In this investigation, InformNapalm volunteer intelligence community continue to examine the activities of the Russian company Aviacon Zitotrans (Russian: АО Авиакомпания “Авиакон Цитотранс”), which we previously analyzed in an earlier study.

hanks to new data obtained by the Ukrainian hacktivist group Cyber Resistance, we will continue to detail the activities of Aviacon Zitotrans. Additionally, we will share facts related to the operations of a Serbian company under Russian management, the presence of Russian military intelligence officers among the company’s crew, and other noteworthy details.

Let us recall that Aviacon Zitotrans JSC specializes in cargo transportation both within Russia and on international routes.

Despite being subjected to international sanctions for transporting arms and military equipment to African and other countries, the company has continued its illegal activities undeterred. In light of Russia’s international isolation, the company has become an effective and important tool for circumventing global sanctions.

The company operates flights to countries deemed “friendly” to Russia, transporting weaponry, military equipment, and dangerous goods such as uranium ores and equipment for nuclear power plants.

The company’s regular pilots include former and active personnel from various Russian security agencies, such as the Russian Ministry of Emergency Situations (EMERCOM), the Russian Army’s Military Transport Aviation, and others.

Overall, this company serves as a tool for transporting various goods in the interests of Russia’s military-industrial complex.

A Serbian Company with Russian Roots

In the previous investigation, we discussed the transportation of equipment for various purposes, both for military needs and for circumventing international sanctions.

Now, we will demonstrate how sanctions are bypassed in practice, using the example of the Serbian company HOLBERG, which, as it turns out, is not entirely Serbian.
According to air waybill №410-00097462, obtained during this investigation, Zitotrans transported electronic goods from Dubai

Al Maktoum Airport to Moscow’s Sheremetyevo Airport on December 6, 2022. Interestingly, the shipper was listed as the Serbian company HOLBERG, registered in Novi Sad, Serbia, while the consignee was the Russian company AV Distri, registered in Kaliningrad, Russian Federation.

Airwaybill №410-00097462

An ordinary operation on the face of it, except that the owner of the Serbian company HOLBERG is a Russian entrepreneur from Kaliningrad, Denis Bushuyev, who has close ties to Vitaly Mazur, the owner of AV Distri.

 Details of the allegedly Serbian company HOLBERG

A search query using the email address of the Serbian company—vancom9@gmail.com leads to the Russian company DS story (Russian: ДС Строй), registered in Kaliningrad, which, interestingly, uses the same email address and shares the same owner, Denis Bushuyev, as the Serbian company HOLBERG. It appears they did not even attempt to conceal these connections.

Details of the Russian company LLC DS Stroy

An analysis of Denis Bushuyev’s connections to other Russian companies reveals that he, along with Vitaly Mazur, the owner of AV Distri, is a co-owner of the companies Dilip (Russian: Дилип) and AV Distri (Russian: АВ Дистри).

Co-owners of the company Dilip

Co-owners of the company AV Distri

As evidenced by the data on AV Distri, on April 22, 2022, Denis Bushuyev transferred 100% of the company’s shares to Vitaly Mazur. Shortly thereafter, on April 28, 2022, the Serbian company HOLBERG was established under the management of Denis Bushuyev.

Apparently, this was done to set up a scheme designed to bypass international sanctions to acquire electronic components, likely for weapons production. A logical link would be a company like Aviacon Zitotrans to facilitate the transportation of these goods between two shell companies owned by Russian nationals. After all, it is highly improbable that an entire Il-76 cargo plane would be used to carry just 55 kilograms of electronics.

However, this is just one example of the sanctions evasion schemes employed by the Russian government and its affiliated companies.

Other flights operated by Aviacon Zitotrans

The example of the Serbian company HOLBERG built into the scheme illustrates how Russia circumvents international sanctions imposed against it.

It is clear that countries “friendly” to Russia either do not impose sanctions or largely fail to enforce international restrictions. Exploiting these gaps, Russia manages to acquire critical goods for its military and civilian industries. The primary destinations for Aviacon Zitotrans Il-76 flights are the UAE, China, Armenia, Turkey, and several African nations.

Air waybills for these flights typically list items such as electronics, mobile phones, lithium-ion batteries, mobile phone screens, automotive parts, servers, processors, data storage devices, iPads, Oculus VR headsets, MacBooks, cosmetic products, and much more.

The air waybills show a remarkably diverse range of goods transported by this company. While most of these items are labeled as civilian goods, it is highly likely that once in Russia many of them become dual-use items actively utilized by Russia’s military-industrial complex.

Here are several air waybills as examples.

Air waybill No. 410-00097646 for the transportation of lithium batteries from the British company Premium Trading International to the Russian company Citylink Limited

Air waybill No. 410-00112442 for the transportation of iPad, Oculus VR Headset, and MacBook from the UAE company Mobile Trade Solutions to the Russian branch of Alibaba.Com

Air waybill No. 410-00097731 for the transportation of servers, processors, and data storage units from the Thai company RBW LAB CO to the Russian company COMPTEK

We can go on with the air waybills, but there is little point in doing so. The key takeaway is that Aviacon Zitotrans serves as a critical link facilitating the transportation of goods, including sanctioned items, into Russia.

The backbone of the company’s fleet consists of Il-76TD aircraft. As of June 2023, the fleet included five units with the following tail numbers: 76502, 76842, 76846, 78765, and 76807.

A document on the availability and tail numbers of Il-76TD aircraft of Aviacon Zitotrans

Pilots of Aviacon Zitotrans

The central figure of the previous investigation was Maksim Oxss, a former colonel of the Russian Aerospace Forces and a pilot in the EMERCOM of Russia aviation squadron , which operates under the Ministry of Emergency Situations.

The heroes of this investigation could very well be the entire staff and all the pilots of Aviacon Zitotrans. However, for now, we will focus on two individuals: Alexey Nikolaevich Imetov and Evgeny Viktorovich Ostapenko.

The subjects of today’s investigation are Alexey Imetov and Evgeny Ostapenko.

Let’s start with Alexey Nikolaevich Imetov (Russian: Алексей Николаевич Иметов). He has been working at Aviacon Zitotrans since December 2015 as a loadmaster on the Il-76TD. Before this, he studied at the Ulyanovsk Higher Aviation School of Civil Aviation (Institute), specializing as a flight attendant. After graduating, he worked at Transaero Airlines JSC as a senior flight attendant until 2015.

What drew our attention, however, was not so much his biography but the fact that he was issued a certificate exempting him from mobilization as a valuable specialist.

Mobilization exemption certificate for Aviacon Zitotrans loadmaster Alexey Nikolaevich Imetov

The certificate indicates that Aviacon Zitotrans is considered a critically important enterprise for fulfilling tasks assigned by the President of the Russian Federation to aviation companies. It is quite plain what these tasks are, given that Aviacon

Zitotrans operates international flights to carry cargo for Rosoboronexport. In other words, it involves the transportation of weapons and military equipment to countries deemed “friendly” to Russia.

Another conclusion that arises is that, due to significant losses among military pilots and support personnel in the Russian Aerospace Forces, there is a need to mobilize civilian pilots from Russian airlines who previously served in military aviation.
Now let us move on to the next flight operator of the company, Evgeny Viktorovich Ostapenko (Russian: Остапенко Евгений Викторович). His biography contains intriguing details, revealing that he is far from being a simple flight engineer, as one might initially assume.

In 1995, Evgeny Ostapenko graduated from Irkutsk Higher Military Aviation Engineering School (Military Institute) (IVVAIU) with a specializing in aviation mechanical engineering.

Personal file of Evgeny Ostapenko

From 1995 to 2022, Evgeny Ostapenko served in the Russian Army’s Military Transport Aviation as a flight engineer and flight inspector. According to his personal record, he was discharged into the reserve in 2022 upon reaching the maximum service age.

His service in military unit 45097, the 117th Separate Military Transport Regiment is of particular interest. This regiment notably participated in supporting the operations of the Russian Army in Syria on behalf of the former Syrian dictator Bashar al-Assad.

Evgeny Ostapenko also took part in the so-called deployments to Syria. For this, he was awarded a combat veteran status in 2017.

Certificate of Ostapenko’s deployment to Syria in 2016

 Combat Veteran Certificate of Evgeny Ostapenko, issued in 2017

However, there is one document that suggests possible connections between Evgeny Ostapenko and the Main Intelligence Directorate of the Russian Ministry of Defense, commonly known as the GRU.

Document Indicating Possible Links Between Evgeny Ostapenko and Russian Military Intelligence

According to the document, in May 2020, Evgeny Ostapenko signed a contract restricting his travel outside Russia. A year earlier, he was granted access to classified information. This may be related to his transfer to serve in military unit 25969 as a senior flight inspector.

However, there is also a possibility that he worked at the Moscow Intelligence Center (military unit 46188, located at Matrosskaya Tishina Street 10/270), which is situated within the premises of military unit 25969. This connection, if verified, could further substantiate links between Ostapenko and Russian military intelligence operations

It is highly likely that, following Russia’s full-scale invasion of Ukraine, the GRU of the Ministry of Defense of the Russian Federation decided to actively integrate its personnel into Russian companies involved in air transportation. Clearly, this was done to ensure control and facilitate the transport of “special” goods abroad and back to Russia—goods previously mentioned in this investigation.

Before moving on to the next part of the report, there is a personal question Ostapenko: why do you conceal the existence of your daughter in official documents? And why, in the event of your death, have you designated Anastasia Evgenievna Kulyk as the sole recipient of payouts, identifying her as your daughter? Why not your son or your wife?

Assignment of Beneficiary for Payments in Case of Evgeny Ostapenko’s Death

About Aviacon Zitotrans

Following up on the topic of the mobilization of aviation company employees, it is worth noting that Aviacon Zitotrans, for instance, has a clear protocol in place detailing the actions of an employee in situations where an employee receives a mobilization notice. This underscores the gravity of the situation regarding the losses of military pilots and support personnel within the Russian Armed Forces.

Employee actions in case of potential mobilization

Thus, despite the important mission for their “homeland,” the primary factor keeping most of the company’s staff in place appears to be the threat of mobilization. It is unlikely that the key motivating factor is the salary, which, according to the income statement of one of the Il-76 crew members, averages 737,769 Russian rubles per year, or about $8,000 USD. This is relatively low pay, especially for an organization transporting dangerous goods and handling shipments for Rosoboronexport.

Income statement of a Il-76TD crew member at Aviacon Zitotrans

Regarding the Rosoboronexport orders and the overall functioning of Russian civil aviation, it is worth noting an interesting document that the Ministry of Transport of the Russian Federation sent to Rosaviation and the heads of civil aviation organizations. The document addresses a growing trend of failures in various components of Russian civil aircraft.

As seen, international sanctions have had a serious impact on the service life of aircraft. It is likely that in the near future, Russia may face a critical shortage of suitable aircraft affecting not only civil aviation flights but also the transportation of “defense” products for Rosoboronexport.

Circular from the Ministry of Transport of the Russian Federation regarding an aviation incident

The management of Aviacon Zitotrans is also concerned about the condition of the aircraft. They have urged pilots in command and engineering personnel, due to the harsh operating conditions and the increased level of danger (likely related to the activities of Russian insurgents in Russian cities), to make every effort to thoroughly inspect the aircraft and perform the necessary maintenance work.

Appeal to the personnel from the management of Aviacon Zitotrans for thorough aircraft inspections amid challenging operating conditions

Thus, following up on previous investigations of Aviacon Zitotrans and its pilots, have found that this company is engaged in the transportation of military products for Rosoboronexport to countries friendly to the Russian Federation. It is likely that Russian military intelligence officers (GRU) of the Ministry of Defense of the Russian Federation assist in this, probably escorting the airlifters to their destinations to monitor the process.

Another aspect is the use of shell companies, such as the Serbian company HOLBERG, to obtain sanctioned goods for the Russian military industry.

Based on the conducted investigation, the use of the Russian government’s aviation fleet is a complex issue. We have established that the staff of Aviacon Zitotrans mainly consisting of former pilots of the Russian military transport aviation, and likely agents or employees of military intelligence.

Despite the company’s continuing ability to carry out transport operations, it may face problems in the near future due to the wear and tear of its Il-76TD aircraft.

The international community must make every effort to monitor all companies involved in circumventing sanctions through the use of Aviacon Tsitotrans aircraft, as well as continue to impose sanctions on the pilots and staff of this company.

In this investigation, we have not disclosed all pilots and personnel; however, we believe it is necessary to carefully examine this data in order to use it for appropriate actions in the future.

Read more publications based InformNapalm on the data from Cyber Resistance hacktivists

• European sanctions disrupt state contract of Russian MOD to supply Granat-4 UAV system
• Hacking the Infocomms Department of the Russian Ministry of Defense. Katyusha and the secrets of General Konashenkov
• Hacking a Russian war criminal, deputy commander of the OMON of the Krasnoyarsk Krai
• Hacking a Russian war criminal, commander of 960th Assault Aviation Regiment
• BagdasarovLeaks: hacking ex-member of the Russian State Duma Semyon Bagdasarov. Iranian gambit
• Hacked: Russian GRU officer wanted by the FBI, leader of the hacker group APT 28
• Hacking”James Bond”: medical service commander of 960th Assault Aviation Regiment doxed key personnel of his own unit
• Hacking Andrey Lugovoy, member of the Russian State Duma, First Deputy Head of the Security Committee
• Ukrainian hacktivists acquired first-ever photo of the GRU hacker unit commander wanted by the FBI for meddling in the U.S. election
• New evidence of collaboration of former Slovak Justice Minister Štefan Harabin with the Russian Federation
• Hacking Colonel Leonid Rusin, ex-commander of Russian AWACS unit
• Ukrainian hackers posted lists and documents of the Russian 72nd Motorized Rifle Brigade (TOP-10 files)
• Economic summit Russia–Africa 2023 databases hacked by Ukrainian hacktivists
• Hacking Lieutenant Colonel Kasatkin, Russian war criminal, head of Combat Training of A-50 early warning aircraft, military unit 41520
• BabakovLeaks: hacking Alexander Babakov, Deputy Chairman of the Russian State Duma
• Cuban mercenaries continue to join the ranks of the Russian Armed Forces. Evidence of new recruitments of Cuban citizens
• Hacked: Russian pilot reveals schemes for weapons supply from Iran, South Africa and Mali to Russia
• CYBINT investigation: how the Orlan-10 manufacturer imports parts bypassing sanctions
• Hacking assistant to vice-speaker of the Russian State Duma: agents of influence in Serbia and media campaigns in the EU
• Hacktivists uncovered new classified documents from STC, Russian manufacturer of Orlan-10 drones
• CYBINT. Hacking Russian UAV manufacturer. Part 1: who assembles Geran-2?
• AlabugaLeaks. Part 2: Kaspersky Lab and neural networks for Russian military drones
• AlabugaLeaks. Part 3: Albatross, war, NVIDIA, Sony and Saito
• MedvedevLeaks: Blackmail by Dmitry ‘Nuclear Teddy’ Medvedev, Aggressive Russian Actions in the Arctic, and Rosatom
• Russian MOD officer conducting PSYOPS via Facebook in France
• BaumankaLeaks. Part 2: secret details of the “contract of the century” for the Supply of S-400 missile systems between Russia and India
• Sanctions at work: $6 million to maintain Russian Su-30SMs stranded

Compiled specially for InformNapalm readership. Distribution and reprint with reference to the source is welcome! (Creative Commons — Attribution 4.0 International — CC BY 4.0) . Subscribe to InformNapalm social media pages.

InformNapalm does not receive any financial support from any country’s government or large donors. Only community volunteers and our readers help us to maintain the site. You can also become one of the community volunteers or support InformNapalm with your donations:

• Patreon
• BuyMeACoffee
• USDT TRC-20: TUbRscbCFns4kvWbUnQRBow9ajxSXwxFJU
• Ethereum: 0xf8979c0e0f82EaF1E79704Eb10b750906868cb72
• Bitcoin: bc1qj6nmqwc75tkwv5zuq4x8ljq94xwqp2msf5kyv3