{"id":11290,"date":"2017-06-23T20:20:25","date_gmt":"2017-06-23T20:20:25","guid":{"rendered":"https:\/\/informnapalm.org\/en\/?p=11290"},"modified":"2017-06-23T20:20:25","modified_gmt":"2017-06-23T20:20:25","slug":"marfa-identification-of-propagandist-and-militant-recruiter","status":"publish","type":"post","link":"https:\/\/informnapalm.org\/en\/marfa-identification-of-propagandist-and-militant-recruiter\/","title":{"rendered":"Marfa: Identification of Propagandist and Militant Recruiter"},"content":{"rendered":"

One evening, over a glass of Lviv beer together with hacktivists from\u00a0UkrainianCyberAlliance (UCA)<\/a> and\u00a0CyberHunta<\/a>\u00a0we took up the issue of blocking Russian social media in Ukraine. All our agreed that VK and Odnoklassniki are platforms tailored to spread Russian propaganda and disinformation in Ukraine\u2019s media environment and that they are one of the main weapons wielded by Russia\u2019s military and political leadership in its hybrid aggression against Ukraine and other countries.<\/p>\n

In the conversation, one of the hacktivists mentioned an interesting story or, should we say, a small operation aimed at identifying a vocal anti-Ukrainian advocate and a prolific administrator of separatist groups on social media in charge of more than twenty active groups with more than 400,000 subscribers. Just think of it! 400,000 users, of whom more than 70% are Ukraine\u2019s nationals. Since late 2013, all of them were fed weaponized information from the “active measures” experts with the blessing and backing of Russian politicians, members of parliament and oligarchs connected to the government.<\/p>\n

With the blessing of our hacktivist friends we decided to make a detailed piece about this pinpoint operation. Before reading this story, you are well advised to read our previous materials on this subject [1<\/a>], [2<\/a>], [3<\/a>], [4<\/a>].<\/p>\n

The case in point is\u00a0Marfa Vasilyevna<\/strong><\/a>, a notorious administrator of separatist groups on social media. She managed more than twenty active anti-Ukrainian groups on VK and Odnoklassniki social networks, including IA\u00a0Novorossia, MIA\u00a0Novorossia, Novorossia Today, Antimaidan, Novorossia | SaveDonbassPeople | Antimaidan, Novorossia, Donetsk | Lugansk | Novorossia.<\/p>\n

<\/p>\n

An effective clue for the identification of a real person behind Marfa\u2019s anonymous account came from the work-related chat of Luhansk and Donetsk People’s Republics (LPR\/DPR) propaganda officers, which had been hacked earlier. With some sadness, Marfa reported that the updated list of journalists accredited by the DPR, which was published on Myrotvorets site, contained her data and that of her husband.<\/p>\n

<\/p>\n

It meant that there was Marfa\u2019s real personal data somewhere among 5,000 records on the list. That was interesting enough, and hacktivists supported by Myrotvorets staff started their long journey through the hacked chat of Novorosinform staffers in the quest for some workable clues.\u00a0Having reviewed what turned out later to be Marfa\u2019s close contacts [1<\/a>], [2<\/a>], they managed to find out her e-mail address and phone number:<\/p>\n

<\/p>\n

The search for letyaga-ya@yandex.ru <\/strong>e-mail address on social media returned a Facebook page of Katia Borzova.<\/strong><\/p>\n

<\/p>\n

The search for \u201cBorzova\u201d in the published list of journalists returned the following record:<\/p>\n

<\/p>\n

The last and first names, as well as the phone number, are the same. However, a different e-mail address was indicated on the list of accredited journalists:\u00a0solnushkovasilek-8886@yandex.ru.\u00a0<\/strong>The name of the owner of this e-mail account was indicated as Katia Stetsenko<\/strong> in one of the documents handed over for analysis. The same e-mail account is linked to the VK account of\u00a0Yekaterina Morozova.<\/strong><\/p>\n

<\/p>\n

So, we have now two e-mail accounts and three Yekaterinas (Ed.: or Katias, informally): Borzova, Morozova, and Stetsenko.<\/strong> Confusing, isn\u2019t it? But do you remember that Katia mentioned her husband in the chat with colleagues? The search for one of the last names produced Denys Stetsenko<\/strong> mentioned in the dump files as DNR Television and Radio Company\u2019s video engineer and an employee of Radio Respublika.<\/p>\n

<\/p>\n

<\/p>\n

There were too many Stetsenko\u2019s on social media, so the hacktivists opted for a different approach. They broke into the e-mail account of the editor-in-chief of Radio Respublika, a propaganda outlet where Stetsenko used to work earlier, and requested Denys\u2019 information from the HR department allegedly for the \u201cMinistry of State Security\u201d in her name.<\/p>\n

<\/p>\n

Then encouraged by the account owner\u2019s hospitality, they also decided to chat on Facebook with other HR specialists of the radio station… …And found out that Katia and Denys had recently been interrogated by the DPR \u201cMinistry of State Security\u201d because of a publication discrediting Zakharchenko.<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

By joint effort, they located the\u00a0account<\/a> of Denys, Katia\u2019s partner. There, they found a page of Katia Borzova renamed later into Yekaterina Morozova. Her photos had been deleted from the account earlier but were found on websites with VK page caches.\u00a0It can be seen that the young woman\u2019s hair hue is the same as the woman\u2019s featured on the photo with the chief terrorist Zakharchenko. This photo was uploaded into Marfa Vasilyevna\u2019s photo album.<\/p>\n

<\/p>\n

After that, UCA\u2019s hacktivists went all-in by posing as an officer of the DPR \u201cMinistry of State Security\u201d and requesting passport copies of Denys and Marfa via hacked VK account of another recruiter\u00a0Vladimir Yezepchuk<\/a>.<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

When Stetsenko friended Yezepchuk, hacktivists found out how old Yekaterina was. Of course, they did not get the passport scans. However, a mention of a conversation with Radio Respublika\u2019s editor-in-chief about Denys\u2019 personal data, he reluctantly acknowledged he knew Yekaterina and was prepared to invite her to chat online.<\/p>\n

<\/p>\n

Hacktivists contacted Borzova (and Denys phoned her with a request to go online on VK). It was easy as pie to confirm that this was the actual person running the Marfa account. The \u201csplit personality\u201d of Katia-Marfa became split even more when some Elena was mentioned who had co-managed the Marfa account together with Yekaterina. One becomes really inventive in order not to end up “in the dungeon”. Interestingly, Yekaterina had already been interrogated by the \u201cMinistry of State Security\u201d regarding her social media accounts and her activity on social media.<\/p>\n

<\/p>\n

<\/p>\n

<\/p>\n

And that was it! Meet\u00a0Yekaterina Sergeievna Borzova<\/a>, (Ed.: the name is spelled in transliteration from Russian, as she would definitely prefer) born on: February\u00a017, 1988, tax identification number: 3234303709, registered address of residence: 2 Vulytsia Varhanova, apartment 26, Mariupol, Donetsk Region.<\/p>\n

<\/p>\n

Google confirms that a female code-named \u201cMarfa\u201d used to recruit militants and informers in Donbas in 2014 and 2015 in the occupied territories. We have grounds to believe now that this \u201cMarfa\u201d is the same Yekaterina Borzova. However, it is up to the Ukrainian intelligence and law enforcement agencies to establish it.<\/p>\n