{"id":18517,"date":"2024-02-28T14:34:23","date_gmt":"2024-02-28T14:34:23","guid":{"rendered":"https:\/\/informnapalm.org\/en\/?p=18517"},"modified":"2024-02-28T14:34:23","modified_gmt":"2024-02-28T14:34:23","slug":"stc-documents-2","status":"publish","type":"post","link":"https:\/\/informnapalm.org\/en\/stc-documents-2\/","title":{"rendered":"Hacktivists uncovered new classified documents from STC, Russian manufacturer of Orlan-10 drones"},"content":{"rendered":"

At the end of January, Ukrainian hacktivists of the Cyber Resistance team handed over to InformNapalm volunteer intelligence community a new portion of information retrieved from the hacked email correspondence containing documentation from the Russian company Special Technology Center LLC (STC). This information reveals new details of the foreign components procurement process for the production of Russian weapons and military equipment bypassing Western sanctions.<\/strong><\/p>\n

Let us recall that on January 12, 2024 we published the first part of the CYBINT investigation into STC<\/a> which was translated into 8 languages. The investigation noted how Russian sanctioned companies circumvent Western sanctions and obtain foreign equipment, spare parts and components. Three days after the publication of this data in the media and amid the ensuing outcry, the German company Rohde & Schwarz<\/strong> whose products are frequently mentioned in the STC documentation, and are indispensable for the production of electronic warfare equipment, made a public statement<\/a> on its Facebook and X pages, claiming that that they fully adhere to Western sanctions. The company publicly promised to review its own business processes to identify critical problems associated with the sale by intermediaries of their products that end up in production facilities in Russia.<\/p>\n

\"\"<\/a><\/p>\n

The next day, on January 16, Bloomberg reported<\/a>, citing its own sources, that Chinese state banks decided to tighten the conditions for providing services to Russian clients after the United States threatened to hit violators of anti-Russian sanctions with secondary restrictions.<\/p>\n

Thus, at least two large Chinese banks in recent weeks have begun auditing their business with the Russian Federation, primarily cross-border transactions and funding of the Russian clients. Based on the results of the audit, banks must stop servicing the companies on the sanctions lists and no longer provide financial services to the Russian military-industrial complex, regardless of the currency and jurisdiction of the transactions in question. The audits also affect non-Russian companies doing business in Russia or supplying goods to Russia through third countries.<\/p>\n

\"\"<\/a><\/p>\n

Considering that STC receives most of its goods through China, we decided to publish the second part of our CYBINT investigation, taking a closer look at the list of intermediaries and documents connected to other types of Russian electronic warfare systems. We will also disclose the data of a leading specialist at STC, who helped the hacktivists obtain internal documents of this company.
\n<\/span><\/p>\n

The Florinsky effect
\n<\/span><\/h2>\n

An important, although not the only, role in obtaining the information by the hactivists was played by Andrey Pavlovich Florinsky, who was responsible for procurement for the research and development department of the STC. Florinsky’s email dump can be downloaded here: <\/span>flor82@inbox.ru<\/strong><\/a>).<\/span><\/p>\n

\"\"<\/a> \"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Florinsky used his email account as a notepad, periodically writing messages to himself. One of the examples contains fields with additional employee data.<\/p>\n

\"\"<\/a><\/p>\n

Later, Florinsky even complained to a friend that he had been hacked.<\/p>\n

\"\"<\/a> \"\"<\/a> \"\"<\/a><\/p>\n

In one of the screenshots of his messaging on VK we see a vestige of his high working morale and motivation: “Rotting at work from 8:30 to 19:30<\/em>“. So much for Florinsky\u2019s job attitude. However, over the past 10 months he has become a valuable source of information for Ukrainian hacktivists. The data received from him about the STC operations were transferred to Ukrainian intelligence services and foreign partners in order to strengthen the sanctions regime. Therefore, his “rotting at work” yielded some truly useful \u201cfertilizer\u201d for us. And it brought fruit.<\/p>\n

Components supplied through China<\/h2>\n

Florinsky’s information shows that Russians are increasingly purchasing equipment through China, paying in the Chinese currency. Apparently, all parties working to circumvent sanctions are perfectly aware of what they are doing and invest themselves in the outcome. Contractors understand that they are purchasing foreign products in violation of sanctions, as do those who are selling to them.<\/p>\n

Here is a scanned copy of the commercial offer dated February 2023. The amount is indicated in RMB and Euro.<\/p>\n

\"\"<\/a><\/p>\n

The same message contains another interesting attachment \u2013 a table indicating specific projects this equipment is needed for. Please note that no one is hiding the Swiss components.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

As to the settlements in RMB, here is a commercial offer from March 2023.<\/p>\n

\"\"<\/a><\/p>\n

And here is a more recent commercial offer dated December 20, 2023 for the Rohde & Schwarz spectrum analyzer, already familiar to our readers from the previous publication.<\/p>\n

\"\"<\/a><\/p>\n

It is worth noting that most Russian intermediaries do not even hide the fact that they purchase products from China. Here is an offer from another company Delasia LLC, offering “turnkey procurement operations” of the necessary products to STC.<\/p>\n

\"\"<\/a><\/p>\n

Since STC is involved in the implementation of the state defense order, it is serviced by the Russian PJSC Promsvyazbank, which is closely connected with the defense industrial sector of the Russian Federation. The financial rules of the defense order mandate the contractor to open accounts in the same bank. STC sends out two reminders to all contractors about the contracting specifics and international currency payments.<\/p>\n

The first contains the account details and mandatory contractual wordings for the state defense order.<\/p>\n

\"\"<\/a><\/p>\n

And the second is an explanation of how to deal with foreign contractors.<\/p>\n

\"\"<\/a><\/p>\n

AXIS<\/b><\/h2>\n

Documents from Florinsky’s mail show STC’s constant demand for video cameras from the Swedish company Axis<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

These data were for August 2023. If we compare against the STC orders a year earlier, in September 2022, we can say that the quantities have decreased slightly, but the flow was not completely blocked.<\/p>\n

Here is Marina Andreyeva from Soft-Tronic LLC (the company\u2019s website says that they are an official distributor of AXIS equipment) promises to deliver 75 cameras in 20 weeks.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

At the same time, the information provided by Florinsky suggests that cameras are used not only in UAVs. AXIS cameras were also critical for the Russian RB-333A Svirel system.<\/p>\n

\"\"<\/a><\/p>\n

Actually, STC works with a large number of front companies acting as procurement intermediaries. Here is a list of such front companies detected in Florinsky\u2019s email dump:<\/p>\n