Second GRU Officer Indicted in Montenegro Coup Unmasked

A joint investigation between Bellingcat and The Insider has identified a second GRU officer, who was involved in the 2016 Montenegro coup, as Vladimir Nikolaevich Moiseev.

Article by Moritz Rakuszitzky, research by Moritz Rakuszitzky, Daniel Romein, and Roman Dobrokhotov.

The Russian version of this investigation is published by The Insider.

Two officers from Russia’s military intelligence (GRU) are sought, via Interpol, as suspected organizers of an unsuccessful 2016 coup in Montenegro, a small country on the Adriatic Sea in Southeastern Europe. The true identity of one officer is public, while the other officer is known only under his cover identity. Bellingcat has been able to unmask the real identity of the second suspect indicted by the Montenegro prosecutor, and to confirm that he is indeed a senior GRU officer.

The name of the first Russian officer, Eduard Shishmakov, and his employment with GRU at the time of the events in Montenegro, was confirmed in a series of investigations by Bellingcat and its Russian investigative partner The Insider (read reports here and here).

The second person is only known to Montenegro prosecutors under his cover identity, Vladimir Popov.  It is under this cover name that he is being sought by Interpol and by Montenegro’s partner law enforcement agencies in Europe, as can be seen in the court case file.

Court case file showing Vladimir Popov wanted by Interpol and the Judicial Authorities of Montenegro.

Bellingcat and the Insider have now succeeded in unmasking “Popov”’s actual identity, which is Vladimir Nikolaevich Moiseev. Moiseev, who is a lieutenant colonel or colonel with Russian military intelligence, was born on 29.06.1980, the same date as the fictional “Popov.”

Bellingcat’s findings in the case of Popov/Moiseev add important and intriguing details to GRU’s modus operandi in undercover operations, including use of sham business operations, and add to the understanding of GRU’s covert operatives’ world, previously provided by our reporting on the two Skripal suspects, Anatoliy Chepiga and Alexander Mishkin. As in the case of Chepiga and Mishkin, our findings directly contradict Kremlin’s statements that “Popov” was an innocent Russian tourist unjustly accused by a hostile foreign government.

Who is Vladimir Moiseev?

Vladimir Nikolaevich Moiseev was born in the small West-Siberian village of Pivkino (population just over 500 people) in the Kurganskaya region in the Urals, not far from Chelyabinsk. He attended the local village school before he moved Tyumen, about 200 km north of Pivkino, for his military service. Immediately following or during his military service, Moiseev enrolled at the Tyumen Military Engineering Institute, an advanced program churning out military engineers specializing in anything from radio-signal encryption to remote bomb detonation. He finished his studies with the rank of lieutenant.

It is not certain at what time — during his studies or thereafter — Moiseev was recruited by the GRU. Bellingcat last traced his registered address to the Tyumen military institute in 2005. At some point between 2005 and 2009, he was relocated to Moscow to serve at a GRU airborne Spetsnaz unit known as military unit № 48427 . In 2008, the Spetznaz unit took part in operations in Georgia during the Ossetia-Georgian conflict and the Russia-Georgia war. Thus, assuming Moiseev was assigned to this unit prior to 2008, he would have taken part in Russia’s military operations in Georgia.

In 2009, Moiseev was issued his new identity under the name Vladimir Popov. Like his GRU colleagues, Skripal suspects Chepiga and Mishkin, Moiseev “exists” in Russian databases with two parallel identities, as Vladimir Moiseev and as Vladimir Popov.

Until 2014, Moiseev and his family resided at the 48427 Spetznaz unit’s dormitory at Matrosskaya Tishina 10 in Moscow.  In March 2015, Moiseev was given an apartment in the same residential building where Skripal suspect Mishkin was also given an apartment several months earlier. As in Mishkin’s case, the apartment is registered in the name of Moiseev’s wife and children, and the GRU officer is not mentioned in the real estate deed.

Under his new cover identity, “Popov” was employed by as a “photo correspondent” and “journalist” working for an insurance periodical called Morskoye Strakhovanie (literally: “Marine Insurance”) and used this cover to travel across Europe in the period 2012-2016. He even published “articles”; a now defunct website for the periodical featured “Popov”’s work listing the world’s greatest seafarers. It was namely under the cover of a journalist for Morskoye Strakhovanie magazine that “Popov” travelled to Serbia in October 2016.

How Did We Unmask Moiseev?

The starting point for this investigation was the name “Vladimir Nikolaevich Popov,” birthdate June 29, 1980, passport photo and international passport  that was published by Montenegro prosecutors and by Interpol. The passport data also had a place of birth: “Kurganskaya oblast” (misspelled on the Interpol website as “Kurgastaya”).

Additionally, we had at our disposal three color photographs posted by “Popov” on social media; as well as a still from a video surveillance tape made by Serbian police capturing a meeting between Shishmakov and Popov in a Belgrade park a few days before the Montenegro events.

A photograph of Vladimir “Popov” from his now deleted social media account.

A screenshot from a video surveillance tape made by Serbian police capturing a meeting between Shishmakov (1) and “Popov” (2).

Our working assumption was that the name “Popov” was an alias. This hypothesis was confirmed when we obtained passport and address data for a person with this name and birthdate from a publicly available Moscow database (Larix).  We found one matching entry in the database; the individual had only one passport listed,  issued in 2009, and was listed as being born in “Kurganskaya oblast.” No earlier references to this individual were found in this or any other databases we consulted.  The entry also listed a Moscow address.

We then obtained an ownership certificate for the Moscow address from Russia’s official real estate registry, Rosreestr. It listed a Russian couple in their 70s as owners of a small one-bedroom apartment. We located the family’s home telephone number via a search at the popular Russian reverse phone lookup website phonenumber.to. We contacted the family and were told that they had never heard of a Vladimir Popov. This lent more weight to our initial hypothesis, as we had observed a similar “random assignment” of a residential address to other undercover GRU operatives, such as Chepiga.

At this point, we decided to search for Vladimir Popov in Moscow’s vehicle ownership databases. Several iterations of these vehicle databases maintained by GIBDD, a.k.a. Russian Traffic Patrol, have been leaked over the years and are freely available on Russian torrent websites. In a 2011 version of the database, we found that a Vladimir Popov, having the same age as the person wanted by Interpol and the same (fake) Moscow address, owned a Kia CEED.

Vladimir “Popov”‘s record in a Russian traffic police database shows he owned a Kia Ceed in 2011.

This new information gave us three significant additional leads. One was the fact that the passport issuing authority was the Central Migration Directorate in Moscow; the same passport-issuing agency that issued the undercover passports for Chepiga and Mishkin.  The second was the contact telephone number. The third were two numbers identifying the vehicle owned by “Popov” (VIM number and car passport number).

Using these vehicle details, we were able to log into the Russian government e-services portal and obtained a list of traffic violations linked to the car in question. We found 10 unpaid speeding tickets, of which 4 were concentrated near two GRU addresses in Moscow: Khoroshevskoye Shosse 76b (the GRU headquarters building), and the “Tower” GRU building in Khimki.

A photograph of Vladimir “Popov”‘s car from a traffic police database that shows a speed violation on Leningradskoye Shosse near an address of a GRU office in Khimki, Moscow oblast.

We then cross-referenced the phone number listed on “Popov”’s car registration against online reverse search phone databases, and found it on one of them, listed with the name “Vladimir Nikolaevich Popov.”

Vladimir “Popov”‘s telephone number in a reverse search phone database.

At this point, we decided to test the hypothesis that had previously helped us track down the true identity of GRU operative Alexander Mishkin. We searched Moscow databases with the first name and patronymic used by “Popov”, using the birthdate of 29 June 1980, while leaving the last name blank as a wild card.

In the 2011 Moscow vehicle registration database, we found one matching entry. A certain Vladimir Nikolaevich Moiseev is listed as the owner of a Subaru Legacy Outback. This person has a passport issued in the Tyumen region. Tyumen is a city not far from Kurganskaya oblast, and was listed in “Popov”’s now defunct VK profile as his place of studies, thus this entry appeared interesting. What is more interesting, however, is the listed address for this individual, as of 2011.

A person named Vladimir Nikolaevich Moiseev from the Tyumen region listed in a 2011 Moscow vehicle registration database.

The address is Matrosskaya Tishina 10, with a further specification of Military Unit 48427. This military unit number was the alias for a Separate Spetsnaz Airborne Reconnaissance Unit, under GRU’s command, which played a critical role in the two Chechen wars and in the Russia-Georgia war.

At this point, our working hypothesis was that Moiseev— matching the alias pattern seen with Mishkin and Shishmakov, and also registered to a military unit under a GRU command, and, furthermore, having a link to Tyumen just as “Popov” did — was, in fact, the real individual hiding behind the “Popov” persona.

Intending to work purely with open source data, Bellingcat chose not to procure a passport copy for Moiseev. Instead, we searched through various additional leaked or commercially available databases for further clues about this man. We searched a Tyumen residential database, and found a Moiseev — having the same passport number as the one listed above — registered in 2004 and 2005 to the address of the Tyumen Military Engineering Institute.

Vladimir Moiseev was registered at the address of the Tyumen Military Engineering Institute in 2004 and 2005.

Then we searched the residential databases of Kurganskaya oblast, and found the same Moiseev with a registered address — and an indicated birthplace — in the tiny village of Pivkino. Thus the candidate also matched the place of birth as indicated in the fake passport: Pivkino is in Kurganskaya oblast.

Vladimir Moiseev registered in Pivkino in the Kurganskaya oblast.

We searched the online system for traffic for violations made by Moiseev under his true name, with the Subaru. We found one traffic violation from 2017, and a corresponding speed-cam photograph, but it was not sufficiently clear to serve as identification.

Then we decided to search for family members who might have a photograph of Moiseev. We searched the Moscow residential database for people having the family name Moiseev/a and having a residential address at а the 48427th unit’s military base in Moscow. We found a woman with the last name Moiseeva (as per the rules of the Russian language, the female version of Moiseev is Moiseeva), and of similar age to our Moiseev. We also found a child with the same family name and the patronymic of Vladimirovich (meaning the father’s name was Vladimir). Our hypothesis was that we may have just found Moiseev’s wife and child.

We were able to identify a social media account for the woman. It was a closed-access account on the Russian social network Odnoklassniki, which prevented us from accessing photographs. We were able, however, to browse through a list of friends of this account, and came across a woman that had the same birthdate as Moiseev, and had “Moiseeva” in her name in brackets, which is customarily how women list their maiden names on the Odnoklassniki social network, a site originally meant for locating old classmates. We hypothesized that this woman is Vladimir Moiseev’s twin sister. This was confirmed when we found her name in the residential database of Pivkino.

Moiseev’s sister’s account contained an extensive photo gallery, including photographs of children whom she identified in comments as her brother Vladimir’s children, and who bore a strong visual resemblance to the person known as “Popov.” However, there was no photograph of her brother.

Ultimately, we stumbled upon the smoking gun, a link between “Popov” and Moiseev, in a more recent version of the GIBDD’s vehicle database of Moscow residents. In it, Moiseev was listed as owning a newer version of the same car as in 2011 (a 2015 Subaru Outback). In this database, Moiseev was listed with a contact telephone number identical to the number listed for “Popov” under his car registration entry.

Car registration of Vladimir Moiseev in a recent Moscow vehicle registration database, showing the same telephone number as of Vladimir “Popov”.

Furthermore, the recent database contained a new address for Moiseev, which was in the same apartment complex as the residence of Skripal poisoning suspect Alexander Mishkin. The exact address allowed us to receive ownership information from the Russian real-estate database, which showed a similar-sized apartment as Mishkin’s and a similar arrangement: a transfer of ownership, unencumbered with any mortgage, directly from the city of Moscow (as it was the original owner of the newly built apartment building) to Moiseev’s wife and children.

Tracking Moiseev’s Travels

During the period of 2011-2013, “Popov” posted extensively on social media, primarily from Central and Western Europe. He posted photos from various locations where he allegedly attended naval-themed conferences in Europe and Georgia. His VK account was deleted in March 2017, after he was put on Interpol’s red notice list.

A photo posted in 2012, which Bellingcat has identified as taken in Warsaw, remains visible as a profile picture on Russia’s email and social media site Mail.ru. During this period, “Popov”’s co-indicted GRU officer, Colonel Eduard Shishmakov, served as deputy military attaché at the Russian embassy in Warsaw. Also during this period, a Polish officer was allegedly recruited by Russian military intelligence, for which he was later sentenced to six years in prison.

A photograph of Vladimir “Popov” from his mail.ru account, geolocated to an observation deck in the old town of Warsaw, Poland.

2013 – 2016 Travels

By reviewing leaked Russian travel booking databases from the period of 2013-2016, we were able to reconstruct Moiseev’s travel schedule until his last trip to Belgrade in October 2016. His itinerary shows multiple trips to Georgia, Bulgaria and Greece.

Notably, “Popov” also travelled to Moldova in early June 2014, matching the arrival and departure times reported earlier last year by independent Moldovan news site Deschide. The publication had reported that “Popov” may have taken part in plotting acts of sabotage against Moldova’s then pending association agreement with the European Union, by destabilizing the country along the Ukraine scenario, using local paramilitaries trained at GRU camps in Rostov.  The travel databases consulted by Bellingcat show that Popov was accompanied on his Moldova trip by a second person whose name and birthdate does not appear in Russian databases, suggesting it was also a cover identity.

Bellingcat has confirmed that Moiseev indeed travelled to Rostov several times, including in the company of pro-Russian Ukrainian separatists, lending credibility to Deschide’s story. Contacted by Bellingcat, the Moldovan Information and Security Agency declined to comment on “Popov”/Moiseev’s activities in the country, citing the “secrecy of ongoing investigation.”

Moiseev’s last trip under the alias “Popov” was to Serbia in October 2016, during the same time period as the alleged plot to destabilize neighboring Montenegro in the aftermath of presidential elections on October 16, 2016. We did not identify any flight data showing when Moiseev arrived to Serbia, however his departure from Belgrade to Moscow was on October 20, 2016. This might suggest arrival by car, or non-commercial aircraft. Several months prior to the trip to Serbia, Moiseev had traveled to Rostov.

It is not clear what Moiseev’s assignments in Georgia, Bulgaria, and Greece may have been. During the period of his trips to Bulgaria in 2015, at least two Serb paramilitaries who had taken part in fighting in Eastern Ukraine after being trained at GRU training camps in Rostov, had set up base in Bulgaria. One of them, Bratislav Zivkovic, was expelled by Romania in 2017 on charges of espionage for a “foreign military intelligence”.

Moiseev also made a five-day trip to Vienna in February 2014; however Vienna may have been used as a transit airport for other nearby locations, such as Slovakia or Hungary.

Vladimir Moiseev’s travel schedule from 2013 to 2016.

It is not known what military rank Moiseev has as of now. However, given the time elapsed since he received the rank of lieutenant, it would be customary to expect that by 2016 he had the rank of at least major or (more likely) lieutenant colonel. Notably, the fact that he received an apartment of similar size, approximately at the same time, and at the same address as Alexander Mishkin, implies that the two are of similar rank; i.e. lieutenant colonel or colonel. It is possible that like Chepiga and Mishkin, Moiseev was also awarded the apartment as part of a state honor award.

“Marine Insurance” as Cover

Vladimir Moiseev’s cover for his trip to Belgrade in October 2016 was provided by the publisher of the now defunct magazine Marine Insurance, Mr. Nikita Minin. Contacted by Bellingcat, he confirmed that in 2016 “Vladimir Popov” did work for his publication.  Minin said the magazine sent “Popov” on a business trip to Serbia to “gather additional information on the topic of the participation of the Serbian river flotilla in the First World War”, which he called a “sparsely researched historical fact that excited the interest of our readers”. Nikita Minin said the research did not materialize in a publication due to commercial reasons.

However, while reviewing evidence submitted by the Montenegro prosecutor to the court, Bellingcat and the Insider found Nikita Minin’s personal telephone number listed as a contact number for a Belgrade hotel booking of the other GRU officer, Colonel Eduard Shishmakov.

Nikita Minin’s personal telephone number on a hotel booking for Colonel Eduard Shishmakov.

When confronted about this, Nikita Minin told us that he had no explanation how his number appeared  on the booking which was made on Sept 29, 2016. He insisted that he has never heard of either Shishmakov or of his alias Shirokov.

Nikita Minin says he has worked in the insurance industry since 1996. However, in publicly available databases, Bellingcat has found that in 2000-2001 he served at the 218 Separate Airborne Forces Spetsnaz Unit or Military Unit 48427 in Moscow, the same unit where Moiseev served years later.

Minin, top right corner, during his service at the 218th Separate Airborne Forces. Undated photos from Minin’s Odnoklassniki account, posted in 2015 and retained in archives, now deleted.

It is unlikely that Minin and Moiseev met during their army service, as while Minin served, Moiseev was still at the military university in Tyumen. It is more likely that Minin was recruited by GRU independently, and later teamed up with Moiseev to provide plausible cover for his international travel.