{"id":18647,"date":"2024-04-17T04:30:16","date_gmt":"2024-04-17T04:30:16","guid":{"rendered":"https:\/\/informnapalm.org\/en\/?p=18647"},"modified":"2024-04-17T05:16:47","modified_gmt":"2024-04-17T05:16:47","slug":"hacking-russian-uav-manufacturer-part-1","status":"publish","type":"post","link":"https:\/\/informnapalm.org\/en\/hacking-russian-uav-manufacturer-part-1\/","title":{"rendered":"CYBINT. Hacking Russian UAV manufacturer. Part 1: who assembles Geran-2?"},"content":{"rendered":"

Ukrainian hacktivists of the Cyber Resistance team, in collaboration with InformNapalm volunteer intelligence community, conducted a multi-level CYBINT operation retrieving more than 100 GB of classified data from the Russian limited liability company ALBATROS. This data includes thousands of pages of internal documentation, technical data and drawings of various types of Albatros UAVs, information on ways to evade sanctions, and documents relating to the production of Shahed 136 kamikaze drones, also known by their Russian designation of Geran-2. Most of these materials have been used for several months in the interests of the Ukrainian intelligence and are not yet subject to disclosure. Today, we are making public the first part in a series of publications. This part is a kind of introduction into the documents of ALBATROSS LLC. For the sake of giving our readership a coherent and connected general picture, we have included in this publication some related context and links to previous investigative reports.\u00a0<\/b><\/p>\n

In this publication:<\/b><\/p>\n

    \n
  1. Who runs Albatross LLC and why the Americans imposed sanctions on this company?<\/b><\/li>\n
  2. What is the Alabuga special economic zone (SEZ)? What did the Russian Deputy Prime Minister inspect there? And how are Shaheds connected to the “Dolphins”?<\/b><\/li>\n
  3. The names of people who assemble Russian versions of the Shahed-136 (Geran-2) UAV.<\/b><\/li>\n
  4. Who of the Alabuga employees regularly fly to Tehran (Infographics)?<\/b><\/li>\n<\/ol>\n

    In lieu of a preface.<\/h2>\n

    On April 2, 2024, the Ukrainian Defense Forces launched a drone strike on the territory of the so-called Alabuga SEZ, located in the territory of Yelabuga municipality in the Republic of Tatarstan, a federal entity of the Russian Federation.<\/p>\n

    The target of the attack was a plant assembling Iranian Shahed 136 drones, or Geran-2 under the Russian designation, the drone which earned infamy for its use in Russian terrorist attacks against civilian targets in Ukraine.<\/p>\n

    After the retaliatory attack of Ukraine, the Russians mobilized their international agents of influence in a bid to shift the emphasis of the incident. So on April 3, during a briefing, the spokesman for the UN Secretary General, Stephane Dujarric, in response to a manipulative question from a journalist about an attack on the facilities in Tatarstan, referred to them as “civilian infrastructure” \u2013\u00a0“…we stand against and call for a halt to all attacks on civilian infrastructure,”<\/i> he said.<\/p>\n

    Based on the documents received, we will demonstrate that the entire territory of the special economic zone in Yelabuga is a military industry facility producing kamikaze drones on a large scale and a legitimate military target.<\/p>\n

    ALBATROSS<\/h2>\n

    As we noted at the beginning that this CYBINT study was enabled by the hacking of the Russian drone manufacturer AlbatrosS LLC [Rus.: \u041e\u041e\u041e “\u0410\u043b\u044c\u0431\u0430\u0442\u0440\u043e\u0441”] by Cyber Resistance hacktivists. They obtained more than 100 GB of internal company data, much of it classified, by accessing the personal data of its CEO, Alexey Florov<\/b>.<\/p>\n

    \"\"<\/a><\/p>\n

    Why and how agricultural drones were weaponized, which Western parts are used to assemble these UAVs, and why sanctions have not yet been imposed on the Kaspersky Corporation \u2013 we will find out in the following parts of the investigation.\u00a0For now, let’s concentrate on the Alabuga Special Economic Zone (SEZ).<\/p>\n

    Albatross LLC has been producing drones since 2017 and was initially located in the Moscow region. However, from 2023 the company has become a resident of Alabuga SEZ.<\/p>\n

    In December 2023, the US Department of Commerce imposed<\/a> export restrictions against 28 Russian companies. Two of them were residents of the Alabuga SEZ. These are Albatross LLC producing drones, and Dolphin Alabuga [Rus.: OOO “\u0414\u0435\u043b\u044c\u0444\u0438\u043d \u0410\u043b\u0430\u0431\u0443\u0433\u0430”], allegedly producing motor boats.<\/p>\n

    In January 2023, RBC Tatarstan published a news report announcing that drones and motor boats would be produced in Alabuga. Both Albatross LLC and Dolphin Alabuga LLC appeared in the publication. Moreover, Florov was mentioned as “a representative of Dolphin Alabuga”.<\/p>\n

    \"\"<\/a><\/p>\n

    There are other companies connected with Florov on the American sanctions list \u2013 Geomir JSC [Rus.: \u0410\u041e “\u0413\u0435\u043e\u043c\u0438\u0440”], ALB.AERO LLC [Rus.: \u041e\u041e\u041e “\u0410\u041b\u0411.\u0410\u042d\u0420\u041e”], Assistagro LLC [Rus.: \u041e\u041e\u041e “\u0410\u0441\u0441\u0438\u0441\u0442\u0430\u0433\u0440\u043e”] and GeomirAgro LLC [Rus.: \u041e\u041e\u041e “\u0413\u0435\u043e\u043c\u0438\u0440\u0410\u0433\u0440\u043e”].<\/p>\n

    \"\"<\/a><\/p>\n

    Florov\u2019s correspondence reveals that all these companies are directly or indirectly connected with him. He is the director of Geomir and ALB.AERO, a stakeholder in GeomirAgro, whereas Albatross has joint projects with Assistagro.<\/p>\n

    \"\"<\/a><\/p>\n

    \"\"<\/a><\/p>\n

    Why are Americans taking so much interest in Albatross and related entities? Because there are valid reasons to believe that the Russians assemble Shahed drones at the Albatross production base in the Alabuga SEZ.<\/p>\n

    ALABUGA as a military industry facility<\/h2>\n

    Before the full-scale Russian invasion of Ukraine, the Alabuga SEZ\u00a0 was an attractive destination for domestic and foreign investment. Full tax exemptions on land, real estate, and transport, as well as very low income tax rates led to the business boom in the zone. In 2016, Alabuga accounted for 74% of all foreign direct investments in Tatarstan.<\/p>\n

    With the full-scale invasion of Ukraine and the introduction of broader sanctions against Russia, many foreign companies curtailed their activities in this economic zone. It is easy to guess what kind of activity filled the vacant premises and workshops in a country that is rapidly switching to a war footing. The SEZ became a part of military-industrial complex.<\/p>\n

    The Alabuga-based companies are also taking part in the military drafting.<\/p>\n

    \"\"<\/a><\/p>\n

    \"\"<\/a><\/p>\n

    Information about Russia\u2019s plans to produce Iranian-designed military drones in its territory appeared in the fall of 2022, as reported<\/a> by The Washington Post. In June 2023, US National Security Council spokesman John Kirby, based on the data from American intelligence agencies, stated that Tehran was equipping a plant for the joint production of kamikaze drones in Russia. The media reported that the plant was being built on the territory of the Alabuga SEZ, and the White House released a photo of the probable location of the production workshops.<\/p>\n

    \"\"<\/a><\/p>\n

    In August 2023, The Washington Post published another feature<\/a> on this topic, based on leaks of Russian engineering documentation and official correspondence.<\/p>\n

    Based on these data, investigative journalists concluded that there\u00a0 were plans to produce 6,000 drones at Alabuga by the summer of 2025. To achieve this goal, Russian engineers needed to improve outdated Iranian technology, increase production capacity and improve quality control.<\/p>\n

    The leak<\/a> made it clear that the Russians used code names in correspondence and other documents: the drones were called “boats” (or “motor boats”), their warheads were “bumpers.” The leak also revealed that the Shahed-136 UAV, designated as Geran-2 in Russia, is referred to in the documents as a “Dolphin 632 motor boat”.<\/p>\n

    \"\"<\/a><\/p>\n

    After the complete transfer of technology from Iran, Russia plans to produce up to 10.000 kamikaze drones per year.<\/p>\n

    \"\"<\/a><\/p>\n

    The documents obtained by Cyber Resistance confirm the previously published data.<\/p>\n

    In March 2024, there were plans for a visit to Alabuga by Andrei Belousov, the First Deputy Prime Minister of the Russian Federation who also chairs the Government Commission for the Development of Unmanned Aircraft Systems.<\/p>\n

    As follows from the documents accompanying the preparation of this visit, Putin, back in June 2023, earmarked 10 priority Russian regions to locate research and production centers for unmanned aerial systems. This year, funding was allocated to three regions, and Alabuga strives to be one of them, on a par with the cities of Samara and Tomsk. The draft letter to Belousov specifically notes that the Deputy Russian Prime Minister will be shown “operational production facilities of Albatross and Dolphin.”<\/p>\n

    \"\"<\/a><\/p>\n

    \"\"<\/a><\/p>\n

    \"\"<\/a><\/p>\n

    It makes little sense to show the production of motor boats to a high-ranking official chairing the commission for the development of UAVs. However, if these “boats” are in fact combat drones, then it makes all the sense. Let’s look at the list of Alabuga facilities that were to be shown to Belousov.<\/p>\n

    \"\"<\/a><\/p>\n

    The list shows the general layout of Alabuga. The name of the facility, its annual production capacity are indicated, as well as a description: what kind of facility that is, what it does and what its state of readiness is.<\/p>\n

    This document shows the planned capacity for Albatross – 1000 UAVs per year. In addition to drones, the company produces instruments and devices for measurement, testing and navigation.<\/p>\n

    The document also shows which enterprises are operating and which are still under construction. For example, the Yakovlev Design Bureau located in the Synergy 13.2 building, is intended for “research and development work in the field of aircraft, engines, electronic boards, and communications”. The center was launched in December 2023.<\/p>\n

    Another operating entity is the educational center Alabuga Polytech. Apparently, the planned capacity of the center is 10,000 students per year.<\/p>\n

    Two projects are still at the commissioning stage:<\/p>\n

      \n
    1. the internal combustion engines production project (located in the Synergy 13.1 building) with a planned capacity of 40,000 pieces per year;<\/li>\n
    2. project for the production of electronic components (Synergy 8.1 building) with a planned production capacity of 160,000 pieces per year.<\/li>\n<\/ol>\n

      However, the most interesting part for us is in the second paragraph of this table.<\/p>\n

      Dolphin project (Synergy 8.2 building).<\/b>\u00a0This mysterious entry contains no notes, and the characteristics indicate only the production area (40,000 sq.m.) and the vague phrase “composite, assembly and testing production of items.” What kind of “items”? We do not know. But the planned number of these products is indicated at 10,000 pieces per year.<\/p>\n

      What kind of production is this? What is this Dolphin project for 10,000 items a year?<\/p>\n

      \"\"<\/a><\/p>\n

      Let us recall the data leak about the “Dolphin 632 motor boats”, where it was indicated that after the transfer of technology from Iran to Russia, it is planned to scale the production to 10,000 pieces per year.<\/p>\n

      Coincidence? Hardly so. Apparently, this is the production site for the Shahed-136 aka Geran-2 UAVs, confirmed by the Russians themselves.<\/p>\n

      This table also helps us understand the location of the assembly plants. Dolphin project is located in the Synergy 8.2 building. The American Institute for Science and International Security (ISIS) monitors Russian production of Shahed drones, and in its September update<\/a> on the progress of the drone production they showed satellite images of the same workshops that were published last summer by the White House.<\/p>\n

      \"\"<\/a><\/p>\n

      Apparently the building on the left is designated as 8.2, and the building on the right is 8.1. The Albatross website indicates that their main address is 423601 Republic of Tatarstan, urban settlement of the city of Yelabuga, territory of the Alabuga SEZ , Sh-1 street, building 8\/1. As confirmed by the materials<\/a> of the Center for Investigative Journalism, the building on the right is Synergy 8.1, the assembly site for Albatrosses. Accordingly, the building on the left is Synergy 8.2 occupied by the Dolphin project \u2013 the production of explosive “motor boats” with wings.<\/p>\n

      “MOTOR BOATS” PRODUCTION SUPPORT DEPARTMENT<\/h2>\n

      The location of the Shaheds assembly site has been established and confirmed by Russian documents. Now let’s look at those involved in the production. Two letters from the data array expose those working not only on the production of drones in Yelabuga, but also on establishing cooperation with Iran in this area.<\/p>\n

      The first letter contains a request from Ramis Sakhabutdinov, senior security and access control specialist at JSC SEZ PPT Alabuga. He asks for a quick conduct of a questionnaire survey of a number of employees, at a request coming from ‘”higher-ranking colleagues.”<\/i> All employees who who are supposed to fill out the questionnaire are involved in the production of the “motor boats.” Typically, the questionnaire that employees need to fill out asks for contact numbers used by the people employed at the production of the “motor boats”, the availability of a passport to travel abroad, and and trips to foreign countries since 2014, as well as information about relatives abroad and the degree of relationship. It is obvious that the manufacturers of “motor boats” are closely monitored by the security service.<\/p>\n

      \"\"<\/a><\/p>\n

      A closer look at the biographies of the individuals whose names and positions appear on the list clear away any doubt that the “motor boats” actually fly. As for Florov, it has been made clear that he is responsible for business contacts, and is the mastermind behind the business model of the Albatross company, a UAV manufacturer.<\/p>\n

      Let’s take a closer look at Konstantin Spiridonov<\/b>, the “chief design officer of the motor boats production.”\u00a0In our opinion, the first of the dates indicated in the table is the start of his official employment at Alabuga, the second is his date of birth. Spiridonov, like Florov, was one of the first to be employed \u2013 as of January 27, 2023.<\/p>\n

      This is not surprising, because Spiridonov also works at Albatross, and is the leader of the production team or the “technical brains” of the company. In fact, this is what the signature line of his business email says.<\/p>\n

      \"\"<\/a><\/p>\n

      A closer look at other details shows that he has a very peculiar personal email address for a designer of “motor boats”: lyotchik-istrebitel@yandex.ru [Editor’s note: “lyotchik-istrebitel” means “fighter pilot” in Russian].<\/p>\n

      In general, Spiridonov quite often uses nicknames like “fighter pilot” or “sniper pilot” in his personal online activity. In particular, he uses these nicknames in the ID of his personal VK account or as a developer of modifications for the ARMA 3 game (one of Spiridonov\u2019s hobbies).<\/p>\n

      Although his VK page is closed, there is access to old photos. All of them indicate that Spiridonov\u2019s interests were far from the maritime domain.<\/p>\n

      \"\"<\/a><\/p>\n

      \"\"<\/a><\/p>\n

      His education specialty is also relevant for an aircraft designer.<\/p>\n

      \"\"<\/a><\/p>\n

      After all, let’s hear out our subject himself. Back in 2020, Spiridonov said in an interview that his main work is designing Albatross drones, not honing computer games.<\/p>\n

      \"\"<\/a><\/p>\n

      And here is a photo from 2017 featuring Spiridonov with a drone wing. The photo comes from the Albatross leak.<\/p>\n

      \"\"<\/a><\/p>\n

      The key role of Florov and Spiridonov in the development of unmanned aircraft in Yelabuga is corroborated by other documents. Before moving to the territory of the SEZ in early 2023, the company submitted a business plan (concerning the production capacity of Albatross) for consideration by the management of the economic zone. The documents have a separate field about the managers and their responsibilities. There, Florov is specified as responsible for documentation and secrecy, Spiridonov \u2013 for technological development and “invention.”<\/p>\n

      \"\"<\/a><\/p>\n

      \"\"<\/a><\/p>\n

      And yet, the production of drones at Alabuga is not only about Albatross LLC. The entire economic zone is involved in this, including the Alabuga Polytech vocational school located on its territory. This is confirmed by the biography of one of the department heads in the Management group of the “motor boats” production department, Evgeniy Makhnutin<\/b>.<\/p>\n

      Makhnutin is a recruiter who got a job at Alabuga back in November 2022. He is looking for personnel not only for the production of UAVs, but also for other residents of the special economic zone. Previously, Makhnutin traveled around Russia and spoke to university students about the benefits of employment, urging them to move to Yelabuga, where life would be better and more fun.<\/p>\n

      \"\"<\/a><\/p>\n

      At that time, students were enticed by work in Western companies that had production facilities in the SEZ.<\/p>\n

      \"\"<\/a><\/p>\n

      Indirect signs indicate that Makhnutin is also involved in the recruitment of vocational school students. This is evidenced by his public reactions to a fatality that happened at the school in late March 2023. One of the students apparently committed suicide in the dormitory. The situation is not yet clear, as a year later the Russian investigation has not come up with a final conclusion, although one of the versions considered was “incitement to suicide.” Relatives of the deceased began to talk to the press about living and studying conditions in Yelabuga, which can hardly be called conducive to comprehensive development of youth.<\/p>\n

      \"\"<\/a><\/p>\n

      It was Makhnutin who came to defend the honor of the school in the comments under the posting. His comment makes it is clear that he has good knowledge about “measures for applicants” during the college admission.<\/p>\n

      \"\"<\/a><\/p>\n

      Are the vocational school students working on “motor boats” that attack Ukraine?<\/h2>\n

      This has been argued substantively in investigations by other journalists. Among the documents provided by Cyber Resistance about the “managers of the motor boat project”, our attention was drawn to the face of Viktor Plugatyrev<\/b>, a young man born on November 10, 2006. If the date is correct, then Plugatyrev should now be under 18 years old. This does not prevent him from holding the position of a “specialist in the motor boats production support department.”<\/p>\n

      At he time of writing of this text, we could not obtain definite documented proofs of Plugatyrev\u2019s training at Alabuga Polytech. However there was a channel on Telegram with a tag line saying “Viktor Plugatyrev… Student of the coolest college Alabuga Plytech” (see the image below):<\/p>\n

      \"\"<\/a><\/p>\n

      Cyber Resistance hacktivists handed over a complete list of of the “motor boat” project employees to the volunteers of the Myrotvorets Center.<\/p>\n

      \"\"<\/a><\/p>\n

      Iran connection<\/h2>\n

      The second document from the array, which testifies to the development of drones in Yelabuga according to the Iranian blueprints, is a letter demanding that a number of employees provide business travel reports for 2023.<\/p>\n

      \"\"<\/a><\/p>\n

      \"\"<\/a><\/p>\n

      A part of people on this list went on business trips to Tehran. What they were doing in the capital of Iran is allegedly unknown. However, it is certain that people with knowledge of foreign languages, mechanical engineering, drones and specialists in the military industry were selected for these trips.<\/p>\n

      Most probably this set of requirements led them to recruiting Alexander Datsyuk<\/b> whose CV can be easily found on the Internet. Datsyuk is one of the few representatives of the older group among the project participants, an expert in the “Persian” language and a former UN peacekeeper.<\/p>\n

      \"\"<\/a><\/p>\n

      \"\"<\/a><\/p>\n

      In contrast to the Muscovite Datsyuk, Roman Avarsky<\/b>, is a representative of the younger generation, a native of Dagestan, a graduate of MGIMO and, it seems, also knows Farsi. This is evidenced by his comments on the VK network, where he writes under the nickname “Roman Verum.”<\/p>\n

      \"\"<\/a><\/p>\n

      \"\"<\/a><\/p>\n

      Mentions of Avarsky can also be found on the websites of the Federal Rice Research Center (Krasnodar) and the Institute of Continuing Professional Education (Stavropol). Both centers are working on the adoption of agricultural drones.<\/p>\n

      A complete list of visitors to Iran is also on our infographics.<\/p>\n

      \"\"<\/a><\/p>\n

      CONCLUSION<\/h2>\n

      This is the first part of our investigation into the activities of Albatross LLC. However, even the listed facts make it abundantly clear that the company is actively involved in the “motor boats” project. Apparently, the Russian authorities chose this particular team as the base for the adoption of the Iranian technology.<\/p>\n

      Currently, only two Alabuga companies are under US sanctions \u2013 Albatross and Dolphin Alabuga.\u00a0JSC SEZ PPT Alabuga, Alabuga Development, Alabuga Exim<\/b> and Alabuga Machinery<\/b> are still not under sanctions.<\/p>\n

      At the same time, the content of the received documents leads to a grim conclusion. Russia is rapidly establishing its own production of attack UAVs. Iranian Shahed-136 UAVs have long become a major challenge for the Ukrainian Defense Forces and a constant threat to civilians. However, while these were Iranian supplies, Russia’s ability to terrorize Ukraine with them was limited by the production constraints and long waiting times.<\/p>\n

      Now they are building workshops for the production of their own internal combustion engines and electronic components at Alabuga. This indicates that in just a few months Russia will be able to independently produce kamikaze drones on a large scale. No parallel imports, no complex procurement of engines and chips abroad will be needed.<\/p>\n

      Unfortunately, the figure of 10 thousand drones per year, drawn from the project documentation, no longer looks fantastic. If the Russians manage to establish a closed-loop production at Alabuga, they will be able to carry out large-scale air raids every day.<\/p>\n

      Just as the Allies carpet-bombed Nazi factories during World War II, Ukraine has the right to strike military targets such as Alabuga. However, in order to prevent Russia from creating thousands and thousands of new Shaheds, Ukraine needs all the support from the West. We need weapons, air defense systems, planes, drones and long-range missiles.\u00a0Otherwise, the Russian Federation will be able to ramp up production and sooner or later swarms of Russian Shaheds will fly to the European cities of NATO member countries.<\/p>\n

      \n

      Read more publications based on the data from Cyber Resistance hacktivists<\/h2>\n