Mar 31, 2026
By Chris Sampson | The Wire Tap

Walking the Path of Fire: Twelve Years of InformNapalm’s War Against the Kremlin

“Ідучи стежиною самопізнання, ми неодмінно повертаємось до початку свого шляху, але з кожним колом підіймаємось над собою.”

“Walking the path of self-knowledge, we inevitably return to the beginning of our path, but with each round we rise above ourselves.”

— Roman Burko, founder, InformNapalm

This weekend, in Kyiv, an international volunteer intelligence community marked twelve years of existence in silence.

No ceremony. No press release. No celebration. InformNapalm announced that morning that they would spend the anniversary as a day of quiet memory — for the friends they have lost, for the military brothers who died for Ukraine in the years since a handful of people stuffed laptops into backpacks in Russian-occupied Sevastopol and disappeared into the night. Then, March 30th, they would call it the Day of the First Flame of Word, and begin again.

But the founder’s message that morning contained something more than grief. It contained a philosophy — one sentence that, when you understand what this organization has actually done across twelve years of war, reads not as wisdom but as lived truth:

“Walking the path of self-knowledge, we inevitably return to the beginning of our path, but with each round we rise above ourselves.”

Each round. Each revolution of the spiral. Each return to the same fight — the same lies, the same adversary, the same fundamental choice between documenting truth or allowing darkness to hold — but arriving at a higher elevation than the last time. Not progress in the comfortable linear sense. Something more demanding. Something earned.

Round One: Sevastopol, February 2014

Roman Burko grew up in Donbas and moved to Crimea. He studied, lived, and worked in Sevastopol — the home port of Russia’s Black Sea Fleet, a city so saturated with Russian military culture and imperial nostalgia that most of its residents absorbed the Kremlin’s worldview as ambient atmosphere. He has written about what Russia’s invasion cost him with a plainness that hits harder than rhetoric: “Russian aggression pulled us out of the familiar environment, destroyed our normal life, shattered our plans for the future.”

By some cruel irony of geography, both of his Ukrainian homes — Donbas and Crimea — would eventually be occupied by the same aggressor. That biographical fact is the foundation on which everything that followed was built. It is also the reason none of it could be done from a distance, from safety, from the comfortable remove of an analyst who reads reports rather than lives inside them.

In January and February of 2014, as Euromaidan burned in Kyiv, Burko was in a narrow circle of three people in Sevastopol who watched the broadcasts together, who felt the revolution differently than their neighbors did. “Despite the fact that I had spent all my earlier life in the region penetrated with strong ideological influence coming from Russia,” he wrote later, “I personally took the beginning of Euromaidan protests positively, even with great enthusiasm. In striking contrast, most of my colleagues and acquaintances criticized the Revolution of Dignity.” So he built a smaller circle. Three people who sent warm clothes to protesters sleeping in tents in Kyiv and watched history move toward them.

The awareness of what was coming hit in the final days of February. The mass shooting of protesters on the Maidan. Viktor Yanukovych fleeing Ukraine on a Russian Black Sea Fleet warship — confirmed by witnesses Burko knew personally, both sailors and civilians who happened to be there. Then: suspicious movements of Black Sea Fleet personnel. Rallies for “civil disobedience” organized with conspicuous coordination. The armed seizure of the Crimean Supreme Council and Council of Ministers. And then the men themselves — soldiers in unmarked uniforms, faces masked, no insignia, appearing at strategic positions across the peninsula with modern Russian weapons, Russian vehicles, Russian tactical formations.

The Kremlin called them local self-defense volunteers.

Burko knew what he was looking at. He had lived next to these people his entire life.

His first instinct was kinetic. “My first thoughts were, of course, to organize a guerrilla party and engage in real combat,” he wrote. “But I had no weapon and no special training.” He reasoned through why that path led nowhere: “Even if there is a chance to carry out at least one successful armed operation against Russian soldiers, this will only aggravate the situation… Russia was very efficient at broadcasting preselected messages to a global audience. Any sporadic armed resistance would be crushed in the bud and presented as a justification for the occupation.” The information cage Russia had constructed around Crimea was the primary weapon. The only counter was a different kind of fire.

“Therefore I had to figure out another way that would inflict real damage and achieve some long-lasting effect.”

He started filming. He posted to YouTube. Other eyewitnesses sent him their footage. “I understood that it was vital to inform the world community about the events taking place in Crimea,” he wrote. “I thought that this could improve the situation and, most likely, prevent the occupation and war.” On March 2nd, 2014, a single video hit nearly two million views in its first twenty-four hours. The world’s intelligence apparatus, which possessed classified information confirming exactly what Burko was filming, said nothing publicly. The official silence created a vacuum. “This record high number of views made me realize that the outer world desperately needs our videos and that we can break the isolation.”

Then the threat came. Through a closed channel on Zello — the push-to-talk app that Russian-backed Cossacks and paramilitaries were using to coordinate the Crimean seizure — Burko received word that Russian security services were already looking for him and his friends. The decision was immediate. “We decided not to wait until they find us. We stuffed our laptops in our backpacks, added a couple of T-shirts, turned off our cellphones, took out our SIM-cards and disappeared.” Multiple forms of transportation out of Crimea to prevent tracking. By the next morning they were in Kyiv, then Lviv — where Burko knew exactly one person, someone he’d only ever met online — who sheltered them while they continued working remotely, monitoring what was happening to their home through phone calls and internet connections.

In late March 2014, “with the help of a programmer from Sevastopol we created a website and decided to call it InformNapalm — a flame of information that burns the lies of the aggressor.” The site went live on March 29th, 2014. Twelve years ago today.

The name was a declaration of intent, and it was Burko’s. Information as incendiary — something that burns, that is difficult to contain once ignited, that destroys the structures it touches. Not simply publishing facts. Deploying information as a weapon against a state that had weaponized information against their country. The symmetry was chosen by a man who had been living inside that state’s lie and understood exactly what he was doing.

The Methodology: How You Burn Lies with Open Sources

Understanding InformNapalm requires understanding a distinction the organization enforced with remarkable discipline across twelve years: the difference between what they found and how it was found.

OSINT — open-source intelligence — was not yet the recognized discipline it would become. What InformNapalm developed in those early months was improvised necessity. The founding insight, as Burko described it: “Initially, the main source of information for us was insiders — people who were in the thick of things. They were consciously risking their freedom and their life, and told us what they saw and heard.” But that source was fragile, dependent on the courage and proximity of individuals who could be identified, silenced, arrested.

What replaced it was more durable. “Later this source faded into insignificance. It got replaced by the OSINT,” Burko wrote. “At that point the Russians were eagerly sharing tons of valuable proofs — on social networks, in news reports, on Internet forums and in the interviews for Russian journalists.” Russia’s conscripts and contract soldiers, raised in a social media culture that treated selfie-posting as instinctive, had carried their phones into a covert operation. They photographed themselves in front of military hardware. They tagged their locations. They posted unit insignia. They boasted to their girlfriends, and their families — proud and oblivious — shared the posts. The Kremlin was maintaining a lie that its own soldiers were disproving in real time. All you had to do was look.

Investigators would find a photograph of a Russian military vehicle posted on VK, analyze registration plates, the terrain visible in the background, unit markings — then search for other photos from the same account or tagged in the same location, building a chain of documentation connecting the vehicle, the unit, the soldiers, and the geographic location: all in eastern Ukraine, all during a period when Russia was officially denying any presence there. One by one, each soldier’s digital behavior became a brick in an evidentiary wall.

The multilingual publication model was as important as the investigative methodology. Publishing in Ukrainian served Ukrainian audiences. Publishing in Russian exposed the evidence to Russian audiences — soldiers’ families, citizens who might otherwise never encounter documentation of what was actually happening. Publishing in English, German, French, and other European languages reached the policymaking and media ecosystems where Ukraine most desperately needed support. Each language version was not a translation of an investigation. It was a targeted deployment of evidence to a specific audience for a specific purpose. Translators recruited from the Ukrainian diaspora and sympathetic language communities worked without pay, often overnight, ensuring publications reached Western media before their daily news cycles.

Burko has been direct about why he remained masked through all of this. “I think that anonymity is a necessary measure of self-defense when you confront a terrorist state, reveal its secrets and show evidence of its involvement in crimes.” This is not evasion. It is the operational logic of someone who understands that the work requires surviving long enough to keep doing it — someone whose home was already occupied by the state he was documenting.

As the hacker partnerships developed, InformNapalm’s published investigations began carrying a standard disclaimer: the community “bears no responsibility for information extraction methods.” InformNapalm analyzed and published. Others extracted. This two-layer model was not merely a legal position — it reflected a genuine division of labor that made each layer more effective. Hacker groups had expertise in system penetration and data extraction. InformNapalm had analytical expertise in intelligence assessment, open-source verification, geolocation, and multilingual publication. Together they produced something neither could produce alone: extracted intelligence verified against open-source evidence, analyzed for operational significance, and published in a form that journalists, policymakers, and courts could actually use.

The verification standard that developed was practiced and cultural. Raw data from hacker partners arrived with varying degrees of reliability. InformNapalm’s standard required cross-referencing against independent open-source evidence before publication. An email dump was not published on the basis of the dump alone; its contents were checked against known facts, public records, and other evidence streams. A document’s metadata was examined. The timeline was verified. The named individuals were cross-referenced against public records. Only when the evidence held up to scrutiny did it become a published investigation.

InformNapalm was co-founded with Irakli Komaxidze, a Georgian military expert who understood Russian hybrid warfare from the inside — Georgia had lived through a version of this playbook in 2008. The community that built up around the work was genuinely international: volunteers from Ukraine, Georgia, Germany, South Africa, the Czech Republic, Bulgaria, the United States, Spain, France, Sweden, Belarus, Portugal, and more. More than thirty volunteers from over ten countries, connected not by institution but by the shared experience of living in Russia’s neighborhood and understanding what hybrid aggression looks like from the ground floor.

By the end of 2014, InformNapalm had published 176 investigations.

Round Two: Building the Evidentiary Wall, 2015–2016

The 2015 surge — 649 published investigations, the highest annual total InformNapalm would ever achieve — corresponded with the intensification of fighting in Donbas and the maturation of the organization’s analytical capabilities. The battles for Debaltseve and the Donetsk airport produced massive Russian military deployments and therefore massive digital evidence. “At times we could also gather important evidence from the official documents, registries and obituaries in the public domain,” Burko noted — the mundane paperwork of a state that was fighting a secret war and still needed to honor its dead. Investigators developed specialized expertise: equipment identification, geolocation, personnel cross-referencing.

By 2016, InformNapalm had documented at least 75 distinct Russian military units operating in Donbas. Not militia formations. Not “volunteers.” Regular Russian Army units — motorized rifle brigades, GRU special forces, airborne units, signals troops, air defense regiments, artillery brigades — drawn from every military district in Russia, including units stationed in the Arctic and the Far East. The 64th Separate Motorized Rifle Brigade, based in Knyaz-Volkonsk in Khabarovsk Krai, was one of them. Their unit file would later prove essential when Ukrainian forces liberated Bucha.

This work did not stop at 75. By 2021, the database had grown to 101 documented Russian military units, alongside more than 50 confirmed types of weapons and equipment that could not have been captured in combat and were secretly brought to Donbas — each entry a verified proof of the lie Moscow was still maintaining.

The awards database became one of InformNapalm’s most powerful evidentiary tools. Between March 2014 and August 2017, InformNapalm documented more than 170 cases of official Russian state decorations: over 116 for operations in Donbas, 19 for Crimea, 6 for the invasion of Georgia, 30 for Syria. Each award was a data point. Assembled into a database, they constituted a prosecutorial record.

The Russian electronic warfare system Zhitel — a sophisticated signals intelligence and jamming complex with no legitimate reason to be in separatist hands — attracted so much InformNapalm attention that its operators began to feel the exposure. Once a system’s operators are named, their unit documented, their location geolocated — the system is compromised operationally. InformNapalm understood this early: publication as operational disruption, transparency as offensive weapon. The Zhitel “burned out” from their attention.

Syria provided a parallel operational theater. Russian soldiers deployed there carried the same digital habits they had brought to Donbas. They photographed themselves in front of aircraft, posted from Russian bases in Latakia, inadvertently documented the equipment and logistics of an intervention that Russian officials described in carefully limited terms. Over two years, InformNapalm published more than 150 materials about Russia’s military presence in Syria, identifying servicemen from at least 20 Russian units — 13 of which had already appeared in their Donbas investigations. The rotating army was rotating. The testing range had expanded to the Middle East.

InformNapalm’s work extended beyond battlefield documentation into the global operations of Russian intelligence itself. Working with Ukrainian hacktivist team Cyber Resistance, the community conducted two landmark operations against GRU Unit 26165 — APT 28, also known as Fancy Bear — the Russian military intelligence hacker group behind interference in the 2016 U.S. election, among other operations worldwide.

The first operation produced a full public exposure of Lieutenant Colonel Sergey Morgachev, APT 28 commander and FBI-wanted GRU officer: correspondence, passport, home address, vehicle registration, pay stubs — all published on InformNapalm. Then the team went further. They used Morgachev’s own AliExpress account to order FBI memorabilia, sex toys, and other packages to his door. His professional usefulness to the GRU was formally ended. The Kremlin could no longer pretend he didn’t exist. His own digital life had been turned into the weapon that burned him.

The second operation was more consequential still: the first-ever photograph of Colonel Viktor Netyksho — commander of GRU Unit 26165 and Morgachev’s direct superior, one of 12 Russian intelligence officers indicted by the U.S. Department of Justice for interference in the 2016 presidential election. The photograph was obtained by penetrating the email account of Netyksho’s wife, monitored for months.

The timing was precise: Netyksho and his son were booked to fly from Moscow to his hometown of Chita the following day. InformNapalm published before he boarded. No intelligence service in the world had ever produced a photograph of this man. Ukrainian volunteers did it first.

Individual groups — RUH8, FalconsFlame, Trinity, CyberHunta — were operating independently. InformNapalm served as the analytical coordination hub. What had begun as a journalism operation was becoming, organically, the connective tissue of the emerging Ukrainian hacktivist community.

In April 2016, Ukrainian hackers destroyed the servers of Anna News, a Russian propaganda outlet broadcasting from Donbas. InformNapalm published analysis of the operation. The resulting coverage — 270,000 views on a documentary about the operation alone — demonstrated that coordinated action followed by analytical publication produced amplification that neither element could achieve alone. This was identified as one of the catalysts for the formal creation of the Ukrainian Cyber Alliance in June 2016.

By mid-2016, the machinery was in place. RUH8, FalconsFlame, Trinity, and CyberHunta had merged into UCA. InformNapalm had established itself as the intelligence production and publication partner. The two-layer architecture was operational: UCA extracted, InformNapalm analyzed, verified, and published. What followed was the peak of Ukrainian volunteer cyber warfare against Russia, conducted entirely by civilians, from laptops, without government authorization or support.

Round Three: The Golden Era — October 2016

October 12, 2016.

The Ukrainian Cyber Alliance penetrated the VKontakte account of Mikhail Polinkov — known as “Khrustalik,” a former criminal turned recruiter and logistics coordinator for Igor Girkin’s separatist network. Polynkov’s account contained over 300,000 messages. Within those messages were lists of thousands of Russian mercenaries who had cycled through the conflict: names, addresses, phone numbers, photographs. A personnel database maintained by the separatists themselves, assembled to manage the flow of fighters, left exposed in a social media account.

The same night, UCA penetrated the LiveJournal account of Igor Girkin — “Strelkov,” the Russian intelligence officer turned separatist commander who had been one of InformNapalm’s earliest documented subjects. They also hit the Union of Donbas Volunteers — a Russian organization that had been recruiting and coordinating mercenaries throughout the conflict.

What the Union of Donbas Volunteers penetration revealed exceeded expectations. The organization maintained detailed questionnaire forms for volunteer fighters — personal data packages that included not just names but home addresses, family contacts, professional backgrounds, criminal histories, and passport photographs. Approximately 1,000 of these packages were transferred to Ukrainian intelligence services. Among the questionnaire forms were entries submitted through access points available only to FSB Department K employees — indicating a serving FSB officer had been using the recruitment system from inside the organization. Not just coordination. Penetration. An insider.

What UCA did with the Polynkov data illustrates the doctrine they had developed. They published it. Then they weaponized it psychologically. Smiling photographs of Vladimir Putin appeared on pages they had defaced. Banners reading “300 Strelkovtsy” — mocking Girkin’s repeated claim to command 300 fighters — appeared across compromised separatist sites. Within hours, over 30,000 subscribers fled the compromised VK groups.

It worked. Polynkov and “Gyurza” — Vera Babinina, another separatist figure — filed FSB complaints against each other, each accusing the other of being the source of the leak. Moskovskiy Komsomolets ran a headline: “Rat in our ranks.”

UCA’s public response was a single sentence: “On behalf of Ukrainian Cyber Alliance, I’d like to address the FSB: arrest them all.”

The financial records found in the Union of Donbas Volunteers documents included an item that collapsed the distance between Russia’s official narrative and operational reality more efficiently than any manifesto could have: the records noted “the cost of sausage at funerals” — a catering line item for the organization’s dead fighters. A spontaneous people’s uprising, complete with funerary catering budgets. The line required no editorial comment.

Then, two weeks after October 12th, UCA handed InformNapalm something larger.

The emails were not the rambling correspondence of a bureaucrat. They were operational. Dates, names, orders, payments. The more than 2,000 emails from Vladislav Surkov’s inbox — one gigabyte of correspondence spanning several years — documented his personal management of the DPR and LNR leadership. Every appointment in the “people’s republics” required his sign-off. Every budget allocation, every propaganda line, every strategic pivot. Separatist leaders Zakharchenko and Plotnitsky, publicly described as organic expressions of local dissent, were employees receiving instructions from Moscow.

On October 26, 2016, InformNapalm published the breach. What followed was a series of fifteen investigations drawing on the leaked materials that detonated internationally within days. Russian state television called it fabricated. The Kremlin offered no credible denial. The FSB opened internal investigations that led to arrests within its own ranks.

The volunteers had done what state intelligence services either could not or would not.

The chain of consequence reached further than anyone anticipated. In 2019, the International Joint Investigation Team investigating the downing of Malaysia Airlines Flight 17 — 298 people dead, shot out of the sky over Donbas in July 2014 — published materials that explicitly referenced InformNapalm’s SurkovLeaks publications as evidence. The same year, the British Royal United Services Institute published a formal report — The Surkov Leaks: The Inner Workings of Russia’s Hybrid War in Ukraine, authored by Alya Shandra and Member of Parliament Robert Seely — drawing directly on InformNapalm’s published investigations. RUSI, one of the oldest and most respected defense think tanks in the world, citing a Ukrainian volunteer intelligence community funded by reader donations.

In 2020, Vladislav Surkov was removed from his post as Presidential aide. By 2022, he was under house arrest — reportedly on corruption charges involving the embezzlement of funds allocated to the Donbas project. The man who had designed Russia’s hybrid war against Ukraine, who had been feeding Putin a manufactured reality for years while apparently pocketing significant sums, was a prisoner of the system he had served.

InformNapalm called it a “SurkovLeaks Fatality.”

A February 2017 operational review documented that UCA had conducted 39 published cyber operations in 2016 alone — approximately ten percent of their actual operational activity. Ninety percent of what Ukrainian volunteer hackers were doing against Russian targets that year was never published. The intelligence went to Ukrainian security services, to partner organizations, to military units.

Round Four: Pressures on the Ecosystem, 2019–2021

By 2018, the publication frequency of InformNapalm’s cyber-focused investigations was declining. Parts of the volunteer cyber ecosystem that had produced SurkovLeaks were coming under pressure. By autumn 2019, the Ukrainian Cyber Alliance had attempted to formalize its relationship with the Ukrainian state — registering as an NGO with the Ministry of Justice, seeking to move from extralegal hacktivism into a recognized relationship with the government they had been defending since 2014.

What followed were interventions by specific actors and institutional frictions that often arise in wartime environments where unofficial capabilities operate alongside formal structures. These were not the actions of the Ukrainian state as a whole. They were the result of pressures that fragmented one of the most capable volunteer cyber formations Ukraine had produced.

Andriy Baranovich, UCA’s spokesperson, described the situation in a February 4, 2021 interview: “We continued working until 2019, until February 2020 when cyber police and Security Service of Ukraine came to us with absolutely absurd accusations.”

The Ukrainian Cyber Alliance, as a unified entity, began to fragment during this period. Some members stepped back under pressure. Others continued working — in different configurations, and in some cases in new forms of cooperation with InformNapalm and other partners.

The effect on the published record was visible. As Baranovich put it by February 2021: “At the moment UCA as a broad community practically doesn’t exist… now we have an NGO consisting of three founders.”

But InformNapalm’s core work did not stop. Investigations continued, particularly in documenting Russian military units and equipment. The archive kept growing. The platform kept publishing.

What is documentable is the timing: the two years between early 2020 and the February 2022 invasion were the two years of maximum Russian preparation for the full-scale assault. During those years, some of the people who had most comprehensively penetrated Russian military communications were operating under severe constraint — through no fault of their own, and no design of Russia’s.

In 2022, Ukraine formalized new cyber volunteer structures to fill the gap. These differed significantly in origin, structure, and operational history from the earlier volunteer-driven initiatives that had produced SurkovLeaks.

Round Five: February 2022 — Return to the Beginning

February 24, 2022. The full-scale invasion.

InformNapalm’s statement that day was direct: they published a leak of personal data of more than 100,000 Russian soldiers — data from the E_N_I_G_M_A hacker group — with this framing: “We do not judge; we only make public the data that has immense public value for meeting today’s challenges.” They acknowledged they had not individually verified every person on the list. They published it anyway, as a tool for future war crimes investigation.

“Please save this data,” they wrote. “We will need it to find every single war criminal and judge them based on their actions in those wars.”

Return to the beginning. Eight years of work, and here was Russia doing openly what InformNapalm had spent eight years proving it was doing covertly. The same lie had simply become a different scale of crime.

But they returned higher on the spiral than they had left.

The years of preparatory work were immediately relevant. Units they had already documented in Donbas were now appearing in Kyiv Oblast, in Kherson, in Mariupol. The 64th Separate Motorized Rifle Brigade — already in InformNapalm’s files from Donbas documentation — was in Kyiv Oblast. When Bucha was liberated in late March and early April 2022 and the world recoiled at the bodies in the streets, InformNapalm was among the first to name the responsible unit. They already had the file. They had been building it for years.

The Dutch court’s November 2022 convictions in the MH17 case — life sentence for Igor Girkin, among others — represented validation of an evidentiary approach that InformNapalm had helped develop. Open-source evidence, properly gathered, verified, and preserved, could sustain criminal convictions against senior Russian military figures.

At the same time, the community itself underwent its own transformation. Part of InformNapalm’s international team joined the Ukrainian Defense Forces. The people who had been fighting Russia with laptops and databases took up weapons and joined their military brothers. Some of those who joined did not come back.

The databases and the bodies share the same war. This is not rhetoric. It is the lived reality of what it means to be a Ukrainian intelligence and information community operating through twelve years of Russian aggression.

Round Six: New Partners, New Capabilities

By 2023, the operational picture had been substantially rebuilt. New cyber partners had emerged from the war’s opening weeks and months — Cyber Resistance, 256 Cyber Assault Division, the analytical cyber center Fenix, Ukrainian Militant. Different in formation and structure from UCA, but operating in the same conceptual space, around the same two-layer architecture that InformNapalm had developed and published over eight years. The methodology was available to anyone willing to study the archive.

The AlabugaLeaks — a three-part investigation drawing on internal documents from Russia’s Shahed drone production facility at Alabuga — documented in specific, named detail the supply chains through which Russia was sourcing the electronic components, propulsion systems, and navigation equipment that made the Shahed drone the primary long-range strike weapon against Ukrainian civilian infrastructure. Swedish AXIS cameras. Chinese electronics. European components routed through Asian intermediaries. InformNapalm published it all, in multiple languages, making quiet bilateral management impossible. This was deliberate doctrine: information constrained to official channels can be suppressed, delayed, managed away. Information published publicly cannot.

The BaumankaLeaks drew on documents from the Bauman Moscow State Technical University to expose air defense system specifications and, in a second tranche, the classified details of a contract for S-400 missile systems sold to India.

The OKBMLeaks of November 2025 — in collaboration with the Fenix cyber center — reached a different order of sensitivity entirely. OKBM, the Experimental Design Bureau of Engine Building in Voronezh, is a subcontractor to Tupolev and a manufacturer of critical components for Russia’s most advanced aviation programs. InformNapalm and Fenix penetrated OKBM’s internal systems and held access for months, sharing classified documentation with Ukrainian Defense Forces and allied countries, before publishing.

What they published revealed that Russia’s next-generation stealth strategic bomber program — the PAK DA “Poslannik,” intended to replace the aging Tu-95 and Tu-160 — was stalled. The hydraulic actuators for opening the Poslannik’s bomb bay doors, coded “80RSh115,” could not be manufactured without German machine tools, Japanese equipment, Taiwanese CNC systems — the Hartford HCMC-1100AG, the Johnford SL-50, Serbian Grindex machines — that Western companies had ceased supplying after 2022 sanctions. Internal audit reports documented the delays explicitly. The production timeline for key PAK DA components ran to August 2027. Russia’s aviation industry, the internal documents stated plainly, had “effectively hit a dead end.”

On October 23rd, 2025, OKBM was officially included in the European Union’s 19th sanctions package. A volunteer intelligence community, funded by reader donations, had contributed directly to an EU designation.

And in March 2026, InformNapalm published analysis of documents obtained in 2024 — from an operation combining HUMINT, OSINT, and CYBINT — related to a classified project code-named “Polyus-24”: intermediate testing of modules connected to Russia’s strategic nuclear forces, with the technical assignment originating from Russian military unit 33949, which InformNapalm’s investigations had linked to Russia’s Foreign Intelligence Service. The documents referenced the “Center for Problems of Strategic Nuclear Forces” within Russia’s Academy of Military Sciences. The investigation published in eleven languages.

Stop and consider what this means. A volunteer organization — founded by a man who fled Crimea with a laptop and a couple of T-shirts, who “had to figure out another way that would inflict real damage and achieve some long-lasting effect” — published, in early 2026, technical documents describing the software architecture used in Russia’s strategic nuclear weapons development program. Not allegations. Documents. Named. Archived. Available to any researcher, journalist, prosecutor, or foreign intelligence analyst who wanted them.

Not One Day Without a Special Operation: 2026

InformNapalm entered its twelfth year with a commitment that was also a slogan: “жодного дня без спецоперації” — not one day without a special operation. The first ninety days of 2026 tested whether that commitment could be sustained. The results were comprehensive.

New Year’s Eve. The analytical cyber center Fenix penetrated closed Russian military communications channels and planted an altered version of Putin’s traditional New Year’s address. Millions of Russians watching their screens saw two different versions: one in which Putin wore a red tie, another in which he wore black. The anomaly cascaded through Russian social media within hours. InformNapalm was first to document and analyze the discrepancy — and went further, presenting technical evidence that the Kremlin had been using AI-generated video avatars for Putin’s standard public appearances for an extended period. The two New Year’s addresses were not simply the result of a hack. They were evidence of an existing deception infrastructure that the hack had accidentally exposed.

The Starlink Operation. On January 27th, InformNapalm published an investigation across thirteen language versions documenting how Russia had been systematically importing Starlink satellite terminals through sanctions evasion networks — customs declarations misclassifying terminals as automotive parts, shipping routes through third-party intermediaries, mounting evidence of Starlink dishes appearing on Russian Shahed drones. The investigation dropped hours before a Russian drone struck a civilian train in Ukraine. Polish Foreign Minister Radosław Sikorski retweeted the publication. Within days, the Ukrainian Defense Ministry had contacted SpaceX directly, providing InformNapalm’s documented evidence of the unauthorized terminal network.

SpaceX implemented a “white list” system that blocked terminals not pre-authorized for Ukrainian use. Russian military Telegram channels began posting reports that their Starlink connections had gone dead. Cause and consequence connected in a chain that took eleven days from publication to confirmed operational battlefield impact.

The Honeypot. On February 12th, InformNapalm and 256 Cyber Assault Division launched a honeypot operation that weaponized exactly the vulnerability the Starlink investigation had identified. The team created a network of fake Telegram channels advertising the activation of Starlink terminals for Russian military units in Ukraine. Over one week: 2,420 data packages on enemy terminals and their coordinates extracted, 31 potential collaborators documented, and $5,870 taken from Russian soldiers who paid for an activation service that did not exist. The coordinate data transferred directly for targeting use. The collaborator files transferred to Ukrainian law enforcement.

The Belarus Drone Relay. An operation six months in the making, announced February 18–21, documented Russian drone operators using Belarusian relay infrastructure to extend strike drone range against northern Ukraine — routing control signals through relay stations on Belarusian territory to circumvent geographic limitations. The documented intelligence became an instrument of statecraft. When President Zelensky imposed sanctions on Lukashenko on February 18, 2026, he cited the relay evidence publicly. Intelligence gathered by volunteers informed a presidential decision with international implications.

Arms to Darkness. A January 8th investigation combined conventional OSINT with social engineering targeting accounts associated with Major Yevgeny Dmitriev, a Russian officer commanding a Storm V assault unit on the Zaporizhzhia front. Extracted communications documented an arms smuggling network running weapons from the front lines through Crimea to black market buyers in Europe, Asia, and Africa via Russia’s shadow fleet. The social engineering component executed simultaneously: the team posed as Major Dmitriev online and redirected fundraising appeals from “Dva Mayora” — a Russian military blogger with over a million subscribers — toward Ukrainian SSO drone purchases. Russian donors, believing they were supporting their own forces, were funding Ukrainian special operations drones.

InformNapalm’s role is no longer just understood. On the Day of the First Flame of Word, multiple Ukrainian defense and intelligence structures publicly acknowledged and congratulated the community. Among those recognizing twelve years of work: the Special Operations Forces of the Armed Forces of Ukraine, the Main Directorate of Intelligence, the Foreign Intelligence Service, the Center for Countering Disinformation of the National Security and Defense Council, and the Unmanned Systems Forces.

InformNapalm occupies a unique position: not a fundraising volunteer organization, not a civic group, but a volunteer intelligence community — a role that even state intelligence structures now openly recognize. They did not wait to be asked. They offered the recognition themselves.

All materials are translated by human volunteers across multiple time zones — no AI translation, a deliberate methodological choice preserving the register and bureaucratic precision of Russian official documentation. Approximately 135,000 Telegram subscribers. An emergency server fundraiser in February requiring 53,000 Ukrainian hryvnias, fully funded within days. The Prime Minister’s office publicly following InformNapalm on Threads. The General Staff’s Cyber Forces unit publicly crediting InformNapalm’s work. The law establishing Ukraine’s formal Cyber Forces — which InformNapalm had advocated for since 2016 — advancing to its second parliamentary reading in late February.

The Record as Weapon: What Twelve Years Built

Twelve years. 2,142 published investigations. One gigabyte of Surkov’s email. Thirty thousand separatist VK subscribers fleeing in a single night. A thousand Russian mercenaries whose identifying information arrived in Ukrainian intelligence databases. A Dutch court’s life sentence for Igor Girkin. Starlink terminals going dark on Russian drones eleven days after publication. An arms smuggling network from the Zaporizhzhia front to three continents. Software architecture for nuclear weapons development published in eleven languages.

When Burko described what his community had built — “within 4 years we have published more than 1,700 investigations demasking the Russian aggression” — he was writing in 2020, when the full-scale invasion was still two years away. By 2026, the archive had grown to 2,142 investigations, cited in criminal courts, informing sanctions packages, triggering battlefield effects.

On July 9, 2025, the Grand Chamber of the European Court of Human Rights delivered its landmark judgment in Ukraine and the Netherlands v. Russia — the most extensive inter-state case in the Court’s history. The ruling held Russia accountable for systematic and widespread human rights violations in Ukraine since 2014, covering indiscriminate military attacks, summary executions, torture, unlawful detentions, and the destruction of civilian property across eight years of conflict. The Court also found Russia responsible for the downing of Malaysia Airlines Flight MH17. The judgment directly relies on patterns of evidence — of Russian military presence, command structure, and operational conduct — that years of open-source investigation had helped establish and systematize.

The intelligence value of the archive went beyond its legal applications. The gap between Russian military theory and Russian military practice, visible in the documentation of the Donbas operations, explained many of the command failures and tactical breakdowns that became visible when the same forces attempted a full-scale invasion in 2022. The archive was a predictive instrument, and it had been right.

What InformNapalm demonstrated — and this is the larger lesson that matters for democracies currently confronting Russian hybrid warfare — is that transparency is a form of defense. Open-source intelligence, rigorously verified and systematically published, can constrain Russian operations in ways that classified intelligence often cannot, precisely because it can be shared publicly, cited in courts, used in political debate, republished by journalists in thirty languages. The Zhitel electronic warfare system that “burned out” from InformNapalm’s attention is a small but perfect illustration. Once a system’s operators are named, its location documented, its unit identified — the system is compromised operationally. Transparency has operational consequences in a warfare environment, and InformNapalm understood this from the beginning.

The Meaning of Twelve Rounds

“Walking the path of self-knowledge, we inevitably return to the beginning of our path, but with each round we rise above ourselves.”

Round one: three people in Sevastopol — a man who “had to figure out another way that would inflict real damage” — filming men without insignia, understanding before the world what was happening, forced out of their home by the state they were filming.

Round two: building a systematic database that proved 75 Russian military units were operating in Donbas, named and documented, unit by unit, soldier by soldier, while the Kremlin denied all of it. At that point the Russians were “eagerly sharing tons of valuable proofs” on social networks, and InformNapalm was collecting every one.

Round three: reaching inside Vladislav Surkov’s inbox, reading the war’s operational instructions, publishing them to the world. Reading the cost of sausage at separatist funerals. Watching the FSB arrest its own people in the aftermath.

Round four: watching the government you defended destroy the capability you built, in the two years Russia spent preparing the full-scale invasion. Returning to start — not by choice but by institutional betrayal — and finding the organization still standing when the worst came.

Round five: returning to the beginning when the full-scale invasion hit — back to the fundamental work of documentation, of naming, of building the evidentiary record — but arriving with a completed archive, with established legal precedent, with the files already built on the units committing the crimes. Back to Bucha with the 64th Brigade’s file already in hand.

Round six: penetrating Russia’s classified defense industry, reaching the bomb bay doors of Russia’s next-generation bomber and the testing documentation for its nuclear weapons program. Publishing it in eleven languages. Starting the thirteenth year.

Each round, the same fire. Each round, burning higher.

The path of self-knowledge Burko described is not comfortable. It began the moment he chose information over a guerrilla rifle — “I had to figure out another way” — and it has required returning to that choice every day for twelve years. It is the knowledge of what you are capable of when you have no institutional support, when the state apparatus either ignores what you’re documenting or actively prosecutes you for it. It is the knowledge that the information front is a front in every sense — that people doing this work are targets, that the work costs things you don’t always get back.

“Our fight is not over and will continue until Russia leaves the occupied territories — not only in Ukraine, but also in other countries,” Burko wrote in 2020. “It is a struggle for truth, justice, and ability to live in a world that has no place for aggression, military occupation and hybrid war.”

The larger lesson — the one that democratic governments confronting hybrid warfare need to hear directly — is that InformNapalm represents something that cannot be manufactured on demand. It required an adversary who believed its operations were deniable while leaving digital documentation everywhere. It required a political and cultural moment that sustained years of unpaid volunteer work under genuine legal risk and physical danger. And it required the particular fury — call it patriotism, call it rage at being lied to, call it the specific emotion of watching your country being dismembered while the world pretends otherwise — that drives a man to choose an information insurgency over a guerrilla rifle because he understands, with cold clarity, which weapon will do more lasting damage.

The Ukrainian government failed that test in February 2020. The SBU raids that destroyed UCA were the expression of an institutional logic that prioritizes control over capability. The IT Army created thirteen months later was the belated admission that they had been right. It just came too late.

The warning is direct: the informal sector that defends you is not your enemy. The volunteers who are doing things you cannot officially authorize, the hackers who are reading your adversary’s mail before you can, the investigators who are building the evidentiary record that will eventually sustain criminal convictions — they are not threats to be managed. They are the force multiplier you cannot buy, recruit, or bureaucratically create.

The Day of Silence

They spent this anniversary in silence — with their thoughts, alone — in memory of all their friends and military brothers who have given their lives for Ukraine over these twelve years. March 30th was the Day of the First Flame of Word.

The work of InformNapalm is among the most consequential investigative intelligence operations of this war — not because they had government resources or institutional prestige, but because they had conviction, methodology, and the courage to start doing the work before it was safe to do it, and to keep doing it through twelve years of escalating threat. The Kremlin knows their name. The FSB has made specific threats. Russian propagandists have run sustained disinformation campaigns against the organization and its founder. And yet InformNapalm has penetrated Russia’s nuclear program documentation, named the commanders of the units that massacred civilians in Bucha, contributed to the criminal investigation of a civilian aircraft shot out of the sky killing 298 people, helped pull down one of Putin’s most powerful ideologues, and documented — in real time, with named evidence — the full operational architecture of a war that Russia has been lying about for twelve years.

There is one more thing that needs to be said plainly — something that Margarita Sokorenko, marking this anniversary, stated in terms that cannot be improved upon: the Grand Chamber of the European Court of Human Rights now cites InformNapalm’s reports. Not as background reading. Not as context. As evidence. Paragraph 472 of the Grand Chamber judgment in Ukraine and the Netherlands v. Russia — the most extensive inter-state case in the Court’s history — names InformNapalm alongside the Atlantic Council and Bellingcat and states that the Court finds these organizations’ reports “credible and serious,” that the authors are experienced and their methodologies sound, and that “there are no grounds upon which to reject the evidence of these reports as a category of evidence.”

Ukraine’s fight has always been a war on multiple fronts. The front lines in Zaporizhzhia and Kherson are one. The courtrooms in Strasbourg and The Hague are another. InformNapalm has been fighting on the second front since the first shot was fired on the first.

On this anniversary, the tools are significantly more capable than they were in that moment Burko chose documentation over a guerrilla rifle. The fire is burning higher. The archive is 2,142 investigations deep, cited in criminal courts, informing sanctions packages, triggering battlefield effects within eleven days of publication. The path of self-knowledge that brought them back to the beginning twelve times has produced an organization that can reach inside the most classified structures of the Russian military-industrial complex and publish what it finds before breakfast.

Not bad for a website named after fire.

On March 30th, InformNapalm began the thirteenth round.

The flame continues.

Chris Sampson is Editor-in-Chief of NatSecMedia and host of The Wire Tap on Substack. He has been based in Kyiv since January 31st, 2022, holds Ukrainian military press accreditation, and is the author of Hacking ISIS.

Compiled specially for InformNapalm readership. Distribution and reprint with reference to the source is welcome! (Creative Commons — Attribution 4.0 International — CC BY 4.0). Subscribe to InformNapalm social media pages Facebook/ Тwitter Telegram/ Slate (Sl8).

InformNapalm does not receive any financial support from any country’s government or large donors. Only community volunteers and our readers help us to maintain the site. You can also become one of the community volunteers or support InformNapalm with your donations.
InformNapalm social media pages: Facebook / Тwitter / Telegram/ Slate (Sl8).