Today, 3 April 2016, the international volunteer community InformNapalm presents the first of a series of publications on the results of hacking dozens of mailboxes of the key coordinators directing the actions of militants, Russian mercenaries and Russian troops in the Donbas region and in Syria. The data was obtained by Ukrainian hackers from the anonymous group Falcons Flame (#FF) and transferred to InformNapalm for analysis and processing. For more information about the data leak operation, see “Why the Russian Defense Ministry is on fire – InformNapalm announces a series of publications based on the leaked data.”
This investigation concerns the message retrieved from a private e-mail exchange of the Union of Donbas Volunteers organization. The persons featured in the message are foreign mercenaries fighting in the Ghost brigade. It is an illegal armed group belonging to the LPR (Luhansk People’s Republic) terrorist organization. The brigade was organized by Alexey Mozgovoy and uses left-wing slogans to give an ideological backing to their actions. Follow these links for more information on the ideology of this terrorist group – [1]  [2]  [3].

We are publishing here the screenshot of the message and its headers:
The message is addressed to two recipients: the first mailbox, draft7771@yandex.ru, belongs to Olga Kulygina, alias Hans Christian; the second mailbox, sdonbassa@yandex.ru, belongs to the organization called Union of Donbass Volunteers. The message body contains the list of passport details of citizens of Italy, Spain, India, and Finland serving in the Ghost brigade in Luhansk Oblast of Ukraine. The author writes that they need visa support for the “legal stay in the territory of the Russian Federation”. The sender of the message is Alexei Markov, e-mail address redrat@yandex.ru, deputy commander of the Ghost brigade, alias Dobriy. Detailed information on him can be found on the Mirotvorets website.

Olga Kulygina

Olga Kulygina works for the Russian propaganda channel “ANNA-News”. She calls herself a “journalist”. Kulygina is a close friend of Alexander Boroday and Igor Girkin. It is known that Igor Bezler, the terrorist leader in Gorlivka, staged a shooting of prisoners to expedite the exchange of Kulygina, who was being held by the Ukrainian government, with 15 Ukrainian POW’s, including a colonel of SBU (Ukrainian Security Service). There are grounds to believe that Kulygina is employed by FSB (Russian Security Service) operating under the guise of a journalist. A brief investigation on her can be found here [1]. Kulygina has also been listed in the Mirotvorets database. A short excerpt from the description of her activities:
“Olga Kulygina played a major role in the organization of the Russian special services operations to support terrorist groups in Syria, Georgia and Ukraine.
She is one of the leaders of the agent network planted by the Russian intelligence to guide Russian nationalist groups. It is used for recruitment into sabotage groups and to control the radical movements back in Russia.
She participated in two military coups.”

“Union of Donbass Volunteers”

The organization was founded in the fall of 2015, allegedly to protect the rights of “volunteers” who fought in Ukraine. However, one of the main real aims of the organization is tracking and control by the Russian intelligence agencies of the people who have received combat experience in the Donbas. Our analysis of the information we received also reveals that the office is concerned with recruitment and visa support of foreign mercenaries, convalescence and rehabilitation of the injured, and survivor assistance. The close relationship with the intelligence agencies, immigration services, and border authorities of the Russian Federation is evident from the text of the request in the message.

The charter of the organization can be found here. Also of interest is the article by Vadim Fulmakht discussing the real purposes of this organization: “Why Boroday is creating the Union of Donbass Volunteers”. On October 10, 2015, Moscow hosted the inaugural congress of the Union of Donbass Volunteers, which was attended by about 600 participants of the military operations in eastern Ukraine, see [1] and [2]. The old domain name of the organization’s website was http://sdonbassa.ru (registered 2015.09.06). There is a parked page under this link now redirecting to the new website http://sddonbassa.ru (registered on 2016.01.31 and hosted in Russia https://hosting.reg.ru/). Registered address: Russia, Moscow, Nastasevsky lane, 5, bldg.3. Judging by message exchange, the office is located on the third floor.

The organization has offices throughout Russia, e.g. in St. Petersburg the coordinator is called “the Box”, telephone +79215505255. In Ufa the coordination is with NOD (National Liberation Movement), contact person Valery Ishmakov, telephone +79613671111.

A press release of the Union of Donbass Volunteers titled “The first results”

Persons under the OSINT-investigation based on the the source data from the message exchange:

Alberto Fazolo, born October 26, 1979 in Italy, passport AA0278798, ID AR7346959. He participated in the organization of the International Solidarity Forum “Anti-fascism, Internationalism and Solidarity”, which was held in Luhansk on May 8, 2015. Passport scan found in the hacked e-mail exchange:

Hector Arroyo Payero, born January 25, 1988 in Spain, passport PAA770023, ID 02710783A. His social network profile can be found here [1]
The identification photos and evidence of participation in illegal armed groups in the east of Ukraine have been collected by InformNapalm volunteers from this post by the blogger quarterbackrene. Excerpt from the post:
“In the photo are the Spanish fighters evacuated from the territory of LPR.
Because of the change in the Spanish law, the guys were forced to leave the unit. But this is just temporary, they say. Meet our brothers in arms, and their escort.
In the photo:
me, Becerra Rb, Héctor Arroyo Payero, Daniel Alcorcón, Adria Irigoyen Bretones, Bars and Victor.”

Additional reading: an article in Spanish from February 28, 2015:
“Eight Spaniards have been arrested for taking part in the conflict in Donbass. The detention operation took place in Asturia, Barcelona, ​​Murcia, Navarra, Madrid and Extremadura. There were three arrests in Madrid, including of Hector Arroyo. It is said that Arroyo had been in Luhansk for three months, then returned along with three other companions before Christmas. The detainees were released in the evening after giving statements to the police. The arrested men are accused of attempted murder, possession of weapons and explosives, and the actions against Spain’s interests abroad.”

This article names the foreign citizens participating in the war in the territory of Ukraine alongside with terrorists: Spaniards – Alexis Kastiye Idodeai, Brian Rodríguez, Héctor Arroyo Payero, Andrés Rohm Sal, Serbs – Zoran Kjazic and Stevan Milosevic, the French – Guillaume Lenormand, Victor Alonso Lenta, Michael Takahashi, another Serbian citizen Nikola Perovic who had previously fought in Afghanistan, as well as Víctor Alfonso Lenta.

Passport scan:

Edy Ongaro, born February 06, 1976 in Italy, passport AA1135734. The social networks profiles can be found here [1] [2].

The ongoing information war waged by the Russian intelligence agencies around the conflict in Ukraine results in massive amounts of material on the web glorifying the foreign mercenaries. For example, these are the articles only from June 14 to 19, 2015, with the participation of Edy Ongaro: [1] [2] [3]. In this video, on June 24, 2015, he says that he was at the forefront for 11 days. Passport scan:

Ravinder Singh, born November 07, 1990 in India, passport P7561331. The social networks profiles can be found here [1] [2]

This article dated July 15, 2015, tells the story of Rav Singh, a 24-year-old business college student from New Zealand, an Indian national, who had arrived in Donbas a month before and had joined the Vostok battalion, “where volunteers from other countries are also fighting on the side of the army of the Donetsk People’s Republic”. Passport scans found in the hacked e-mail exchange:

Ilari Olavy Ikonen, born January 10, 1975 in Finland, passport PT8258308. It is known that Ikonen ran for parliament in 2003 as a member of the Communist Party of Finland. He chose to report the following: Ilari Ikonen, age – 28 years, e-mail address – ilariko@luukku.com, presentation of the candidate:
“I am a fireman by profession. Aged 28 years. My hobbies: judo, nature and hunting. My electoral program: exit from the EU, non-entry into NATO.”
In 2003, he was 28 years old, so he was born in 1975, as stated above.
In 2010 Ikonen participated in the party activity in Lapland, however he was not just a fireman, but a fire station manager, here are the voting results. Presumably, he spoke at the May Day rally in 2011. In 2011 – 2012 he took part in a local council.

Petri Juhana Vijakainen, born June 16, 1976 in Finland, passport PU514631. His social network profile can be found here [1] There are numerous videos confirming the facts of participation of this Finnish citizen in the illegal armed groups on the occupied territories of Ukraine – [1]  [2]  [3]  [4]. 
Here is a photo of a Russian visa from the hacked e-mail exchange:

Thus from those listed in the request, we have established four people who had taken part in the fighting in the Donbas as members of illegal armed groups of terrorist organizations LPR and DPR. The other two are left-wing activists, one of whom took part in the preparation of a forum in Luhansk, and probably was there. Unfortunately through OSINT we could not establish visiting of the occupied territory by Ilari Olavy Ikonen, a member of the Finnish Communist Party. However, we hope that Finland’s security agencies will look into it with great interest using this data as the starting point.

Conclusions

The analysis of the message from the hacked mailbox showed the following:

• there are foreign fighters in the Ghost brigade, mostly left-wing radicals advocating a forcible change of the constitutional order of Ukraine. They are mostly members of fringe social groups, not able to fulfill themselves in the homeland, coming to Donbas either for financial gain or for ideological reasons.
• The Union of Donbass Volunteers is an organization established in Moscow, for the control, coordination, and recruitment of mercenaries.
• Four of the six subjects of the investigation are war criminals. The presence of one of them in Luhansk has been confirmed by documents of a congress of communist parties.
• The Union of Donbass Volunteers and Olga Kulygina personally assisted in obtaining and extending visas to foreign mercenaries through the Russian Federal Migration Service without personal presence of the applicants, which means that the process was spurred by the Russian intelligence agencies.
• The mercenaries come to the occupied territory of Ukraine bypassing the border control of the Russian Federation, since, according to their documents, they did not leave Russia. Here, too, we can reasonably suspect a hand of the Russian intelligence agencies.

Bonus video: Email exchange hacking during this operation.

CC BY 4.0 – Original article written by Kateryna Yaresko and Mikhail Kuznetsov based on the data provided by the hacker group Falcons Flame.. Translated by Artyom Velichko. Upon reuse of the material, an active link to the author and our project is desirable.