughly a 10% stake in Rostelecom, Russia’s largest state-controlled telecommunications company. Malofeev later sold this stake back to Rostelecom in 2013 for more than 30 billion rubles. Russian media suspected that Malofeev may have been acting in Shchegolev’s interests.

Georgy Shevkunov (Tikhon) (67 years old) is widely known as Vladimir Putin’s “confessor” and ranks among the most powerful figures within the Russian Orthodox Church. He grew close to Putin in the late 1990s when the latter headed the FSB. Putin reportedly visited the priest on his own initiative; Tikhon was then the abbot of the Sretensky Monastery, located just a couple of kilometers from the FSB headquarters on Lubyanka.

Shevkunov is a long-standing ideologue of Russia's confrontation with the West and a key pro-war propagandist who has exerted immense effort to shape state policy.

Sources acquainted with Malofeev and Shchegolev note that both are deeply connected to Tikhon. Despite the Metropolitan’s strained relations with the official church leadership, he is frequently tipped as a potential contender for the post of Russian Patriarch.

Translation: CORRECTIV, IStories

Read on istories.media →

The names of the individuals have been changed at their request for security reasons.

“The defendant may be deported after the military operation is completed.” Why Russia detains ex-prisoner Ukrainian citizens

Olha's prison term ended in January 2026, but instead of being released, she was sent to a temporary detention center for foreign nationals in one of the regions of Central Russia. Olha came to Russia as a teenager and graduated from high school and college there, but kept her Ukrainian citizenship. On the verge of her release from prison, the Federal Penitentiary Service (FSIN) decided that her stay in Russia was “undesirable,” and the Ministry of Internal Affairs ruled to deport her. 

Deporting foreign nationals after their prison sentences is a common practice which had also been used in pre-war Russia, says Oleksii Ladukhin, a lawyer at Every Human Being. After the full-scale invasion began, direct deportations to Ukraine were halted. Because of this, Ukrainian citizens are spending months and years in detention centers. 

IStories has obtained a court ruling extending the detention of a Ukrainian citizen in one of such centers. Here is how Russian court justifies indefinitely detaining people in such conditions: “The circumstances preventing the deportation of the administrative defendant are temporary in nature; once the special military operation (an official euphemism used in Russia to describe the Russo-Ukrainian war — Ed.) is completed, the administrative defendant may be deported to their country of citizenship.” This essentially translates to indefinite detention.

According to Ladukhin, before the war deportations used to take about two weeks; everything would depend on whether the person being deported had their valid documents and on the level of cooperation with the receiving country authorities. “Courts did not routinely and massively extend detention periods like they do now, because it was possible to file a complaint with the European Court of Human Rights over such practices,” says the lawyer. “In 2022, the situation changed dramatically. Neither we nor our colleagues from other organizations have had a single case where a court would reject a Ministry of Internal Affairs request to extend the detention of a Ukrainian citizen.”

Russia is using the Ukrainians subject to deportation as bargaining chips. In May 2025, during a large-scale “1,000 for 1,000” prisoners of war exchange, 120 civilians returned to Ukraine. But among them there wasn't a single person of those abducted from the occupied territories. Instead, Russia sent back those Ukrainian citizens it was supposed to deport anyway: those who had served their sentences in Russian penal colonies and prisoners from Ukraine's Kherson oblast who had been taken to Russia in 2022.

In a conversation with IStories, Mykhailo Savva, a Ukrainian Center for Civil Liberties expert, described this practice as “blatant fraud on the part of Russia.”

Not less than 1,000 Ukrainians are stuck in detention centers for foreign nationals across Russia, but the exact number is unknown, says Hanna Skrypka, a lawyer with the Protection for Prisoners of Ukraine NGO. The detainees are kept in various Russian regions, and in many cases there is no way of communication for them. The detainees IStories were able to speak with say that in the Sakharovo detention center (in Moscow Oblast — Ed.) alone there are about 300 to 400 detained Ukrainians. There are about 70 of them kept in the village of Voronino in Smolensk Oblast. As more people are released from penal colonies, the number of detainees is growing. 

Olha has been kept in the center for more than four months. According to her, some of the people there have had their detention term extended up to seven times. “No one is giving us any information. It’s agonizing. The people are burned out and desperate. We’re treated like subhumans. They say deportation is impossible and that I’ll be stuck here until the end of the ‘special military operation.’ It sends shivers down my spine,” she says. Oleksii Ladukhin says one of the people who reached out to him spent more than three years at the foreigners detention center.

“I’ll die here without treatment”. The detention conditions

The centers where the Ukrainians are kept are designed for short-term detention only. The conditions there are no better than in penal colonies — and sometimes even worse. The food supply and the access to personal hygiene and medical care are highly problematic issues there. 

In one of the regions of the North Caucasus, there are no vacant places in the foreign nationals detention center, so the Ukrainians awaiting deportation have been sent to a jail-type facility (а “detention center for people under administrative arrest” — Ed.). “It’s a regular jail with the bare minimum of amenities. No outdoor time, no medical facilities — nothing at all. No beds, just bunks. A cell for four people. Unsafe and unsanitary conditions. No soap, no toothbrushes, no hygiene products. No doctors. The food supply is terrible. They installed a shower in April; before that, we had to wash ourselves in a basin,” describes Mykola, one of the detainees.

According to Mykola, he had a blood pressure spike in winter; an ambulance was called, and the nurse administered his shot carelessly, which caused an abscess. The man had to be taken to the surgery room by ambulance again. He was soon discharged, even though the wound had not yet healed (the photos are at the disposal of the editorial staff). “They said that they wouldn’t give me any medication because I have no state health insurance. I offered to buy the medicines with my own money, but they kicked me out of the ward anyway. The wound is still bleeding,” the man says. The inmates at the facility are not provided with medical care although some of them suffer health issues including stomach ulcers, gastritis, and hypertension.

Another person IStories spoke with, Yaroslav, describes similar conditions at another detention center in one of Russia’s central regions. Yaroslav was released from a Russian prison in 2025 and has been held at the detention center for five months now; his cellmates have been there for over a year. The center is overcrowded.

“No one knows what to do with us; there is no more space,” says Yaroslav. “The police bring in new people. They are sent away. ‘Take them wherever you want,’ they say.” 

There are six Ukrainians in Yaroslav’s cell. Just one shower for 30 people. The inmates are only allowed to be outside (in a small courtyard with high walls and a metal grate overhead) for an hour a day and are allowed to use the phone for just an hour a day, too. “We’re just stuck in here, locked up” Yaroslav continues. – “We're asking them to maybe let us shovel snow in the winter, just to move around and stretch our legs.’ But no, they tell us we have no right to work.”

Yaroslav is HIV-positive and needs to take medication every day, but the police won't provide it: “I’m fighting [to be deported to Ukraine] because I feel trapped. Without treatment I’ll die here.” 

“Locked up for no reason and waiting for hell knows what.” How indefinite detention works

Once in three months, the Ukrainians are taken to a court that extends their detention at the request of the Ministry of Internal Affairs. “We have a lawyer; he explains it all [why detention cannot be extended indefinitely] clearly, the judge agrees with him, leaves, comes back, and still orders the detention to be extended for another three months,” Serhii, one of our interviewees, describes the typical procedure. 

Oleksii Ladukhin explains that appeals do nothing to speed up the deportation process: “According to the Russian prosecutor’s office and the superior courts, if the number of possible detention extensions is not specified in the legislation, there's no limit. And so there are no violations.” 

Back in 2025, Serhii was to be deported to Ukraine via Georgia, but Georgian border guards did not let him pass because his passport had expired. The Russian Ministry of Internal Affairs left him in a jail-type detention center in one of the North Caucasus regions, as there were no spots available at the local detention center. He has been there for a whole year since his release from prison. 

In his case, the Ministry of Internal Affairs and the courts are at least trying to follow the formalities. Some detainees are even less lucky. Andriy, another Ukrainian currently kept at a foreigners detention center, told IStories that the order to place him there had expired back in August 2025: "I appealed to the administration, explaining that I have been kept here unlawfully. For me to stay here, there should be a court order with a specific term. They don’t understand. I have filed a lawsuit with the court. No response. Another lawsuit with the prosecutor’s office. No response. I called them. A prosecutor came here in the fall of 2025 and said they would look into it. They’re still looking into it.” 

The European Court of Human Rights has ruled that keeping people in detention centers for foreign citizens long-term constitutes a violation of Article 5 of the European Convention on Human Rights, which prohibits unlawful confinement, Oleksii Ladukhin explains. “Detention is permissible when they are actually carrying out the deportation, when the authorities are taking active and good-faith steps to implement it: transferring documents, coordinating the location and time of deportation and conducting negotiations. If the process has stalled, a person cannot be detained indefinitely. This is a severe violation of their rights,” he says. 

“It’s very hard: being locked up for no reason and waiting for hell knows what,” Serhii confides. “My family in Ukraine is having problems; I don’t know if I’ll ever see them again. It’s very difficult mentally. The prison walls are suffocating, and the whole situation is overwhelming.

“When they are fed up, they’ll sign up as cannon fodder.” War recruitment at the detention centers

All of our interviewees note that the former prisoners — and primarily those who had lived in the now-occupied territories of Ukraine before coming to Russia — are being recruited to fight against their own country. “We’re hearing that the general idea is 'let's keep them locked up, and when they are fed up, they’ll sign up for the ‘special military operation’ as cannon fodder,” says Yaroslav, who has been kept at the detention center for six months since his official release. 

At a detention center in one of the regions in Central Russia there are people who have been expecting deportation for over a year and a half, two Ukrainians told IStories. According to them, the only way to get out that was offered to those detainees was to sign a military contract with the Ministry of Defense and go to war against Ukraine. 

Andriy, our interviewee kept in the Caucasian jail-type detention center, confirms: “There are instructions from above to offer [the military contracts]. Right now, the guys are just losing their minds from the hopelessness and from no way out in sight, and they’re even ready to sign the contracts. But in the jail-type detention center, they aren’t even given that opportunity. In [another region], people have been taken away to fight in the ‘special military operation’; a couple of people left when I was there". 

Not all the Ukrainians interviewed by IStories want to return home. Many men are sure that upon their return they will be forcibly mobilized without being allowed to see their families. Those who do not want to return to Ukraine are either trying to seek asylum in Russia, are applying for Russian passports, or looking for opportunities to leave via a third country at a family invitation or for work, but all they get is detention extensions.

“He wasn’t even ill before, but now he’s disabled.” Fate of those stranded at the Russian-Georgian border

Men who do not want to return to Ukraine are citing the consequences of the August 2025 mass return, when Ukraine organized the evacuation of its citizens who had been stranded in a basement on the Russian-Georgian border through Moldova. 

A few days later, reports emerged that those who had returned were sent to TCRs (territorial recruitment centers, a Ukrainian name for military enlistment offices — Ed.) after a three-day quarantine. Those deemed fit for service were mobilized. Hanna Skrypka (Protection for Prisoners of Ukraine) confirmed IStories that 40 of the 65 returnees had been mobilized.  

Protection for Prisoners of Ukraine published an open letter calling on the Ministry of Defense and the Security Service of Ukraine, as well as other Ukrainian government agencies, to consider changing the return procedures. For example, they requested to allow people to see their families and receive medical and psychological assistance upon returning. According to Skrypka, they have not received any reaction to this letter. 

Currently, 19 of those who refused to return to Ukraine in August 2025 are remaining in the border gray zone. They are still living in a windowless basement and are entirely dependent on charities that occasionally bring them food and humanitarian aid.

“It’s a concrete room with no ventilation. We can’t predict when the next food supply will arrive, so we constantly have to save food. There have been times when we spent a whole week with no food,” says Oleksii, a Ukrainian citizen who has been living in the basement for nearly a year. 

The Georgian Red Cross branch told the Ukrainians that the aid program for them had ended. The branch’s deputy secretary-general, Kakha Mamuladze, confirmed IStories that the program had been shut down back in December because international donors had stopped funding it. The Tbilisi Volunteers organization, which supports Ukrainians in Georgia, cannot operate fully due to Georgia’s newly introduced “foreign agents” law and is forced to find workarounds to continue helping those stranded at the border, said Maria, its head.

The most serious problem is the lack of medical care. One man became disabled while stuck at the border. He had an eye infection, and his fellow basement dwellers tried to call an ambulance. They had reached out to the Ukrainian consulate, but no help arrived for several weeks. “By the time we managed to get him to the hospital, all that the doctors could do was remove his eye. He wasn’t even ill before, but now he’s disabled. What kind of medical care is this? We don’t even have painkillers for headaches and toothaches, not to mention those of us who need a more serious treatment or medications,” Oleksii says. 

Among those in the basement there are people with hepatitis and HIV. They need daily treatment, but it’s very difficult to access. “Antiretroviral therapy medication isn’t available over the counter, and the Georgian HIV care center can’t give medications out to unregistered and untested patients. But they can’t get tested at the border. We’ve managed to find a way to deliver the medications several times and we hope we’ll be able to do it again soon,” says Maria from Tbilisi Volunteers. 

In November 2025, Andriy Bilyk, a representative of the Ukrainian Embassy in Georgia, visited the Ukrainians remaining in the basement. He explained that technically the consulate could issue the new passports for them, but this would require approval from the Ukrainian Ministry of Justice as well as the Ministry of Internal Affairs and the Security Service of Ukraine (a recording of the meeting is at IStories’ disposal). A month later, the embassy sent the approval document to the basement, but by that moment the Security Service of Ukraine had not issued passports to any of those citizens.

Pavlo has remained in the basement for almost a year. He says he is already losing hope of ever getting his passport and leaving. “They constantly throw something at us to keep us from bothering them. Two or three weeks go by, and we start calling and writing to them again. I wonder if I’ve got 50 kilos of weight left. I feel terrible. There’s no air here; we’re just suffocating. The only thing left to do is to shoot myself — I don’t know what other way out there is.” 

IStories have sent inquiries to the Russian Ministry of Internal Affairs, the Office of the Human Rights Commissioner of Russia, and the Presidential Council on Human Rights asking what steps the Russian authorities are taking to end the indefinite detention of Ukrainian citizens. We have not received any responses from these entities. The Office of the Ukrainian Parliament Commissioner for Human Rights and the Ukrainian Embassy in Georgia also have not responded to our inquiries as of the moment of publication.

Read on istories.media →

Since the invasion began, the Kremlin has spent years cultivating the image of a new elite, signaling that veterans of the “SMO” (Special Military Operation, the official Russian government term for the war in Ukraine) should take their rightful place alongside established technocrats and old-guard politicians.

Vladimir Putin has repeatedly hammered this theme, dubbing the military “the real elite” and emphasizing that they are the ones who should “rise to leading positions in the state.” To institutionalize this idea, the government launched the “Time of Heroes” program — a state-sponsored career elevator designed to fast-track yesterday’s soldiers into government posts.

The 2026 elections were supposed to mark another major milestone for this initiative, but even in the early preparatory stages, a stark reality emerged: integrating the military into the political system en masse simply will not work. This is not merely about electoral risks (will voters actually back SMO veterans?), but about the fact that the political system itself has no idea what to do with them.

As early as November 2025, according to IStories’ sources within the Kremlin and the State Duma, officials discussed a plan to usher up to 150 war participants into parliament — nearly a third of the entire chamber. However, that ambitious idea was swiftly scrapped. Insiders explained it bluntly: “You can’t bring these people in like that; they’re completely non-systemic.” Consequently, the target was slashed to 50–70 individuals. Now, sources’ estimates have grown even more cautious: the working figure is roughly 30 deputies, despite public declarations from United Russia (the ruling pro-Putin political party) about its desire to seat over 40 veterans in the Duma.

The prospect of a new bloc of military deputies clearly makes the Kremlin uneasy. Currently, the presidential administration and United Russia are debating exactly how to absorb veterans into the next Duma: should they create dedicated structures for them, or, conversely, disperse them across various committees to dilute their influence and ensure safety? Judging by the guarded commentary from pro-Kremlin political experts, it is glaringly obvious that the authorities are not confident in their ability to control them.

Take, for example, the case of Nikita Gorelov. In October 2024, this mobilized sergeant and sniper became the mayor of Sosnovka, a small village in the Kirov Oblast. He immediately began blowing the whistle on local government corruption, quickly clashing with regional United Russia functionaries. Officials attempted to ship the soldier back to the frontlines, but local residents rallied to his defense. Now imagine thirty such volatile scenarios playing out on the floor of the State Duma.

Unlike the typical careerists from the “Young Guard” (United Russia’s youth wing) or the graduates of Sergei Kiriyenko’s (first deputy chief of staff of the Presidential Administration) management competitions, war veterans simply do not fit into the established matrix of political subservience. According to insiders, they are widely perceived as “uncontrollable” — figures who might demand far more independence than is customary in Russia's tightly scripted political arena. The logic is straightforward: the less consolidated this group remains, the easier it will be to manage them.

Then there is another awkward question: exactly which veterans will the state designate for the Duma? The “veteran” category turns out to be politically murky. Frontline soldiers, rear-echelon officials, mobilized men, contract soldiers, pardoned ex-convicts, combat medics... Voters might reasonably ask: why does one “hero” get a Duma mandate while another is left rotting in the trenches? Furthermore, if these individuals wake up tomorrow and begin to see themselves as a unified political force, what then? Should they be pitted against one another just to ensure they don’t “eat United Russia alive”? This is why the Kremlin faces a dual, contradictory task: it must visibly bring veterans into the halls of power, while simultaneously preventing them from becoming an independent political actor.

The problem is that even at lower levels of government, the integration of veterans is already floundering. In recent regional elections, many military candidates lost their party primaries. In the Federation Council (the upper house of parliament), new colleagues drawn from the military have been unofficially branded as “black sheep” and mocked for their inability to “string two words together.”

Moreover, despite the high level of societal respect afforded to war participants, there is no reliable public data indicating how this reverence translates into actual votes at the ballot box. For political parties, running a veteran is a gamble that by no means guarantees victory. While parties publicly declare their enthusiasm for nominating SMO veterans, in practice, it seems everyone is searching for backdoor compromises.

Some are relying on party lists, where election outcomes are much easier to control. Others are placing them in single-mandate districts (where voters elect a specific candidate rather than voting for a party list), seemingly banking on the assumption that rival parties will refuse to campaign against “war heroes” out of ideological deference. Ultimately, the goal is performative participation with absolute minimum risk.

All of this is unfolding against a backdrop of rapidly deteriorating social sentiment. According to VCIOM (Russian Public Opinion Research Center, the state-owned polling agency), the happiness index of Russians in the spring of 2026 plummeted to its lowest level in fifteen years. The authorities are being forced to maneuver carefully: they are already purging overly radical deputies from the public sphere to avoid inflaming domestic tensions. Against this volatile backdrop, the prospect of introducing an unpredictable bloc of veterans suffering from PTSD into the new Duma looks exceptionally risky.

The Russian authorities have backed themselves into a tight corner of their own making: these “war heroes” are desperately needed as ideological symbols, but they are far too dangerous to be empowered as real political actors. As a result, the Kremlin is once again losing face, quietly retreating from its own fiercely declared principles.

Read on istories.media →

Symbolic Software reviewed the claims from last year’s IStories report regarding Telegram’s ties to the FSB, concluding that the vulnerability we detailed in 2025 poses a genuine threat to the privacy of all the app’s users, including those communicating in secret chats.

“We evaluate claims from public reporting about these vulnerabilities, finding the core technical assertions <...> to be accurate and reproducible. <...> The implications extend beyond theoretical concerns. <...> This is particularly significant given Telegrams adoption by journalists, activists, and other high-risk users,” the expert review states (the full Symbolic Software report can be read here).

The anatomy of the vulnerability

While working on last year’s investigation, IStories conducted an experiment: we asked people in various countries to send messages to each other via Telegram and record the network traffic using specialized software.

We then shared the results with cybersecurity experts, who discovered that during data transmission, the app sends an unencrypted header containing a unique device identifier: auth_key_id. Armed with this identifier, anyone with access to Telegram’s traffic can track users, analyze their online activity, and map their communication networks.

Symbolic Software experts reached the same conclusion:

“Our analysis confirms the core technical findings: Telegram clients <...> transmit messages over unencrypted TCP connections, exposing the auth_key_id in cleartext (or trivially obfuscated form) to any network intermediary. The auth_key_id functions as a persistent device identifier that remains constant across sessions, IP address changes, network switches, and geographic locations. This creates a technical capability for device tracking by any entity with passive network access, including Internet Service Provider (ISP)s, network administrators, government surveillance programs, and other adversaries positioned along the communication path.”

“All of these adversaries,” the review continues, “can collect auth_key_id values through entirely passive observation. No man-in-the-middle attack is required, no certificate compromise is necessary, and no active protocol manipulation is needed. Simple packet capture and trivial deobfuscation suffice to extract persistent device identifiers from Telegram traffic.

The persistence of auth_key_id values across sessions, network changes, and extended time periods enables long-term tracking of individual devices. An adversary who collects auth_key_id values from network traffic can build a comprehensive database associating specific auth_key_id values with observed network locations, timestamps, traffic patterns, and — when the user’s identity is known through other means — specific individuals.

Such a database could enable queries like: ‘Where has the device associated with auth_key_id X been observed over the past six months?’ or ‘Which auth_key_id values were present at network location Y during time period Z?’ The ability to track devices across IP address changes means that even users who employ dynamic IP addressing, regularly switch networks, or use mobile connections remain trackable through their persistent auth_key_id,” the experts emphasize.

The FSB connection and the origin of the report

This expert review is particularly valuable not only because it was conducted by an independent firm with a solid reputation in cybersecurity, but also because its initiator was apparently none other than Vladimir Vedeneev — one of the key figures in last year’s IStories investigation. In 2025, we revealed that Vedeneev had served for several years as Telegram’s chief financial officer, held power of attorney to sign documents on behalf of the company and Pavel Durov, and, moreover, maintains nearly the entirety of the app’s network infrastructure across multiple countries.

We also learned that Vedeneev’s former Russian company (he transferred ownership to a relative in 2024) services FSB operational and investigative systems used to surveil Russian citizens under a classified government contract. Most importantly, according to Vedeneev himself, he is assigned a dedicated FSB handler — a senior security service officer with whom Vedeneev has long cooperated and shared information: “I am overseen by a FSB guy, related to SORM (the System for Operative Investigative Activities, the technical specification for the targeted surveillance of telephone and Internet communications in Russia. — Ed.). He’s apparently trying to get promoted, so he tells everyone: ‘Access to Vladimir is only through me.’ He calls me and says: ‘Listen, Volodya, basically, you’ve got to somehow talk to them, to all of them [other FSB officers], and so on.’

They [the FSB officers] say: ‘So, we need this IP address at this time. Who is it?’ We understand that we can’t not answer, right? We quickly answer them. We have authorized emails from which they send requests. We quickly answer them. We say: ‘It’s Ivanov Ivan Ivanovich, apartment number 7, blah-blah-blah.’ They’re like: ‘All right, okay,’” Vedeneev told IStories in an interview.

Following the publication of the investigation, Vedeneev filed a lawsuit in Switzerland, where he resides, against the story’s lead author and IStories founder, Roman Anin. In the lawsuit, Vedeneev does not dispute the investigation’s claims; instead, he demands the removal of the interview in which he admits to cooperating with the FSB.

While reviewing the materials of the Swiss case, we discovered this very same technical review by Symbolic Software, which Vedeneev had apparently attached in hopes that the experts would refute the article’s technical findings. Instead, they confirmed them.

Global reach and the scale of the risk

“From a surveillance infrastructure perspective, ‘global’ reach depends on the extent of the adversary's network access. <...> Achieving truly global surveillance would require infrastructure access across multiple geographic regions and network paths,” the Symbolic Software review states.

Vladimir Vedeneev possesses exactly this level of access. For instance, here is what he said in an interview with IStories: “Telegram doesn’t have access to the data centers in Singapore or Miami: they’ve never been there. Four data centers have already been built. We (Vedeneev’s company GNM, which services Telegram’s network infrastructure. — Ed.) are present in all four. <...> At this point, I provide all communication channels. Not someone else — me! If I really wanted to, of course, I could capture this traffic.”

Vedeneev’s admission, coupled with the experts’ conclusions, indicates that a significant portion of Telegram’s traffic essentially flows through a single individual, and:

• this traffic contains unencrypted device identifiers that allow user tracking;
• this individual has an FSB handler with whom he has long cooperated and shared information.

In last year’s interview with IStories, Vladimir Vedeneev denied the vulnerability we described, claiming he only provides his FSB handler with information regarding Russian internet users from Russian companies, but not from Telegram. Whether this is true or not is a matter of faith.

The Symbolic Software expert notes that the vulnerability did not stem from a technical failing, but rather is the result of “a fundamental abdication of Telegram’s responsibility to protect user privacy through appropriate cryptographic measures. <...> The proper solution is <...> for Telegram to eliminate the vulnerability entirely through mandatory use of transport-layer encryption — a standard practice adopted by virtually every other major messaging platform. The technical implementation is straightforward, the performance impact negligible, and the privacy benefits substantial. Until Telegram implements proper TLS encryption, it continues to expose its users to unnecessary privacy risks,” the expert concludes.

The Symbolic Software review does not claim that malicious actors with access to Telegram traffic and device identifiers can decrypt messages. However, cybersecurity experts interviewed by IStories consider such a risk to be entirely possible.

The issue is that the auth_key_id identifier — which Telegram transmits openly over the network for some reason — is used to locate the specific user's key in the database, which the app then uses to decrypt messages on its servers. Thus, if someone like Vladimir Vedeneev or another passive traffic observer were to gain access to this database, it means they could potentially decrypt messages.

Telegram’s response

Telegram representative Remi Vaughn (whose actual existence remains unverified: there are no photos or other mentions of him online) sent the following response to the IStories editorial office: “Regarding the unpublished article, we reject its conclusions for the reasons outlined on this page.

The auth_key_id parameter changes regularly and does not reveal user information, message contents, recipients, or private data. Any observer able to see it would already have access to more reliable network-level signals for tracking. Telegram owns its infrastructure, which is configured, managed and controlled exclusively by Telegram’s internal engineering teams. GNM is a respected global infrastructure provider, and neither GNM nor its owner Mr. Vedeneev is connected to the FSB.

Since 2021, neither GNM nor any other company affiliated with Mr. Vedeneev has provided services in the Telegram data center that stores information of Russian and European citizens. This fact alone makes the entire FSB–Vedeneev conspiracy theory inconsistent with reality.”

Read on istories.media →

Five CCTV cameras are installed in front of the 1200 Guardsmen Memorial in Kaliningrad, the USSR's first monument to soldiers killed in the Great Patriotic War, 1941-1945. In the center of the memorial is the Eternal Flame. From time to time, various incidents occur near the memorial, which are then widely reported in the local news, and their perpetrators become the subjects of criminal cases. Since last year, for the "desecration of war memorials," a sentence of up to five years in prison has been provided.

Thus, in February this year, a drunken Kaliningrad resident wanted to light a cigarette from the fire and warmed his feet over the flames. In January 2026, a couple of residents stole a basket of flowers from the monument. In September 2025, another couple had sex at the memorial.

Six months before that, around 5 am on February 24, 2025, 37-year-old Kaliningrad resident Alexander Okunev burned himself alive at the memorial to 1200 Guardsmen in protest against the war — and no one found out about it.

"He was sitting in a corner, not where all the people were"

In the 2010s, Kaliningrad earned the title of the protest capital of Russia, and a series of large-scale rallies even led to the replacement of Governor Georgy Boos.

However, since the start of the full-scale war in Ukraine, the city has not exhibited any notable protest activity. In the first days of the invasion, a wave of anti-war actions swept through Kaliningrad. At one point, the city became a leader in the number of protocols issued for "discrediting" the army. But almost immediately, protests died down as they did throughout the country. Igor Luzin, a Kaliningrad activist and former employee of Navalny's local headquarters, explains that the "political field" in Kaliningrad has been cleaned up just like the rest of Russia.

Alexander Okunev was not an activist. He avoided talking politics at work (he was a sysadmin at a firm selling retail equipment), did not argue about the full-scale war with his family, and apparently was not active on social media. Okunev had almost no friends, had no girlfriend, and lived alone.

He practically did not talk to his colleagues, could ignore even his superiors: he could keep silent in response to a greeting or not answer the questions. At corporate parties, New Year's Eve, for example, he tried not to leave his office.

"Was sitting there in a corner, not where all the people ... Somehow always in himself, lived his own life," recalls his former colleague. "Closed. Strange." However, there were no complaints about his work: "His programmer's brains were cool". His colleague believes that Alexander could have made a good career, "but it feels like he didn't care much about money". When Okunev decided to quit (about six months before the incident), everyone was upset.

"We asked him, have you found another job? No. Are you going somewhere? Maybe. No one had any idea what or why he left," says his former colleague. Acquaintances call Okunev "kind, responsive, fair": "He always helped everyone". He was fond of origami, and when one of his colleagues had a birthday, he could secretly put "some flowers" on their table. Regarding his hobbies, people close to him say that he liked to watch movies and ride a bicycle.

After the dismissal, Okunev really did not find another job. "Sat at home, practically did not communicate with anyone," heard his ex-colleague.

Cleanup

Having decided on such a desperate protest act as self-immolation, Alexander Okunev did not seem to be trying to attract attention. Maybe he was afraid that someone could stop him. But he obviously chose the date (the anniversary of the Russian full-scale invasion of Ukraine) and the place (the main war memorial in the city) for a reason. Perhaps the time too: the Russian missile struck Kyiv on February 24, 2022, began just about five in the morning.

Okunev's charred corpse, despite the numerous cameras at the memorial, was discovered by a random passerby only at around 6:40 am. The snow appears to have been spray-painted with the words "No to War". Employees of the investigative department for the Leninsky district of Kaliningrad went to the scene. In the report of the events of the night, Okunev's self-immolation is mentioned along with reports of two other corpses and a ninth-grade girl who had left home.

The incident was reported to the head of the city administration, Elena Dyatlova. She immediately took everything under her control, the European intelligence officer knows. She was assisted by Evgeny Maslov, head of the local service for the protection of cultural heritage. The main thing for them was to quickly get rid of the body and the words on the snow — the officials were worried mostly that journalists would know what happened. The Minister of Culture and Tourism of the Kaliningrad Oblast, Andrey Yermak, was especially worried that the self-immolation took place near the monument of the Great Patriotic War — too symbolic.

Everything was settled by 9:15 am. Traces of the incident were removed, and authorities were relieved to report to the local governor and other local officials that no one had seen anything, the source of IStories Media said.

Information about the self-immolation of an unnamed Kaliningrad resident first went public only along with a report by Estonian intelligence in the winter of 2026: "On the third anniversary of Russia's full-scale war, at five o'clock in the morning on February 24, 2025, a man born in 1988 wrote 'No to War' in the snow near the monument to a Russian soldier in Kaliningrad and set himself on fire in protest."

None of the Kaliningrad media ever reported the news. There were no local or propaganda Telegram channels or other social media posts about Okunev. The Alexanders' family did not spread the word about the incident either. "What's the point of somehow publicizing and telling all this? What for?" one of them told reporters.

"There is another way"

An acquaintance of Okunev says that on the eve of his suicide, he behaved "absolutely normally." There was no hint of what he was going to do, and "what happened came as a shock to everyone." Okunev's relatives speak of some "expert examinations" conducted as part of the investigation, which found that "there was no outside influence" on Aexander. The family was questioned by the local Investigative Committee; the police came to Okunev's former colleagues for a "characterization," but came away with "Worked well, did not communicate with anyone."

A close friend of Okunev recounted to IStories Media the content of his suicide note: "He wrote that there is another way. Apparently, he meant a world with peace. And he didn't want to live in the world we have, so he made this decision... But we are all aware that world peace is a utopia."

The note also shows that Okunev understood that "most likely, it will not be in the news anywhere, it will not be widely covered anywhere," the source tells IStories Media.

Elena Maslova, head of the Kaliningrad administration, and Evgeny Maslov, head of the cultural heritage protection service, have not responded to journalists' requests.

Culture Minister Andrei Yermak replied that he was not familiar with the results of the investigation of this "accident", so he would not comment on anything. He expressed confidence that law enforcement agencies "will comment on the situation as soon as the investigation is finalized."

"These people are afraid not of the people, but of their superiors"

In January 1969, the self-immolation of Jan Palach, a philosophy student at Charles University, brought tens of thousands of people onto the streets and became a symbol of resistance to the Soviet occupation in Czechoslovakia. The self-immolation of street vendor Mohammed Bouazizi provoked mass protests in Tunisia, which eventually led to the resignation of the country's president.

In Russia, the self-immolations of journalist Irina Slavina and Udmurt scientist Albert Razin did not lead to any notable collective action. Could Okunev's suicide have provoked some protest if people had learned about it?

Sociologist Margarita Zavadskaya thinks not. "Self-immolation is a powerful symbolic act," she says, "but public outrage alone is not enough to trigger large-scale collective action under conditions of severe repression and limited access to information."

So why did the Russian authorities try so hard to conceal information about what happened? To prevent "protest contagion" and imitation, she explains. Moreover, such an anti-war suicide contradicts the government's theory of a universal public consensus on war. And local officials would look incapable of maintaining control in the eyes of their superiors.

Political scientist Ekaterina Shulman also does not believe that fear of further protests was behind the Kaliningrad authorities' actions. "Local authorities are not afraid of the people, not of protests. They are afraid of their superiors," she says, "they were afraid to hear: 'You oversaw, allowed a scandal, there are media publications, what do you eat your bread for?'"

"Authoritarian regimes are afraid of symbolic sparks. They understand that a single act of protest may not cause an immediate mass movement, but can become a moral symbol around which scattered anxiety and discontent begin to crystallize," says Lithuanian political scientist Nerijus Malukiavicius. "That is why such regimes seek to 'clean up' the scene, silence history, and discredit the victim."

Read on istories.media →

It appears that we are witnessing the transition of the Russian regime into a fundamentally different state. The deadlock in the war in Ukraine, painful Ukrainian drone strikes on oil infrastructure, economic and social problems — all of these factors combined, as IStories has previously written, were bound sooner or later to lead to a struggle among Russia’s “siloviki” clans for the throne of a weakening dictator.

Putin, who himself built this system of power, understands well what awaits him — hence the growing paranoia, the unprecedented isolation from the public and from his own inner circle, and the attempt to create a new oprichnina in the form of the Federal Protective Service, endowed with unlimited coercive powers.

This means that in the short-term historical perspective, Russia has two paths left:

• The Iranian path. Putin will succeed in consolidating loyal security services around himself — primarily the FSO and the National Guard — which will form a Russian analogue of Iran’s IRGC. Through unprecedented repression, which will affect broader segments of the population and those who were previously considered untouchable, the dictator will retain power by force. This scenario would also imply further isolation of the country from the internet and the outside world: the oprichnina will not tolerate any critics.

• The Time of Troubles. Historians do not like analogies, but history does not stop reproducing them. The first oprichnina emerged as an attempt by Ivan the Terrible to maintain control over the elites and strengthen autocratic rule in conditions of a prolonged and destructive war and internal crisis. The terror of the oprichnina, economic exhaustion, and devastation led to the Time of Troubles and a civil war. 

Which of these scenarios is more likely in Russia is not so important. What matters is that each of them is highly likely.

Read on istories.media →

• it is of significant public interest;
• some of the information it contains has been independently verified;
• the source who provided the document holds an official position in the government of a European country and risks their reputation and career if the document is a deliberate disinformation campaign;

Here is the text of the document.

“The Kremlin on high alert

Since the beginning of March 2026, the Kremlin and Vladimir Putin have been concerned about a leak of sensitive information and, at the same time, about the risk of a plot or coup attempt against the Russian president. In particular, he fears the use of drones for a possible assassination attempt by members of the Russian political elite.

Strengthening security measures around the Russian president

In response, the Federal Protective Service (FSO), whose primary mission is to ensure the physical protection of the highest officials of the Russian state, has significantly tightened security measures around Vladimir Putin:

• Visitors to the Presidential Administration undergo two levels of screening, including a full body search by FSO officers.
• The FSO has significantly reduced the list of locations regularly visited by the president; neither he nor his family visit their usual residences in the Moscow region and Valdai anymore.
• Since the beginning of the war in Ukraine, Putin has often taken refuge in renovated bunkers, particularly in the Krasnodar region, where he may work for weeks, while Russian media continue public communication using pre-recorded footage.
• No visits to military infrastructure have been organized this year, in contrast to frequent trips in 2025.
• Communication networks in certain districts of Moscow are periodically shut down.
• FSO officers conduct large-scale checks using canine units and are also deployed along the Moscow River, ready to respond to possible drone attacks.
• The FSO now controls and approves any informational or media publication involving the president, relying on a secret presidential decree (apparently referring to announcements of Putin’s trips and participation in various events — Ed.)
• Personnel working near Putin are now prohibited from using mobile phones; they must use devices without internet access.
• These employees are also banned from using public transportation and move exclusively using FSO transport; surveillance systems have been installed in the homes of cooks, photographers, and bodyguards.
• 
  

Sergei Shoigu considered a potential destabilizing actor

Sergei Shoigu, former Minister of Defense and Secretary of the Security Council of the Russian Federation since May 2024, who retains significant influence within the military command, is associated with the risk of a coup attempt.

The arrest of his former first deputy, Ruslan Tsalikov, on March 5, 2026, is seen as a violation of informal guarantees of safety for elites, weakening Shoigu’s position and increasing the likelihood that he himself may face criminal prosecution.

Rising tensions among security structures

The issue of the physical security of senior Russian Armed Forces officers has led to increased tensions among representatives of Russia’s security agencies.

After the killing of Lieutenant General Fanil Sarvarov in Moscow on December 22, 2025, Chief of the General Staff Valery Gerasimov proposed that Vladimir Putin convene a meeting of the permanent members of the Security Council to discuss the situation. However, Putin chose to hold a smaller meeting on December 25, 2025, the day after another attack on Russian security officials at the same location as the killing of Sarvarov.

During the meeting, representatives of the security agencies, the so-called “siloviki,” blamed one another for shortcomings in the security system revealed by Ukrainian attacks. Emphasizing that these attacks cause fear and disorganization within the ranks of the Russian Armed Forces, Valery Gerasimov sharply criticized his colleagues from the intelligence services for failing to anticipate them. The Chief of the General Staff also complained about a lack of personnel for the physical protection of officers in rear areas and drew the president’s attention to this issue.

The Director of the Federal Security Service, Alexander Bortnikov, in turn, defended himself by stressing the impossibility of systematically preventing such attacks. He criticized the Ministry of Defense for lacking a specialized unit responsible for the physical protection of top officials — similar to those in other security agencies.

The head of the National Guard, Viktor Zolotov, in turn, noted that the resources at his disposal cannot be allocated to protect officers of the Ministry of Defense. He also addressed operational security recommendations to Gerasimov for Ministry of Defense officers, which provoked the Chief of the General Staff’s anger.

At the end of this tense meeting, Vladimir Putin called for calm, proposing to change the format of the discussion. He instructed participants to submit their proposals for resolving the issues discussed within a week.

Expansion of security measures for ten senior Russian generals

After the meeting, Vladimir Putin met with Federal Protective Service Director Dmitry Kochnev, whose primary task is to ensure the physical security of top state officials. It was decided to amend the internal regulations of the FSO by expanding the list of individuals under its enhanced protection.

Previously, such protection applied only to Valery Gerasimov. Now it has been extended to ten senior generals, including three deputy chiefs of the General Staff. Vladimir Putin’s decision, made at the request of the General Staff, demonstrates the political weight of Valery Gerasimov, who succeeded in this “arbitration,” while other security agencies have so far failed to expand the FSO’s mandate in their interests.

List of generals placed under FSO protection:

• Colonel General Nikolai Bogdanovsky, First Deputy Chief of the General Staff;
• Colonel General Sergey Istrakov, Deputy Chief of the General Staff;
• Colonel General Alexey Kim, Deputy Chief of the General Staff;
• Colonel General Sergey Rudskoy, Head of the Main Operational Directorate of the General Staff;
• Colonel General Viktor Poznikhir, First Deputy Head of the Main Operational Directorate of the General Staff;
• Lieutenant General Stanislav Gadzhimagomedov, Head of the National Defense Management Center (NDMC RF);
• Admiral Igor Kostyukov, Head of the Main Intelligence Directorate (GRU);
• Colonel General Vladimir Zarudnitsky, Head of the Military Academy of the General Staff;
• Colonel General Alexander Chaiko;
• Colonel General Mikhail Mizintsev.”

What is independently confirmed

Some of the information in this report is confirmed by independent sources. For example, that the large-scale internet shutdowns in Moscow are carried out by the FSO rather than the FSB, as reported by some media outlets, had been told to IStories a month earlier by a former FSB officer. However, we did not publish this at the time because we could not find a second source to confirm it. Now the same claim appears in the European intelligence report.

Several sources of IStories also confirm the increased fear of Putin over a plot or coup attempt. This is evidenced not only by heightened security measures around the Kremlin and other locations visited by the Russian president, but also by some indirect signs.

For example, a current FSB officer told IStories that it has become much more difficult for his unit to obtain authorization for wiretapping in non-political criminal cases because “all equipment has been redirected to monitor the government and other state bodies.”

The extreme level of Putin’s fear of an assassination attempt or conspiracy is also indirectly indicated by the fact that this year not a single deputy of the State Duma received an invitation to the Victory Day parade on Red Square.

Why this report is one of the most important recent stories about Russia — read in an opinion by IStories founder Roman Anin.

Read on istories.media →

Roskomnadzor is demanding that the companies immediately inform IStories “about the need for the prompt removal of information distributed in violation of the law” and remove the app from their stores if the demands are not met. It is unclear exactly what information we are supposed to delete. In its letters, Roskomnadzor accuses the IStories mobile app of “destabilizing the socio-political situation in the Russian Federation” and spreading “fakes.”

We launched our mobile app in February 2026 to share important news, research, and investigations despite widespread censorship and restrictions. It works in Russia without VPN.

Read on istories.media →

Zelenskyy did not specify what exactly could be the goal of this process, but there are two main scenarios:

• Either the Belarusian army itself joins Russia in the aggression and invades Ukraine;
• Or, just like it was in 2022, Belarus provides the Russian army with a foothold for invading Ukraine from the north.

IStories have requested experts to comment on how probable each scenario is. 

Military construction at the borderlands and its relevance

Soon after Zelenskyy’s statement, eRadar, a Ukrainian war analytics Telegram channel, published some of the satellite images taken in March in the border regions of Belarus. As reported by the channel, the pictures show a new border post, a military town, a training ground, a dam and an embankment to move military vehicles being built there. “It seems Belarus has indeed been tasked by Russia to keep our forces on alert ahead of their spring-summer offensive in the east and south,” Andriy Kovalenko, head of Ukraine’s Center for Countering Disinformation, commented.

However, there has been no observed buildup of Belarusian or Russian troops near the border, Andriy Demchenko, Ukraine’s State Border Guard Service spokesperson, said on Monday. “As part of their information campaign, they (the Belarusians — Ed.) previously announced the creation of a Southern Operational Command — specifically along the border with Ukraine. The positions, training grounds, and access roads might be established within this framework,” Demchenko explained.

Conflict Intelligence Team (CIT) (an OSINT project specialized in investigations into the activities of Russian Armed Forces — Ed.) suggests that the construction works are routine military activity and do not indicate preparations for a ground invasion of Ukraine. A source within CIT asked to remain anonymous comments, “we are not seeing artillery positions being set up or military vehicles concentrated.”

In recent years, Belarus has had little direct involvement in hostilities against Ukraine. The most recent known case involves repeaters used to control attack drones located on Belarusian territory.

In late December, Zelenskyy reported that antennas had been installed in Belarus near the Ukrainian border, some of them on the roofs of apartment buildings, which Russians were using to control drones attacking western regions of Ukraine. Two months later, Ukrainian Defense Minister Mykhailo Fedorov reported that a mesh network used to control the attacking UAVs in the north of Ukraine has been destroyed. Fedorov’s advisor, Serhii Beskrestnov, explained that there had been several locations in Belarus from which the drones would receive a signal they then retransmitted and amplified to one another (this is what constitutes a mesh network). The Ukrainian military did not specify how the Belarusian repeaters were destroyed. Since then, there have been no reports of their use.

Otherwise, Belarus’s military assistance to Russia can be described as less direct: it is wounded Russian soldiers' treatment and rehabilitation, military equipment parts production, combat helicopter maintenance, weapon parts supply chains that allow Russians circumvent the sanctions, etc.

May the Belarusian army join the fight itself?

“We estimate the prospect of the Belarusian Armed Forces joining the war as highly improbable,” the CIT expert says. He mentioned several reasons.

Belarusian army capabilities. According to Belarusian dictator Alexander Lukashenko, there are currently 70,000 active-duty soldiers. The total is around 100,000 if the Internal Troops of the Ministry of Internal Affairs and certain other units are included. However, analysts’ estimates are more modest. According to the Global Military project, there are about 45,000 troops in the Belarusian army, while Latvian intelligence puts the figure at approximately 50,000. Taking civilian staff into account, the 70,000 figure cited by Lukashenko is quite realistic. At the same time, Russia has about 700,000 personnel “in the special military operation zone,” as Vladimir Putin claimed in December.

The combat readiness of the Belarusian army is also questionable. “It’s important to understand that the number of truly combat-ready units is measured in the thousands,” explains the CIT analyst. According to him, without a mobilization — which CIT considers impossible to happen — the Belarusian army will be unable to influence the course of hostilities in any way.

Lukashenko says that “in the event of war” and mobilization, he could expand the army to 500,000 troops. The opposition United Transitional Cabinet of Belarus believes that the army could be expanded to 140,000–200,000 troops at best through mobilization, and that number would include the Internal Troops of the Ministry of Internal Affairs. “Half a million, it seems to me, is just a mantra used for self-reassurance, or perhaps for intimidating neighbors,” says Vadzim Kabanchuk, representative of the defence committee within the Belarusian opposition. Besides, it would have to be figured out how to equip, accommodate, and train such a large number of recruits.

In terms of weapons and military equipment, Belarus has little to offer the Russian army. Most of its arsenal was inherited from the Soviet Union. During the war, these stocks may have been depleted: there is evidence of mothballed equipment having been transferred from Belarus to the Russia-occupied territories of Ukraine. At the start of the war, the Belarusian prime minister acknowledged that in Russia there was demand for weapons from Belarus.

The main achievement of the Belarusian defense industry since the end of the Soviet era is considered to be the Polonez multiple-launch rocket system, capable of hitting targets at a distance of up to 300 km. However the Belarusian army has few Polonez systems (estimated at six units as of 2022). Secondly, the Russian army possesses some significantly more powerful and longer-range weapons, such as the Iskander systems.

Ukraine’s preparedness. “If we were to go to war against Ukraine today, it would be pointless. Their border with Belarus is so heavily fortified that it’s impossible to approach it,” Belarus President Lukashenko said two years ago. According to Lukashenko, the Ukrainian Armed Forces have about 120,000 troops stationed along the Belarus border. However, the Belarusian Border Committee estimates the number of Ukrainian troops at the border as only 15,000.

Ukrainians, understandably, do not disclose the number of their troops at the border, but regularly report on new fortifications being built along the border.

Another significant factor is Ukraine’s ability to monitor troop and equipment movements. If the Belarusian army does begin to redeploy its units to the border, the Ukrainian Armed Forces will have the opportunity to send their own units there in advance and set up a "drone wall” Ukrainians used in 2026 to successfully slow down the Russian army’s advance.

Belarusian people oppose taking part in the war. The army likely does as well. Recent polls (in October and November) show that the majority of Belarusians don’t support the Russian invasion of Ukraine. At the same time, a significant proportion (34–39%) chose not to answer the question. As for ending the war, more than 60% of respondents support an immediate ceasefire and negotiations.

The military isn’t eager to go to war either, according to the Belarusian opposition estimates. “The soldiers themselves lack the motivation — they need to be explained why they should invade and occupy a foreign country. There is no political ideology for that,” activist Ilya Dobrotvor, says. “In 2022, when the full-scale war began, it was the hesitation within the Belarusian army that effectively prevented Lukashenko from issuing an order for them to enter [Ukrainian territory] alongside the Russians,” Vadzim Kabanchuk from the United Transitional Cabinet says.

“Overall, Lukashenko is well aware that dragging Belarus into the war against Ukraine — let alone the hostilities on Belarus territory — would practically be a death sentence for him. Because there is public consensus on the idea he himself has been selling the idea to Belarusians in recent years : ‘I have ensured you peace, you are not fighting,’” Artsiom Brukhan, speaker of the Belarusian opposition Coordination Council, says.

Is Russia going to attack Ukraine from Belarus?

If Russians decide to attack Ukraine from Belarus using their own army like they did in 2022, they won't be able to expect to break through to the outskirts of Kyiv again. In 2026, the plausible objectives of another invasion from Belarus could be to stretch the front line and draw Ukrainian forces away from other sectors.

However, the Russian army currently significantly lacks the required resources, says the anonymous CIT analyst. “Such an operation would require at least several combined-arms armies. But then they would have to be withdrawn from the current front line, seriously weakening certain sectors,” the expert says. As of now, CIT has not detected Russian units being deployed to Belarus.

The State Border Service of Ukraine believes that Russia currently has no forces in Belarus that would be capable of carrying out a second invasion. 

However, Ukrainians do not rule out Russian provocations aimed at distracting Ukrainian forces units from other parts of the front. CIT believes that the Russian Armed Forces are already attempting to stretch the front by creating a “buffer zone” in the Sumy and Kharkiv regions. So far it has not been very successful, says the CIT expert: the Ukrainian Armed Forces withdrawing from border villages block the Russians’ advance deeper into the country. Moreover, the Ukrainians manage to do this without deploying reinforcements — mainly by the forces of territorial defense brigades.

Why is the threat from Belarus discussed now?

Zelensky has pointed out Russia’s attempts to make Belarus a bigger threat many times throughout the war. Here are the reasons why the President might be mentioning this possibility now, according to Anton Naumluck, a Russian journalist who had worked in Ukraine for many years and founded the Graty magazine.

“We cannot dismiss the possibility of Ukrainian intelligence learning that the Belarusian government is actually planning to take a bigger part in the war,” Naumluck says. “No matter what’s being said about Belarusians opposing the war, Lukashenko might simply decide that the people will tolerate any decision.”

On the other hand, the journalist thinks, “if the Office of the President of Ukraine is already thinking about the future electoral campaign, the threat of a new invasion might make people come to terms with such internal problems as forced mobilization or corruption.”

Another plausible explanation for speaking about the possible threat is Zelenskyy’s team “trying to strengthen the dialogue with the Belarusian opposition [Sviatlana Tsikhanouskaya and her Office],” Naumluck says.

Read on istories.media →

The association members requested a legal, prosecutorial, and antitrust examination of the initiatives as well as postponing their adoption and investigating the Ministry of Digital Development’s activities to ensure the anti-corruption legislation compliance.

The initiatives

Last week, it was reported that the Ministry of Digital Development is discussing toughening the licensing rules for Russian Internet providers. Essentially, this will result in a total elimination of small and medium-sized providers. As a result, only the state-controlled telecom companies will remain on the market.

The ministry wants to introduce three new types of licenses, with a cost ranging from 1 to 50 million rubles (from $13,000 to $665,000 approx.), which will not be issued to individual entrepreneurs.

The Ministry of Digital Development also wants to start revoking the providers’ licenses for repeated “major violations” and to introduce a 10-year ban on licensing the beneficiaries of the offending companies.

In addition, a minimum amount requirement for the providers' authorized capital will be established, ranging from 5 to 100 million rubles (depending on the type of license).

The Ministry of Digital Development stated that the proposals “have been received positively by the industry.” According to officials, their goal is to ensure that only the “reliable operators” remain as well as "to guarantee effective compliance with the law".

Earlier, the digital development minister Maksut Shadayev had claimed regional Internet providers were failing to comply with the obligatory installation of the TPSU tools (traffic filtering tools used by Roskomnadzor, Russia’s executive body responsible for censoring media, telecommunications, and internet content — Ed.) and the SORM system (interception interfaces used for surveillance — Ed.).

As part of this reform, the Ministry of Digital Development also plans to lift the moratorium on telcos inspections, which was set to last until 2030, RBC Russia reported. The sources explained that the moratorium is making it hard for authorities to verify whether the companies have installed the SORM system.

The companies reaction

The AMOR association has demanded that the Ministry of Digital Development be tasked with developing alternative mechanisms for modernizing the telecommunications sector which “would enable the government to achieve its objectives without destroying small and regional telecom businesses,” and has requested that its representatives be included in the process.

Not only will the reforms hinder the operations of small and regional telecom businesses, but will make them impossible, AMOR claims.

Consequences: from unemployment to price growth

According to the AMOR letter, the total number of employees of all the Russian telecom companies whose annual revenue amounts to 50 million rubles ($665,000 approx) and below is 15,200 people. The companies generating 50 to 500 million rubles ($665,000 and $7 million approx.) in revenue employ 21,800 people in the country. Therefore, tens of thousands of telecom industry employees might suddenly find themselves out of work.

Other consequences will include Internet cost growth. It is difficult to say precisely how much the prices will change, the telco sources interviewed by IStories say.

“I think the costs could change dramatically, even outrageously, since there won’t be any competition even in the long run,” says one of the Moscow oblast providers' owners.

In addition, the Ministry of Digital Development’s proposal could potentially leave some people without Internet at all, because major players haven’t entered some areas due to unprofitability, AMOR points out.

“The regional and municipal providers will suffer the most, especially those operating in the private housing areas and places where the requirements tied to the coverage rate of apartment buildings are basically impossible to meet,” the statement says.

This will cause the providers who have historically ensured Internet access in remote villages, hard-to-reach areas, and rural communities to quit , the association asserts. 

“The simultaneous layoff of tens of thousands of workers, the price growth and declining service quality will inevitably lead to increased social tension at the time when stability is the absolute priority for the state,” AMOR notes.

In addition, the reforms will negatively impact equipment suppliers and manufacturers, television service providers and broadcasters as well as software developers for billing, video surveillance and intercom systems, and so on. 

“Less independent providers means less customers, deployments and growth opportunities for the entire ecosystem. This means less orders, investments, and jobs far beyond the telecommunications industry. Additionally, it will lower the demand for Russian hardware and software,” the letter reads.

An AMOR source interviewed by IStories considers there is no ground for claiming that the independent providers are ignoring the requirements regarding the SORM and TSPU systems.

He notes that the FSB (Russian Federal Security Service — Ed.) frequently imposes massive fines on the non-compliant providers, including the numerous subsidiaries of major providers. A Leningrad oblast provider owner IStories have spoken to also confirms that the regulations are strict.

“It’s practically impossible to avoid setting the TSPU, and doing so would be very risky. They monitor it very closely and have everything they need to verify our compliance,” he asserts. 

The state Internet

AMOR states that the reforms are being pursued in the interests of the five biggest internet providers in the country (Rostelecom, VimpelCom, ER-Telecom, MTS, and MegaFon). These changes essentially create an oligopoly, when the whole industry is completely controlled by just a few companies.

“We believe that the motivation behind this reform does not reflect the interests of the industry or the country as a whole, but rather serves the interests of a very limited circle of large commercial entities,” the statement reads.

The Leningrad oblast provider owner agrees.

“None of the companies had ever doubted that the consolidation would happen. It’s just a matter of time and approach – whether they’ll buy us or just take the business. My view is that they’ll buy the medium-sized ones and simply press the small ones. We live in a capitalist system, where the big ones feed on the small ones. The only question is how civilized is our capitalism,” he says.

According to his predictions, the complete takeover of the small and medium providers will occur within three years, as the big players won’t be able to secure the services for all the clients at once. 

The consequences for Russian cybersecurity

The provider owners IStories have spoken to have admitted that telecom consolidation has taken place in many countries around the world a long time ago. However, they say that the unique situation in Russia makes the country’s entire network more resilient to cyberattacks and external threats.

According to them, the larger the number of independent providers, data transmission routes, and network control centers in Russia is, the easier it is to cope with the consequences of any crash, error, or attack, and the lower the importance of each single point of failure is to the system.

“The decentralized architecture of the Russian Internet segment is its fundamental advantage from a security standpoint. [...] Concentrating infrastructure management in the hands of five providers will sharply increase our vulnerability to DDoS attacks and targeted cyberattacks by unfriendly countries (Russia officially maintains a so-called "Unfriendly countries" list — Ed.). For a country with a vast territory and widely distributed infrastructure, decentralization is a factor of resilience, not a development obstacle,” the AMOR statement reads.

Read on istories.media →

Dubron is a former military who served in the US and in Israel. He described the differences he saw between the recruiting process in Russia and Ukraine — and between the two countries at war in general.

— As a citizen of the US, why did you choose the Russian invasion of Ukraine as the subject matter of the book? 

— First, I studied history. I do think that it is the most historically important thing to happen in the 21st century. I believe it destroys the world order that was established post 1946-1947, with the UN agreeing that we don't invade countries and we solve our problems through mediation or legal means. I do understand that people have broken that, but we've generally kept to that. And I think that the breaking of that is an extremely historical event, and I wanted to write about that as a historian. 

Number two, I would say that I was in a unique position because I did serve in the Israeli military, and in the Israel military, we have a lot of Ukrainians and a lot of Russians. So I actually did know people who were on both sides. And that's where the idea of the book came in, just telling what the normal person goes through. Yes. Don't get me wrong. I'm not defending the criminal soldiers that they (the Russians — Ed.) have, but I am saying that there are normal people who are forced to be there and it sucks. And the Ukrainians, on their side, you have normal people who just want to go home. And I can sympathize with that level of soldiering as a soldier.

I tried to approach writing a modern book in a historical context, and then I realized that the tragedy and suffering that is going on would not be told well in a non-fiction book. I realized that I wanted to tell a more personalized story about the war and be able to relate it more to Americans.

— How did you collect the information to write the part of the book telling the russian soldier story?

— 2022 was when I came up with the idea for the book and research. But what I wanted when I wrote the book — and I said that it's based on true stories — I didn't want to just be some idiot who just made up stories, or watched a YouTube video and said, “Okay, cool. I know exactly what's going on here guys”. No. I wanted to go there.

Because I have two passports and because I have friends from both sides, I was able to go in with an Israeli passport into Russia, use the American one to get around in case that gets flagged or in trouble, and then get out with an Israel passport. 

I already had the title, “the Volunteers”. The important part is volunteering, so I went to the recruitment center to look around. So, I went for a day. 

— What did you see in the Moscow recruitment center?

It's almost like an assembly line, and my book talks about it. You go in, you sit down, you talk. You get asked one question — “why do you want to be here?” Uh, money. Oh, okay. Cool. Goodbye. Next. 

If you replaced everything there with AI, nothing would change. They don't care. There's four or five guys sitting there, and there's a line up the door of people. 

Unfortunately, when you're an American there, everyone asks you what you think. So I had to keep it very, very pro-Russian. I don't want to end up like many Americans who've been arrested, including two or three former American Marines, anything like that. I always give the party line answer.

Their physical (checkup — Ed.) is… I didn't even realize I took a physical. I just talked to somebody and walked out.

They don't really check skills and things like this. The Americans or the Ukrainians will be like, oh, you're a programmer. OK, we can put you somewhere and use your skill sets. Whereas from what I saw, it seemed like they (Russians — Ed.) really didn't care at all. They just were like: oh, a person, cool.

[When it turned out it was time to sign the contract] I just said, “Oh, I didn't know it would be today. I want to go see the beauty of Russia. See you later. I'll come back”. And they were cool with that. They have so many people there. It's not even a concern for them.

Me being an American, they would never stop me from leaving. I just knew that. I don't think they'd cause an international incident this week. So I'll be OK.

I stayed for a little bit longer to arrange the interview. I really wanted to interview someone who was on the front. So my friend, who I met through my Israeli contacts, was able to set up the meeting with someone who was there (Dubron opted not to reveal the interviewee's name — Ed.)

Also I was able to arrange the interview with a person who lost a very close family member. And so I was able to ask them, why did they join? Were they some person who wants the Russian Empire back? Are they a person who is patriotic? Are they a person who was avoiding criminal (responsibility — Ed.)? And then they said, money. And that's where the character of my book came, with the money (as a motivation — Ed.)

— Why did you decide to go to the recruitment center if you had no intention to fight? 

I wanted to get something so that I could say “this is true”. I didn't want to just say that, I wanted to use some primary sources, going back to my historical training. I wanted to either be my primary source or talk to someone who was there. 

And the gentleman who I talked to, who was on the front, did not join through a recruiting center. He was a member of one of the, I would say PMCs, and then he ended up in the army when they switched over. 

— What surprised you the most in the Russian recruiting center? 

I was very surprised to see that it was a one stop shop. You just walk in and then that day they were leaving. I don't know if they do background checks. This is crazy! 

I served in the IDF. There is rubber stamping that happens where it's like, “Yeah, he's good, we swear”. But it's at least even then they go through the pretense. 

Even in what the Russians call elite units, which is VDV and the Morskaya Pekhota, they don't get that much training. From a direct source from someone who was there, their training was four to six weeks. (Russian BBC Service has also reported that the paratrooper training during the war has been taking just a couple of weeks — meanwhile before the war it would take 6 to 12 months to do the just basic training — Ed.).

In an elite unit in Israel you'd be training for 8 to 12 months before you're even allowed to take the training wheels off and go for a walk, whereas in the American military the fastest pipeline for a special operations soldier is still a year. 

But it may have changed again, it's been two years. But in 2024, they were doing a counter-offensive, so it must have been pretty manpower-heavy comparatively.

— Why do some foreigners — Americans included — decide to go to war on Russia’s side? 

— That's, actually — I wouldn't say “common — but it's a thing. Number one is Russian women, most likely, is where they go. Guys like girls, and that's a story as old as time. 

Number two, I would say, in their case, it would be... I can't speak for everyone else, but I would say veterans would probably feel a little betrayed after the collapse of Afghanistan and things like that. And they probably feel betrayed that certain social ideologies were being pushed in the US military.

And Russia claims to be this bastion of strong Christian nation, but what they portray themselves as and what they really are is a different world. And they're sending their guys to go die on the front when they have a huge demographic crisis. But I would say that this right-wing Christian nation ideology attracts a lot of, I would say, very disenfranchised Americans and Westerners. 

And I would say, people still, especially in the West, associate Russia with communism, being the successor state of the Soviet Union. So, it could attract the left-wing, too. 

— In your book, another part of the story is that of an American fighting for Ukraine. How did you collect the information for this part?

— After a month in Russia, I went back to the United States. I — again through contacts — arranged meetings in Ukraine. I went to Lviv and Kyiv. 

I went to the recruiting place in Kyiv in the old city hall. They gave me the number for the International Legion over regular brigades, as I am an American. 

What I noticed in Ukraine is that they care a lot more about skills. The difference is I saw the Ukrainians taking their time a little more with recruits. When I was there, they were talking to them, which is something that I know is shocking compared to the Russian side of the house, but they wanted to know a little bit more about you. Maybe, I can't say for certain, to place you where you may be the best for the Ukrainian military.

I would also say that the Ukrainian (recruiting office — Ed.) was a lot more upbeat. The Russian office looked like it was quite possibly the most depressing place I've ever been, and that includes a morgue. Everyone there was kind of in a bad mood.

— What else is different about the recruiting process in the two countries?

 From what I saw: (in Ukraine — Ed.) the people who joined got to choose. If you join and want to go to the 12th assault brigade or something like that, “Okay, cool. We're gonna send you there”. Oh, 95th air mobile. “Okay, cool”. 

I also feel that the Ukrainian one takes more time. It took four to six weeks for the Americans I interviewed, and they were actually angry about it. I met an American who came over and was ready to go fight for Ukraine. He walks in. They're like, “we'll call you”. And he never got a call for six weeks. He said he almost lost all his money.

Ukraine most likely wants to make sure the volunteer is not wanted by Interpol or something like this. (The official website of the International Legion for the Defence of Ukraine states that an application is reviewed by the Legion and the corresponding unit for 4 to 6 weeks — Ed.)

— How would you describe the mood in the two countries? 

They were very different.

The mood in Moscow was very serious (as of the beginning of 2024 — Ed.). There's propaganda posters everywhere for what they call a special military operation. They never use the term (war — Ed.), ever. I find it hilarious that you'll be talking to someone there and you'll like, “war”, and they'll be like, no, “call it whatever you want”. What do you want to call it, dude? It's a war. 

In Kyiv, people were still friendly. I accidentally walked into someone's home instead of a cafe and was like, I'm so sorry, I'm walking out. And they're like, “No no no, stay for tea!”.

And I would say that the narratives portrayed in the West on both sides are incorrect, from what I saw.

There was this narrative that “Ukraine is breaking”, but I didn't see that in 2024. I saw a very determined group of people. And that's impressive. The narrative also is that “Russia is breaking” and I don't see that either. In Russia, I just see people who are tired. And I'd say they are also tired in Kyiv, but there's hope. In Russia, it's just tiredness. I would say that's the big difference. 

— What's the motivation difference between the volunteers fighting for Russia and Ukraine you wrote about in the book?

Russians’ motivations are generally money. And unfortunately, from the start of the war, I think the true believers (among the volunteers — Ed.) on both sides are mostly gone — unfortunately, because they have fought bravely. Ukrainians are still getting high quality foreign volunteers, but the foreign volunteers don't come for money on the Ukrainian side. They come for their friends already there. They come because they want to help. They come because they're professionals and they say, “I believe in this. This is a true fight where I get to help”. And that's what I wrote about. 

But I wasn't trying to make the Russians characters. I wasn't trying to make Ukrainian characters. I was trying to make them as real as possible. 

The American was there for ideals. When people died, it was a little more hurtful, that kind of impact. The Russian was forced there for money. 

But you have to remember they are people. The second you start degrading your enemy as a caricature, or the second you start degrading your enemy as just evil, without understanding, you're not going to do well.

I think telling it from a humanistic perspective is able to, again, give that quality to the average Ukrainian soldier. If you keep saying, oh, these Russian soldiers suck, I think that takes away from some of the Ukrainian soldiers who've been fighting these guys for four years. When the Russians make gains, what does that say about you guys? That's really not fair. That's wrong. So you need to say, OK, yes, your average soldier quality goes to Ukraine. But the Russians still have combat-capable, decent units that are pushing, and actually sometimes getting repulsed (by Ukrainians — Ed.), which is beyond impressive for someone who's been fighting. 

I'm not trying to say anything other than war is hell, it sucks that people are there. It's just all of it is a tragedy on a level that is incomprehensible.

My family is a military family and I would say the majority of them are pretty anti-war overall. Going to wars, you have to brainwash 18 year old kids. “Go have fun”. But that's because you're drilled in your head. 

You can have guys who fought in a lot of elite units: Israel, America, Ukraine. And they did all the “cool things”, and they come back, and you ask them — “was it worth not seeing your family?” — and they will almost always say “no.”

Read on istories.media →

Sergei Magnitsky was an auditor at Hermitage Capital, who uncovered a 2007 scheme of a 5.4 billion rubles’ ($230 million approx. according to the exchange rates of 2007) embezzlement from the Russian federal budget. The funds obtained through illegal income tax refunds would be transferred to accounts at Universal Savings Bank owned by Klyuev. The money was then transferred abroad through a complex network of shell companies, with some of it ending up in Klyuev’s offshore accounts. After giving his testimony, Magnitsky himself was arrested and sent to a pretrial detention center. There, he died after being beaten and denied medical care. 

After reviewing the evidence gathered in the Magnitsky case, French prosecutors concluded that Klyuev was the mastermind behind the tax fraud scheme.

The money laundering charges are based on Klyuev’s bank accounts spendings. As French investigators discovered, between April 2008 and October 2012 Klyuev used his Cyprus bank accounts to spend over €2 million in France on luxury brand clothing, jewelry, art, and traveling. More than 127,000 euros were spent on paying for a vacation for Dmitry Savelyev, a then-Senator of the Russian State Duma, and his guests at the Courchevel ski resort in France, according to the transactions and invoices available to IStories.

In March 2025, Klyuev was placed on the international wanted list, according to the documents from the French prosecutor’s office (at the disposal of IStories). As the prosecutor’s office notes, Klyuev is likely to be residing in Russia, where he “is clearly enjoying the support of the authorities and is likely to be affiliated with organized crime.” However, Russia has been excluded from the list of countries notified of Klyuev’s arrest warrant being issued, as French law enforcement officials see no prospect of Russia extraditing him.

In Russia, Klyuev owns the Quorum Debt Management Group law firm—a partner of the Russian Deposit Insurance Agency in recovering assets from troubled banks. The Quorum group was founded by Andrei Pavlov, a person featured on the Magnitsky List (originally list of people sanctioned for their connection to Magnitsky's detention, abuse and death in detention in 2009, which has been updated with the names of those responsible for other human rights violations and corruption — Ed.). Klyuev also owns a hunting estate in Kaluga Oblast, which, according to an IStories source, is visited by high-ranking officials at his invitation.

The complaint against Klyuev was initially filed by the Hermitage Capital Foundation. Its CEO, Bill Browder, had launched a global campaign to investigate the Magnitsky case following Magnitsky’s death. As a result, in 2014 the United States imposed sanctions against Klyuev and other individuals involved in the fraudulent scheme.

According to the indictment, the maximum penalty facing Klyuev is 10 years in prison. The prosecution considers Klyuev's regular engagement in money laundering activity to be an aggravating factor. The documents note that he was also involved in laundering the Russian budget stolen funds in Cyprus and Switzerland.

Previously, IStories reported on Klyuev having invested in a luxury resort in Cyprus in 2009 — shortly after Magnitsky had accused him of the financial fraud. In 2012 and 2013, nearly $8 million (247 million rubles approx.) were transferred from an account allegedly linked to Klyuev’s offshore entity (into which money stolen from the Russian budget had previously been funneled) to the Swiss bank account of an offshore company owned by the aforementioned Dmitry Savelyev.

“It’s very encouraging to see that after years of going after those who profited from the $230 million fraud uncovered by Sergei Magnitsky, the key perpetrator himself is now facing trial in Paris,” Bill Browder commented to IStories. “We hope that one day he will also be held accountable in Russia for what he has done to the Russian people.”

Read on istories.media →

Along a rugged, wind-swept shore in western Ireland stands Aughinish Alumina, the hulking industrial complex that is Europe's largest alumina refinery.

Inside the sprawling plant, heat and pressure are harnessed to transform bauxite — a reddish rock mined oceans away — into alumina, the main raw material needed to produce aluminum.

Strong and resistant to corrosion, aluminum is vital for manufacturing military hardware like missiles, drones, and aircraft. That’s one reason why the European Commission has called on member states to stockpile alumina as a defense against hostile powers.

Yet rather than remaining in the European Union, the majority of the Aughinish factory’s exports are shipped to Russia’s largest aluminum smelters. Those smelters, in turn, feed into a supply chain of sanctioned defense contractors whose weapons have killed thousands of civilians in Ukraine, a new investigation by OCCRP and partners has found.   

Reporters could not track the final destination of a specific batch of Aughinish’s alumina, as the powdery substance is typically mixed together with alumina from other sources in the smelting process. 

However, customs and trade data show that since 2023, more than half the Ireland-based refinery’s alumina exports have gone to smelters in Russia owned by the plant’s Russian parent company, United Company Rusal.

After processing the alumina into aluminum, the smelters have sold more than $650 million worth of the metal to a Moscow-based trader, Aluminium Sales Company (ASK), which supplies aluminum to clients that include dozens of EU-sanctioned Russian weapons manufacturers, according to leaked transaction data. (The data does not detail the volume of aluminum sold.)

Weapons made by these firms have leveled entire city blocks in Mariupol, struck a children’s hospital in Kyiv, and blown open an apartment building in western Ukraine, according to EU sanctions listings, Ukraine’s military intelligence, and the London-based Royal United Services Institute (RUSI). 

Aughinish Alumina’s exports to Russia — which have increased since the full-scale invasion of Ukraine — are entirely legal under EU trade rules. That is because despite the bloc’s recognition of alumina’s importance, no restrictions have been placed on the product’s export to Russia.

“A strategic asset”

Aughinish Alumina’s Russian parent company, Rusal, is one of the world’s largest aluminum producers, with mines, refineries, and smelters across the globe. In Russia, it is the primary supplier of aluminum for the defense, transport, construction and electrical industries. 

After Russia’s 2022 invasion of Ukraine, the EU sanctioned Rusal’s founder and former top shareholder Oleg Deripaska, a billionaire and close ally of Russian President Vladimir Putin, for his alleged involvement in companies working with the Russian defense sector. (Deripaska did not respond to reporters’ request for comment, but has mounted failed legal challenges to U.S., EU, and Australian sanctions against him.)

Rusal, however, remained untouched, sparking a debate in the Irish parliament about the company’s plant in County Limerick, which produces around a third of the EU’s alumina. 

“We appear to be protecting the Aughinish Alumina plant from sanctions,” then-MP Thomas Pringle said in April 2022. “That is hypocritical of us. If we need to protect that plant, the Government should be considering taking it over straight away and…take it out of the hands of the oligarchs.” 

The country’s then minister of state, Patrick O’Donovan, responded by saying that the plant “is not connected…to any sort of Russian empire,” and that it was a major employer and supplier of alumina to European industries.

Rusal itself had actually been briefly sanctioned back in 2018 by the U.S. for its connection to Deripaska. The move sent shockwaves through the global aluminum industry and led to a surge in aluminum prices. Not long after, the U.S. agreed to delist the company after Deripaska reduced his shares in Rusal’s parent company to a minority stake. 

From Guinea to Siberia

To trace Russia’s aluminum supply chain, reporters started at the source. Trade data shows the bauxite refined by the Aughinish factory comes from the West African country Guinea, where Rusal owns three mines. It also comes from a Rusal-owned mine in the Brazilian Amazon whose largest shareholder is the mining and commodity trading giant Glencore. (When reached for comment Glencore, which owns a 10% stake in Rusal’s parent company, said it was “unable to comment on Aughinish’s commercial decisions.”)

After arriving by bulk carrier to Irish shores, the bauxite is transformed with heat, pressure, and caustic soda into alumina at the Aughinish facility. Since the 2022 invasion — after which one of Rusal’s Ukraine-based refineries was nationalized — Aughinish has become an increasingly important alumina supplier for the Russian conglomerate.

Trade data shows that starting in 2023, the Ireland-based plant has shipped the majority of its alumina exports to Rusal smelters in Russia. The bulk has gone to two smelters in particular: the Krasnoyarsk and Sayanogorsk facilities in Siberia.

In 2024, for instance, Aughinish sent around half of all its refined alumina produced that year — worth around $400 million — to Krasnoyarsk and Sayanogorsk, accounting for nearly 40% of the alumina imported by the smelters. That year, the two smelters produced over a third of Rusal’s entire aluminum output, according to annual reports.

But that’s where the public paper trail ends, with Rusal making no public mention of supplying Russian arms manufacturers. Leaked transaction data, however, allowed reporters to follow the aluminum’s path.

From Russian smelters to Ukraine’s frontlines

The leaked transaction data obtained by reporters shows ASK paid Rusal’s trading arm more than $640 million for aluminum from the company’s smelters between the start of the full-scale invasion in February 2022 to April 2025.

(While the data does not show the exact volumes ASK sourced from each smelter, it shows the trader also paid service fees to specific smelters for loading and unloading aluminum, some 40 percent of which went to Krasnoyarsk and Sayanogorsk.)

Throughout the same time period ASK, in turn, made approximately a third of its revenue — some $337 million — selling aluminum for the purpose of Russian defense contracts.

Reporters were unable to trace alumina from Aughinish to a specific product. However, ASK’s 2024 customer list included more than 40 EU-sanctioned companies — many owned by the Russian defense conglomerate Rostec — which produce weapons including anti-aircraft missiles, rocket systems, and long-range bombers, according to sanctions listings. 

Eighteen of these companies have built arms directly used in deadly attacks in Ukraine, said Andriy Yusov, an official from the Main Directorate of Intelligence of the Ministry of Defense of Ukraine, which analyzes the debris of Russian weaponry found on Ukraine's battlefields. 

One of the trader’s biggest customers is Kamaz, a manufacturer of heavy-duty vehicles used by Russia’s armed forces in Ukraine, according to its EU sanctions listing. In 2024, Kamaz paid ASK $16 million for aluminum, the data shows. 

Another top ASK client is the U.S.- and EU-sanctioned Votkinsk Machine Building Plant, which bought $101,200 worth of aluminum from ASK in 2024.

According to EU authorities and Ukraine's military intelligence agency, the Votkinsk plant manufactures a range of armaments, including long-range missiles and the short-range Iskander ballistic missile — a weapon that reportedly killed 31 civilians in an attack in the northeastern city of Sumy in April 2025. 

Kamaz, Votkinsk, and eleven other sanctioned arms manufacturers that buy aluminum from ASK did not respond to requests to comment.

Export control issues

The EU banned imports of aluminum produced in Russia in February 2025 in an effort to sever an income stream that could be used to fund Moscow’s war. But it has not prohibited the export of alumina to Russia, despite calls from the Latvian government which argued that a ban would “weaken [Russia’s] war machine.” 

Supplies of EU-produced alumina to Russia “could undermine NATO’s stated goals of supporting Ukraine and deterring Russia,” Oleksandr V. Danylyuk, a former Ukraine defense official who is now a fellow at the think-tank RUSI, says.

Pavlo Shkurenko, a Sanctions Research Fellow at Kyiv School of Economics Institute, also warns that Europe’s “entanglement” with Russia’s metallurgical sector carries serious risks for the continent.

It enables “not only direct daily attacks on Ukrainian civilians, but also potential confrontation with Europe itself, as the development of Russian military industry suggests.”

When reached for comment, Aughinish told OCCRP that it operates “in strict compliance with all applicable European Union laws, including sanctions, export control measures and trade regulations.” The company said it had implemented “robust sanctions compliance and due diligence framework covering its entire supply chain,” though it did not respond to specific questions about whether its products might be used to build Russian weapons. 

The firm emphasized that alumina and aluminum are basic commodities serving “broad general purpose societal needs…vital for countless civilian industries.” 

Ireland’s Department of Foreign Affairs and Trade stressed that alumina is “not a sanctioned good” and “therefore its export to other countries, including Russia, is not restricted.”

A lack of data makes it “difficult to ascertain where Russia is sourcing its tools and weapons from,” a spokesperson said, adding that “Ireland remains unequivocal in its continuing support for Ukraine in light of Russia’s unjustified invasion.” 

The Russian Ministry of Defense, ASK, and Rusal and its parent company EN+ Group did not respond to reporters’ request for comment. 

Khadija Sharife, Alina Tsogoeva (OCCRP), Kaur Maran (Eesti Ekspress), Simon Goodley (The Guardian), Maksym Dudchenko (KibOrg), and Lars Bové (De Tijd) contributed reporting.

Read on istories.media →

Pozhidaeva was born and raised in Moscow in a well-off family. From an early age, Svetlana — her full name — played tennis, but ultimately chose a career in finance: she graduated from MGIMO with honors, learned English, French, Italian, and Spanish, interned at the Russian Foreign Ministry and at Lukoil, studied in France, and immediately after graduation began working as an analyst at Credit Europe Bank, later moving on to Russian investment firms.

However, in 2008, Pozhidaeva abruptly changed career paths and tried modeling: at age 24, she submitted photos to a Maxim magazine competition and unexpectedly reached the finals, she told journalists in 2018.

“My parents said: you’re crazy. When someone tells me I’m crazy, I take it as a compliment, because the worst thing for me is being told I’m boring or ordinary,” Pozhidaeva explained.

The MGIMO graduate signed her first modeling contract with the Milan-based agency Elite Models and then moved to Europe. At the same time, in the United States she was represented by MC2 Model Management, an agency founded with Epstein’s money by Jean-Luc Brunel, a close associate of the financier. Brunel was widely considered a key supplier of underage girls to Epstein’s network and was himself accused of raping minors. After Epstein’s death in 2019, Brunel was arrested in France and in 2022 was found dead in his prison cell.

Pozhidaeva’s introduction to Epstein took place in 2008: documents published by the U.S. Department of Justice include an email from Epstein’s assistant sending him Lana’s phone numbers and asking him to call the Russian model. From then on, Pozhidaeva became closely acquainted not only with Epstein but also with other influential figures in the United States. By at least 2010, she had begun helping the financier — accused of pedophilia — recruit young women in former Soviet countries.

After the U.S. Department of Justice released millions of documents from the Epstein case, Pozhidaeva drew attention from leading global media outlets. A week ago, she spoke publicly to reporters from The Wall Street Journal, saying she had been manipulated and abused by Epstein and that she recruited young women for his network against her will. She denied any ties to Russian authorities.

However, in that interview Pozhidaeva left out many details about her cooperation with Epstein, as well as aspects of her biography, which begins in Moscow’s notorious House on the Embankment — a building where many prominent Bolsheviks and security officials once lived before being sent to labor camps or executed.

Important Stories uncovered previously unreported details about Pozhidaeva’s life and explains how a woman from a family of Russian intelligence officers built a career within the sex-network of a powerful American financier.

House on the Embankment

Pozhidaeva was born and raised in Moscow in a Stalin-era apartment building near Begovaya, but part of her family has lived for generations in the House on the Embankment. The apartment there was allocated to her maternal grandfather, Colonel Marcel Platonov, a well-known Soviet military surgeon and gynecologist. Platonov worked in Kremlin and General Staff clinics and became one of the leading gynecologists of the Soviet Ministry of Defense.

Svetlana’s parents — Yuri and Irina — graduated from the Military Institute of Foreign Languages in Moscow, colloquially known as a “spy school.”

Graduates of the institute often went on to serve in the KGB’s First Chief Directorate (foreign intelligence) or in the military attaché corps, a source who served alongside interpreters from the institute in conflict zones told Important Stories. The institute was also one of the few military schools that admitted women.

Among its well-known graduates are arms trafficker Viktor Bout and Yuri Drozdov, head of the KGB’s illegal intelligence network from 1979 to 1991 and deputy head of the First Chief Directorate, who in 1962 organized the exchange of Soviet spy Rudolf Abel for U.S. pilot Francis Gary Powers.

Pozhidaeva’s father, Yuri Pozhidaev, trained as a Persian-language military interpreter and in 1978, on the eve of the Soviet invasion, was sent to Afghanistan as part of the military advisory corps. During the war, he remained in Kabul working within the office of the chief military adviser (a structure tied to the General Staff). Little is known about his later career except his rank — lieutenant colonel. It appears that both of Lana’s parents left service in the late 1990s.

As Pozhidaeva’s relationship with Epstein grew closer and her role in his network became more significant, she began introducing her relatives to her boss and his influential associates.

Her father and the FSB

In the spring of 2015, Pozhidaeva’s brother Sergey traveled to the United States. She tried to place him in companies linked to Epstein and to Sultan Ahmed bin Sulayem, the former head of the global logistics giant DP World, who was dismissed earlier this year following reports about his ties to Epstein.

In December 2015, Pozhidaeva’s parents also traveled to the U.S., as confirmed by both correspondence and Russian border-crossing records. Ahead of their visit, Epstein transferred more than $237,000 from his offshore Butterfly Trust to Lana’s account “for the family.” The parents stayed with her in New York and later moved to Epstein’s Florida residence.

After visiting the mansion, Lana’s mother wrote to Epstein:

“My son asked me: "How's the house"? I said that it's like "Great Getsby"; "No,- he said,- it's not Great Getsby , it's Great Jeffry!" So, for our family you are a Great man!’”

A few days later, Lana told Epstein that she had introduced her parents to her then-boyfriend Pen King:

“Dad shared some stories from his FSB part, Pen loved it.”

After the family became close to Epstein, Yuri Pozhidaev’s career in Russia advanced rapidly. In December 2017, the retired lieutenant colonel began working at Technopromexport (part of the Rostec holding, the main producer of the Russian arms) and frequently traveled to Tehran, where the company was building energy infrastructure.

In 2018, while continuing to receive a salary from Technopromexport, he became deputy head of security in the Iranian division of Russian Railways International, which was building the “North–South” transport corridor linking Russia, Iran, and India — a major international government project involving billions of rubles in investment.

Moreover, in 2020, while still formally employed by Russian Railways, Pozhidaev became deputy general director for security at Caspian Services, the main contractor for Russia’s Ministry of Transport on the same corridor project. He remained in that role at least until early 2026.

The types of positions Yuri Pozhidaev held in state corporations are typically reserved for security service officers — often so-called “seconded personnel” (APS) from the FSB. Orders assigning such officers to companies, banks, and ministries are signed by the FSB director; the officers receive formal positions related to security but remain in active service and report back to the agency.

Investigative journalists from the Explainer project found that in 2022 Yuri Pozhidaev sent three letters to the address at 20/2 Bolshaya Lubyanka — home to the Moscow regional FSB pension department.

A family of recruiters

Correspondence between Epstein and Pozhidaeva differs from his communication with other models from the former Soviet Union: in his emails, Epstein does not flirt with Lana, and she, unlike many others, does not appear to harbor romantic illusions about their relationship.

At the beginning of their relationship in 2009, Epstein helped Lana with visa issues and invited her to events at the United Nations and the World Economic Forum in Davos alongside Maria Drokova, a former commissar of the pro-Kremlin youth movement Nashi who later worked as Epstein’s PR agent. But within a year, Pozhidaeva began sourcing young women for Epstein from post-Soviet countries, traveling to Kyiv and Moscow and introducing her friends to him.

In several emails, Epstein expressed dissatisfaction that the women she found appeared older than he preferred. In one case, Pozhidaeva offered to arrange a meeting with a 17-year-old girl (we are not publishing the link to that file because the U.S. Department of Justice did not redact the victim’s identifying details).

Before sending women to Epstein’s island, Lana arranged for some of them to take lessons in foot massage so they “would know how to do it.”

Starting in 2016, Pozhidaeva began recruiting under the alias “Julia Santos” — the name of a character from the popular American soap opera All My Children, played by Santa Barbara star Sydney Penny, a cultural reference familiar to a child growing up in 1990s Moscow.

Investigators were able to link the alias to Pozhidaeva by cross-referencing emails from “Santos” mentioning meetings with her parents, visits from her brother, or references to her boyfriend, and matching those details with travel records and emails sent under her real name.

We found messages indicating 18 women whom Pozhidaeva, under the name Julia Santos, recruited for sex parties or meetings with Epstein. The vast majority were from Russia and Ukraine. In one case, the woman was from Odesa and had been a victim of child pornography as a teenager. In another, Epstein instructed that a trafficking victim not be allowed to keep food in the refrigerator because she “needed to lose six kilos” to spend time with him.

In May 2017, Pozhidaeva sent Epstein a photograph from a party in Barbados: a Ukrainian woman is seen standing next to “A” — likely British Prince Andrew, who in 2025 was stripped of all titles due to his ties to Epstein.

“I have heard super druggy,” Pozhidaeva wrote of her.

After her parents met Epstein, they also began offering women for his network. For example, Lana’s mother attempted to “offer” a woman from Ukraine who, in her words, was “in a really bad situation.” Her father, Lieutenant Colonel Pozhidaev, sent Epstein photos of young women without comment (in both cases, victims’ names were not redacted in DOJ documents).

Feminism funded by a sex offender

“I feel ashamed and think about those other women all the time. That’s the hardest part of all of this — I was too consumed by my own abuse to see beyond it. I had to appear happy, to keep smiling, while privately I was battling eating disorders, depression, and insomnia,” Lana said in her interview with The Wall Street Journal.

Her work was well paid: Epstein wrote that at the beginning she earned about $30,000 per year after taxes — roughly the median salary in New York at the time. From at least 2017, DOJ materials show payments to Pozhidaeva of $8,333 per month through Epstein’s Enhanced Education foundation, set up as automatic transfers.

Over the years, Lana accumulated enough money to purchase two small apartments in central Moscow.

She now claims she was a victim like the underage girls, arguing that Epstein controlled her immigration status, housing, and finances. She says she could not leave because large payments were structured as loans. Important Stories found no confirmation of this in the available files.

Epstein also supported her business ventures. He donated more than $50,000 to the Education Advance foundation she co-founded in 2017 with her boyfriend, New York venture investor Pendleton King Jr. Investigative journalists later found that the funds went to a Buddhist organization at MIT. The ultimate purpose of the project remains unclear.

Another initiative she launched with Epstein’s support was WE Talks — a platform modeled on TED Talks, aimed at bringing together ambitious women. The name stood for “Women Empowerment.”

The project was registered at Epstein’s address, funded by him, and Lana discussed its operations with him directly.

Its co-director was Viktoria Drokova, sister of Maria Drokova. Maria herself also participated.

In correspondence, Lana described how they were brainstorming ways to reshape Epstein’s public image:

“We are brainstorming with Masha how we can turn the discussion around and ask why money should not be taken for a good cause just because sth had happened 10+ years ago and that you had funded great projects and probably saved many lives. Hope this can be good.”

In 2019, Pozhidaeva and the Drokova sisters began holding WE Talks events in Moscow, but Epstein’s death disrupted their plans.

Pozhidaeva also claimed she feared retaliation if she tried to leave Epstein — not for herself, but for her family in Russia. She suggested Epstein could pressure her parents through connections in Russian leadership, including Sergey Belyakov, an FSB officer and former deputy minister of economic development.

Belyakov was indeed a long-time contact of Epstein in Russia. According to the Dossier Center, Epstein advised him on economic issues and helped bring high-profile guests to the St. Petersburg International Economic Forum, while Belyakov introduced Epstein to senior officials in Russia’s Finance Ministry and Central Bank.

According to Novaya Gazeta Europe, Belyakov helped Epstein obtain a Russian visa in 2011 via an FSB veterans’ organization. Epstein wrote that he planned to visit Moscow, but there is no evidence he did.

Pozhidaeva herself helped facilitate contacts between Epstein and Russian officials, including preparations for meetings with Finance Ministry and Central Bank representatives. In 2014, Belyakov wrote a recommendation letter supporting her U.S. visa extension.

“Snow White” and America’s power elite

Over ten years working for Epstein, Pozhidaeva gained access to some of the most powerful people in the U.S. and globally.

In 2010, paparazzi photographed her leaving Epstein’s Manhattan mansion on a day when Prince Andrew was present. She later identified herself in photos with Bill Gates and Norwegian diplomat Terje Rød-Larsen, who also stepped down from positions after his ties to Epstein became public.

Their interactions appear to have been professional, including helping organize visits and meetings.

However, her name also appears in correspondence linked to sexual encounters involving prominent individuals.

In one email exchange, Epstein requested a Snow White costume for a party.

“Brett Rattner is going to film a big movie Snow White, I would love to take photos of you in a snow white costume. You can get it from the costume store,” he wrote.

Afterward, Barclays CEO Jes Staley wrote:

“That was fun. Say hi to Snow White.”

Pozhidaeva a few hours later reported:

“the snow white was f..ed twice as soon as she put her costume.”

In the early 2010s, Pozhidaeva had a relationship with Joshua Fink, son of BlackRock founder Larry Fink — one of the most powerful figures in global finance. 

In 2012, Epstein introduced her to Elon Musk and attempted to arrange meetings in Paris, promising Musk “a lot of fun” with her.

He also tried to match her with Saudi businessman Mohammed Abdul Latif Jameel, though unsuccessfully. However, Pozhidaeva later claimed she had a sexual relationship with his son, Hassan Jameel.

After Epstein

Six months after Epstein’s death, Pozhidaeva changed her identity. Now 42, she goes by Sofia Platt and has changed her name in her Russian passport.

She continues to work from the United States. In San Francisco, she co-founded Bridge Funding Global, a fundraising platform focused on women entrepreneurs, and contributes to business publications such as Forbes.

Melinda French Gates spoke at the opening of one of her events.

Pozhidaeva says she also mentors children in foster care and invests in private credit. She describes her past work as consulting for social enterprises.

She has largely withdrawn from public view and now identifies herself as a “victim of human trafficking.”

On her website, she states:

“I have already told my story. In order to preserve my mental well-being and the integrity of this process, I will not accept further media requests or give interviews.”

She says she is currently undergoing recovery through a mental health program in the U.S. Virgin Islands — where Epstein’s island is located.

Important Stories attempted to contact Pozhidaeva-Platt and her family. Her attorney, Kyle Stroup, responded:

“Ms. Pozhidaeva declines to provide any further comment or information at this time and is not looking to engage in further interviews. Accordingly, we respectfully request that you cease contacting her or her family.”

Read on istories.media →

Warning: This text contains descriptions of murder and violence as well as profanity and ethnic slurs.

A drone-filmed video shows a battle underway, and a soldier is taking an enemy captive. The captive has a yellow armband on his sleeve, worn by the Armed Forces of Ukraine; he has raised his hands and is not resisting. Off-camera, presumedly Russian soldiers are commenting on the footage in real time. “FInish him off,” a voice can be heard on the radio. “Don’t talk to him, just fucking kill him,” says another one. The video freezes for a few seconds; the commenters are confused. The next thing we see is the captive’s body falling. “Fuck it, that’s awesome,” the soldiers cheer. 

This video was posted on the “Video *** 18+” Telegram channel (here and further on, we hide the exact names of these channels not to give them publicity — Ed.) on January 2, 2026. “Our stormtrooper beats up a pig and captures it in hand-to-hand combat, then decides it’s useless and kills it,” the video caption reads. 

The channel has almost 40 thousand subscribers. The main content is the so-called snuff: videos of Ukrainian soldiers being killed, corpses torn to pieces or burned, bodies desecrated, all titled with offensive captions such as “the pigs who tried to surrender being shot.” Sometimes the channel author even specifies the “key moments” timecodes. “For The Hague,” he comments sarcastically.

“Video *** 18+” is an anonymous channel, but IStories managed to find the founder, Vladimir Grebennikov, 36, a refractory worker at the Volgograd Aluminum Plant. In his free time, he goes fishing with his father, an Afghan War vet. On his social media page, the father often recalls his service and posts the war photos, including the dead Soviet soldiers’ bodies. 

At night, Grebennikov participates in amateur car races. His social media avatar is Russia’s imperial flag with “We are Russians — God is with us” slogan written on it. On Telegram, the name “Vova” is accompanied by a Russian national flag icon.

Refractory workers in Volgograd are paid less than 80,000 rubles (approx. USD 1,000) per month. Most likely, Grebennikov earned more by selling ads on the channel. “Video *** 18+” publishes about 30 advertising posts per week, mostly promoting other channels, or sometimes counterfeit cigarettes shops and online casinos. According to IStories' estimate based on pricing in this kind of market, the channel might be bringing its owner about 200,000 rubles (approx. USD 2,500) per month.

Grebennikov tells IStories he “has been interested in the topic of war” his entire life. “I watch these videos myself,” he said. “And I decided: if I watch them, why not create a channel and start posting them? So I started doing this, and then somehow they ended up at the top of Google and Yandex (Russian search engine – Ed.) search results. Then people started following the channel. That’s basically it. I was never going to become a blogger or anything like that.” 

Grebennikov himself hasn’t fought and does not want to: “To be a soldier, a contract soldier, to go to war, you have to be brave, at least. I’m not.”

By early 2026, he had sold his channel because he had “burned out during all that time.” When asked how much he had managed to earn from the channel, Grebennikov refused to answer. 

What are snuff videos, and where are they coming from?

Before the Russo-Ukrainian war, no other conflict in history had been documented in such detail with photos and videos. Cameras are placed on hundreds of thousands of drones, which have become an indispensable warfare tool. Russian soldiers wear cameras on their helmets to record “the evidence of their heroism and the elimination of targets,” a former soldier told IStories on an anonymous basis. And, of course, soldiers also have cameras on their phones. 

The military immediately saw the potential of such footage. For example, the “Arkhangel Spetsnaza” (translated as “Special Forces Archangel” — Ed.) Telegram channel has been providing detailed operation coverage since the beginning of the invasion, starting with the Hostomel Airport air assault on February 24. As IStories found out, the channel was created by Yevgeny Zhulidov, an officer of the 45th Airborne Troops Special Purpose Brigade. He now has over 1.1 million subscribers and might earn up to 3.8 million rubles (approx. USD 48,000) a month from advertising, based on the rates provided by his advertising manager, multiplied by the number of such posts. 

There are also channels posting nothing but snuff content: photos and videos of murders, mutilated bodies, and desecration of corpses. Execution exclusives are popular, especially when filmed from a first-person perspective. A typical ad looks like this: “GoPro recordings of khokhols (derogatory slur meaning Ukrainians — Ed.) shot in the head, the wounded finished off, and whole groups killed: here you’ll find everything others don't dare to show on their channels.” 

IStories examined more than 50 war snuff Telegram channels. Most of them are run by civilians, not military personnel. For example, Grebennikov, an aluminum plant worker, has never been to the front himself, but would find the videos and the photos online: “Sometimes I indicated the source, sometimes I didn’t.” From time to time, Grebennikov would post messages of gratitude to the subscribers, posing as a member of the military. The credulous subscribers responded by wishing “our guys” good luck. 

According to a former Russian military officer interviewed by IStories, the footage of incidents that the soldiers send to the command posts often leaks from there. “Even if the video is highly classified, there will always be someone who will leak it for money or hype.”

Such videos and photos subsequently become war crimes evidence. The UN Human Rights Monitoring Mission in Ukraine (HRMMU) has confirmed cases of executions of Ukrainian military personnel via this evidence. According to the latest report by the UN Human Rights Office, there have been no fewer than 96 executions of Ukrainian soldiers confirmed since 2022. The HRMMU told IStories they also keep an eye on the Russian snuff channels.

In just one of the channels, IStories found 51 videos of mass shootings and beheadings in the “Executions” section. In the “Executions (photos)” section, there are 53 more photos of corpses. Some of them have their hands tied. 

Sometimes the admins try to squeeze maximum profit out of such videos and ask subscribers for “donations.”

“Guys. Does anyone want to donate 1.000 rubles to our fighter for executing a khokhol?” a snuff channel admin wrote in a chat on December 3, 2025. “We have the footage,” another administrator wrote a few hours later. “We’ll post it on the channel soon.” The same day, a video titled “Awesome exclusive finishing off a foreign mercenary” was posted. The video shows a wounded soldier lying on the ground is executed with a gunshot to the head.

“We also thank our subscriber for financially supporting the soldier who finished this idiot off!” the video description reads. “Hear me out, executions are fucking awesome,” commented the admin in the chat.

On December 7, 2025, the same admin called on the subscribers to help with the content search: “The simplest and most effective way is to write to the soldiers and ask them to provide the footage [...] If a soldier asks for money in return, let us know.”

How teenagers monetize snuff

“Happy New Year, everyone. There were many sad events and things in 2022, but any disappointment is overshadowed by the pleasant fact that about 100,000 combat pigs (and thousands of civilians😁) have been killed. And in 2023, with God’s help, we'll kill at least as many more,” another Telegram channel, “*** slaughter”, the admin addressed his subscribers at the end of 2022. 

This channel has been around for more than three years. It is the largest war snuff content channel IStories has been able to find, with over 100,000 subscribers.

Since its launch, “*** slaughter” has published more than 15,000 photos and 20,000 videos. The channel publishes footage — both exclusive and taken from somewhere else — showing dead Ukrainian soldiers and moments of them being killed. Ads are also posted almost every day: military service campaign ads, online casinos, and AI bots for undressing girls in photos.

IStories found out that the channel has been monetized by teenagers. Their contact details have been listed for advertising inquiries right in the channel description next to the “18+” label.

Denis Bogolyubov is now 19 years old. He comes from the village of Korkatovo in the Republic of Mari El, with a population of about 500 people. In the neighboring village school, there are two memorial plaques to local residents who went to war and died, and Denis’ uncle is one of them. 

Denis was involved in advertising the “*** slaughter” channel during, at the very least, the summer and fall of 2023, when he was 16 years old. In addition to the snuff channel, Denis collaborated with educational and entertainment Telegram communities. “In more than two years of active work on Telegram, I have gained extensive experience in budget management and the implementation of successful cases,” Bogolyubov writes on his personal channel. Denis charges “15% to 25%, depending on the subject” for advertising services “with his trusted people” and more than 11,000 rubles for “consulting.” 

Bogolyubov did not respond to IStories’ inquiries.

The second teenage advertising manager had not even turned 16 when he started working for the “*** slaughter” channel in 2023. Artem Prigodin is from the village of Konosha in the Arkhangelsk Oblast. In 2023 and 2024, Artem appeared as the administrator or advertising manager of two other trash channels called “not for the faint-hearted” and “18+ strictly.” His advertising career has been interrupted by compulsory military service at the Russian border. 

Artem Prigodin confirmed to us that he worked for “*** slaughter” in 2023–2024, but then “had a beef with the owner and quit.” According to Prigodin, he did not meet the channel owner in person and “only saw him via camera.” He claims the owner is not a member of the military. After completing his compulsory military service, Prigodin has no intention of remaining in the army on a contract basis: “It’s a one-way ticket. You sign the contract, and tomorrow you’re cannon fodder.”

IStories weren’t able to identify the “*** slaughter” channel owner.

“Are we supposed to be ashamed to post and watch?”

As IStories found out, not only do teens manage the ads in snuff channels, but they also create and actively run their own violent footage communities. We know at least two channels like this. 

One of them, called “***’s Funny Corpses,” was created in 2022 and blocked in 2025 after gaining just over 8,000 subscribers. The owner recreated the channel, and 800 people subscribed to it. 

In the last few weeks alone, the channel has published a photo of a decapitated Ukrainian soldier whose head is impaled on a stick; a video of a Russian soldier urinating on a corpse; and a photo of a body with its hands tied and its skull crushed. The administrators made their own sticker pack from such photos of killed Ukrainian soldiers. 

IStories discovered that the founder of this channel is Artem Filippov, 18, from Kaluga. He calls himself the “Kaluga serial killer” and, according to his photos on social media, embraces neo-Nazi views. 

Filippov created the channel when he was just 15 years old. Among the other admins, we found four more teenagers who are now no older than 15 (their names are known to the newsroom, but we are not naming them since they are underage — Ed.). Their Telegram accounts are registered using the phone numbers of their older relatives. One of the teenagers, a 14-year-old eighth grader from Abakan, uses photos of Russian soldiers as userpics. “Mines, explosions, bloody smoke, we’ll wash away the enemy with blood, with our battle plan!” his account description reads. Information obtained from data leaks shows that, in seventh grade, he had applied to join Yunarmiya. This Russian youth organisation aims to prepare kids for future military service.

In a conversation with IStories, Artem Filippov confirmed that he founded the channel while still at school. “This channel was created in response to similar Ukrainian channels. It’s called information warfare,” Filippov claims. “I was just on the internet, arguing with some guy from Ukraine, I don’t remember the topic. He started showing me photos of our fallen soldiers, and I decided to find a channel with dead Ukrainians. At that time, there were practically none. So I decided to create my own channel.” 

Filippov came up with the “Funny Corpses” channel name himself: “I was just so angry that we didn’t have this kind of content, while the Ukrainians had a lot of it. That’s why I deliberately chose such a loud, provocative name.” According to Filippov, younger people are the channel’s main audience. 

Immediately after the conversation with IStories, Filippov announced on a backup channel that the main channel had allegedly been “blocked again,” but he would not recreate it.

Vladimir Grebennikov, the “Video *** 18+” snuff channel founder, also blames Ukrainians for provoking him to create hateful captions for his videos and photos. “I think it all started with the Ukrainians,” Grebennikov says. “Initially, there were no such [misanthropic] captions, but now 95% of them are like that.”

He noticed school kids were showing particular interest in his violent content. Nevertheless, he claims he would block minors if he identified them.

Grebennikov sees no moral contradiction in posting and sharing the violent content among mass audiences:

“What’s wrong with it? It’s our life, people are fighting there and dying, someone’s sisters, brothers, husbands, and so on. Do you think people shouldn’t know how it feels to them and how they died or whatever? Many people live here and don’t know that there is a war going on, figuratively speaking, they don’t give a shit, while someone else has been living in trenches for several years and so on. Do you think we shouldn’t be interested in this? Are we supposed to be ashamed to post and watch?”

How much the owners earn thanks to snuff content 

There are two main ways for snuff channel owners to make money: advertisement posts and collecting donations from subscribers.

Ads are present on almost all snuff channels studied by IStories: it could be online casinos, tech stores, counterfeit cigarettes stores, or the military service campaign ads. Snuff channels also often promote one another.

According to one of the administrators, the cost of an ad post depends on the reach, not on the number of subscribers. In the snuff content “market,” a thousand views cost 300–350 rubles (approx. USD 4). This indicator is known as CPM (cost per mille). Administrators of other channels estimate it more modestly: at 160 (approx. USD 2) or even just 70 (approx. USD 1) rubles per thousand views.

IStories discovered a 4-snuff-channel network that, at such rates, has a total audience of 115,000 subscribers and averages 12,000 views per post, earning about 200,000 rubles per month.

This network was administered by Robert Khaibullin, 24, from Magnitogorsk. Here is how he advertised one of the channels: “If you are weak-nerved, don’t enter. If you have a stable psyche, welcome to the real murders channel.” According to the information found in data leaks, Khaibullin has never been employed. His only official income comes from sports betting and stock trading. Khaibullin told IStories he was only responsible for advertising on these channels and “didn’t even know what the content was.” “At the moment, I have completely left this field,” Khaibullin added. 

Advertising in large communities is handled by special managers, with the same people often working for several ones. One of the manager’s contact details were listed in more than ten different channels, including the largest one, “*** slaughter.”

Most likely, this manager is Nikita Semenov, 23, from the Oryol Oblast. The phone number he registered the account with belongs to his girlfriend, but Semenov has used it when applying for loans, IStories found out. Until 2021, Semenov had worked as a handyman in the Oryol Oblast, then moved to Moscow, where he worked in a warehouse and had a side job as a taxi driver. Semenov did not respond to our request for comment.

The “*** slaughter” channel, with its 112,000 subscribers and nearly 30,000 views per post, publishes one ad per day on average and might be earning up to 260,000 rubles per month (approx. USD 3,250). When we contacted its owner, posing as potential ad buyers, he agreed to give us a “starter discount” and place an ad for a new military-themed Telegram channel for just 2,000 rubles (approx. USD 25). Even at this price, the channel can generate over 50,000 rubles (approx. USD 620) per month in revenue.

Apart from ads paid for directly by clients, automatically appearing in-app ads are also shown across channels. But channel creators don't get any money from these ads if they are in Russia.

The channels’ owners also earn decent money from collecting donations from subscribers. 

The “*** 21+” channel, with about 100,000 subscribers, posts videos of Ukrainians being murdered paired with reports on the money collected. “Thank you so much, friends, for your financial support 🙂 From the bottom of our hearts 👍,” the admins write, listing the amounts transferred to their cards. Judging by their posts, the channel has managed to collect almost 400,000 rubles (approx. USD 5,000) in three and a half years, with more than 800 people having contributed.

Female admins: Matryoshka, Goddess, and Snaky Girlboss

“Friends, do you like the violent footage we publish?”, the subscribers were asked in a poll published on several war snuff channels. Out of hundreds of answers, “Yes” and “We need the videos to be more violent” were the most popular options.

Many channels have their own chats and allow users to comment. In some of the channel chats, there are over 1,000 participants, with the largest one numbering almost 10,000 people. People chat all day and night: the participants either mock the Ukrainians or engage in heated discussions about the war, throwing insults at each other (as sometimes Ukraine supporters might join in the conversations). 

The chat admins do not restrict or moderate the constant stream of hateful comments; instead, they encourage it. 

We have identified more than 30 chat admins from various snuff channels. Although almost 90% of subscribers are male (according to TGStat data — Ed.), there are quite a few women among the admins.

The “*** SMO Snuff” (the “Special Military Operation” euphemism is the official term for the war in Russia — Ed.) channel's chat has a particularly high number of female admins: half of them are women. The channel itself boasts more than 50,000 subscribers, and the chat has just over a thousand members. The most active ones are the admins nicknamed “Masyanya” (Ekaterina Chrikyan, 36, from the Nizhny Novgorod Oblast), “The Angry Beastess” (Diana Loginova, 34, originally from Moldova), “Miss Sudarynya” (Ekaterina Selina, 40, from the Rostov Oblast), “Snaky Girlboss” (Natalya Abramova, 43, from the Novosibirsk Oblast), and “Goddess” (Natalya Alekhina, 39, from the Krasnodar Krai). 

They mainly discuss personal topics (such as one of the women’s troubled relationship) rather than the channel's snuff content. Sometimes, another female admin, nicknamed “Matryoshka,” would pop into the chat to share updates on her combatant husband.

The “Goddess” confirmed to us she moderates the chat, but she doesn’t know why she was put in charge: “Probably because I’ve been around for a while. I’ve been observing [the chat] for a long time.” “Masyanya” told IStories that the channel owner, whom she is familiar with, promoted her to chat admin “behind her back.” “I’m a frequent participant, that’s all,” she explains. “My brother is in the SMO zone.” “Miss Sudarynya” said she joined the group “just like everyone else,” and then hung up, saying, “How do I know you’re not a khokhol?” “The Angry Beastess” was out of reach. 

Why people are watching and talking about snuff videos

An interest in the theme of death is inherent to human nature, but it intensifies during certain historical periods, according to a criminal psychology expert interviewed by IStories on condition of anonymity. “During the periods of civil unrest, wars, and revolutions, people’s violence sensitivity threshold can shift,” the expert says.

However, the culture of mass consumption of snuff content is not a universal characteristic of human nature, Kirill Titaev, a sociologist and researcher in law enforcement and crime, points out in an interview with the “Stories and Facts” outlet. “Undoubtedly, various forms of violent content have accompanied humanity since ancient times. But it would be fundamentally wrong to try to link this exact phenomenon to the gladiatorial fighting culture or the Middle Ages' public executions,” the sociologist says. “It would imply that humans in general have some psychological predisposition to enjoy this kind of content and to seek it. But we know of many societies of other countries and eras where there is no snuff content available at all.” 

According to Titaev, for the mass consumption of snuff to take root in society, it must first be socially approved. “To take off, watching this would have to be culturally legitimized, because not only is one ready to watch it, but also to discuss it,” the sociologist explains. The second factor is the physical distancing from what is happening on the screen. “Typically, the murder act — with all its associated smells, sounds, and other physical sensations — is not experienced directly by the content consumer,” Titaev adds. 

Mass violent video consumption can be dangerous for society, according to the criminal psychology expert. “It doesn’t mean that people who become desensitized to violence will repeat it, but they will have fewer restraints,” he says.

Russian legislation on snuff videos

There are enough regulations in Russia to allow for the prosecution of snuff channel owners. For example, it’s the set of laws banning trash streams, signed by Russia's president in 2024. These laws ban the content that “is offensive to human dignity and public morality,” “contains depictions of activities that appear to be illegal, including violent ones, and is distributed with the intention of pranks, profit, or other low motives.” Exposing children to such content is prohibited distinctly. For such violations, the Administrative Code imposes heavy fines and confiscation of equipment used to create such videos.

There is a separate law on “inciting hatred or hostility,” which covers the derogatory captions that accompany the photos and videos. For example, in 2025, a Ulan-Ude resident was fined for using the word “khokhly” in his community chat. The court deemed her actions “aimed at humiliating human dignity based on nationality while committed publicly via the internet.”

“Under the ‘On Information’ law, social media page owners are required to independently monitor, promptly respond to, and remove the banned content, but few actually do so. Everyone has already gotten used to Roskomnadzor’s (Russian digital censoring body — Ed.) strict policies and bans,” says Sarkis Darbinyan, a cyberlaw attorney.

The Telegram app itself claims that it has taken down over 9 million groups and channels in 2026 alone. In 2025, the number was 44 million. However, the platform does not specify what exactly the kind of content banned was, except for terrorist groups and child pornography. Of all the snuff channels we examined, there was only one channel that would be blocked by Telegram, Artem Filippov’s “***’s Funny Corpses” channel. Darbinian believes that Telegram’s policy regarding similar content “echoes its founder’s (Pavel Durov — Ed.) libertarian approach”: “Durov has always stated that he is only willing to counter terrorism, which he has consistently done. It seems that if he weren’t required to, he wouldn’t remove anything at all.”

Authorities should intervene and seek out the distributors and producers of snuff content, Kirill Titaev believes. “This is a classic task for investigative and law enforcement units, which are supposed to identify the creators and the intermediaries. A person who films a homicide scene is clearly an accomplice in the homicide; moreover, it is supposed to mean aggravating circumstances and quite substantial prison terms,” he says. 

The Criminal Code was also amended by the legislative package banning “trash streams” in 2024. Posting violent videos depicting murders is now considered to be an aggravating circumstance and a qualifying element in ten Criminal Code articles, including murder, intentional bodily harm infliction, assault, and torture.

State Duma Chairman Vyacheslav Volodin had described the importance of banning the “trash streams” to his Telegram channel audience, naming them “online broadcasts during which unlawful acts are committed, demonstrating cruelty, sadism, and abuse of people and animals, usually to make money and increase one’s audience.” 

“The state should not persecute these platforms [Telegram, etc.], but rather be grateful to them. They enable investigators to identify specific individuals and hold them accountable under criminal law,” Titaev adds. “But the problem is, the people who should be doing this work are busy persecuting the very journalists who are doing their work instead.”

Read on istories.media →