InformNapalm @InformNapalm

На початку 2026 року Чингис Дамбієв заявляв, що «Мангаси» вже здійснили понад 500 бойових вильотів для ударних і логістичних завдань. Для порівняння, українські Vampire на той момент здійснили вже понад 2,5 млн бойових вильотів.

Важкі українські коптери, які росіяни узагальнено називають «Баба Яга», протягом війни стали для них окремою проблемою. Російські військові автори неодноразово критикували відставання РФ у цьому класі БПЛА та відсутність масового аналога українського Vampire.

18 вересня МО РФ вперше показало «новий» важкий гексакоптер «#Мангас». Але його публічний слід почався значно раніше. Z-блогери позиціонували його як «аналог Баби Яги». InformNapalm простежив весь ланцюг у новому #OSINT матеріалі: informnapalm.org/ua/mangas-heav…

@istories_media А могли ведь нарисовать себе и 99%? Как-то они скромненько... 😁 наверное вбрасыватели сбились со счета и отвлеклись на просмотр видео с салютами от ПВО в Москве.

The best illustration of today’s news about Realpolitik 2026. #Russia’s State Duma elections in Moscow were marked with a festive fireworks display courtesy of Russian air defense 🎆 Meanwhile, the Russian Defense Ministry officially stated that Ukrainian drones “did not reach their targets.” So apparently, Ukraine had nothing to do with the fire at the #Moscow oil refinery this morning. The dry grass simply caught fire from the “fireworks”… This is, of course, a satirical post. But as the saying goes, every joke contains only a grain of jest — the rest is truth.

🇺🇦 “Glory to Ukraine!” How some Russians who managed to leave the country are voting. Ilya Makarov, a former candidate for Moscow municipal council, published a photo of his ballot in the Russian State Duma #elections: he marked every party on the ballot and wrote “Glory to Ukraine” across it. “I don’t want to choose between different kinds of shit, and I don’t know how to,” he explained. In 2022, Makarov ran in Moscow as an anti-war candidate. He left Russia in 2023 and is now voting at an overseas polling station in Germany. It is a striking illustration that some Russians with a clear anti-war position have come to recognize a basic reality: Ukraine’s victory is the only effective path toward dismantling not only the Kremlin’s regime, but also the system of internal occupation that #Putin and his entourage have imposed on #Russia. If we see many more such performances at polling stations abroad — and if they are widely shared online — they could also have a certain cognitive effect. Even if only symbolic, and even if primarily through the attention they receive from foreign media.

keyboard_arrow_left Previous keyboard_arrow_right Next

6/6 One more detail caught our attention: this appears to be the first public Wild Hornets post in which #STING carries the additional “S” designation. We suspected it was a new, faster variant adapted to a new class of targets. The developers later confirmed to InformNapalm that our observation was correct. The broader lesson is straightforward: Air defense cannot prepare for the drone threat of two years ago. Russian strike systems are evolving now, and the interceptor adaptation cycle has to move even faster. Read more on our Telegram channel: t.me/informnapalm/2…

5/6 The wider trend is already visible. On Sept. 18, 46 of 93 #Russian UAVs were reported as jet-powered — almost 50%. Today, #Ukraine’s Air Force said that half of the #Shahed-type drones used in the attack were jet-powered. This is no longer an experimental niche.

1/6 🇺🇦 #Ukraine’s new STING S interceptor has reportedly taken down a #Russian Geran-5 jet-powered strike drone. The @wilendhornets published footage showing the “Rubin” crew of the 1020th air-defense regiment intercepting the target.

It is probably worth explaining separately why, by our internal estimate, the share of cyber operations that eventually become public has fallen from roughly 10% to around 1%. On paper, that is an almost tenfold decline. But it does not mean fewer operations are taking place, or that their quality has decreased. The reason is the changing nature of the war — and the way acquired intelligence can now be used. Before Russia’s full-scale invasion, Ukraine had far fewer options for kinetic action against military and industrial targets inside Russia. The war in Donbas was constrained by ceasefires and force-separation arrangements, while long-range strike capabilities of today’s scale simply did not exist. As a result, there was often little additional value in keeping many cyber cases under strict OPSEC for long periods. The collected material was therefore more frequently moved into the public — or cognitive — domain. Today, the situation is different. The growing range and precision of strike capabilities, the possibility of further exploiting identified infrastructure and networks, and the direct transfer of evidence to Ukrainian and partner institutions responsible for sanctions, export controls and other forms of pressure have dramatically increased the value of keeping such material non-public. A cyber operation may therefore produce tangible effects months or even years later — without any publication at the time the data is obtained. A good example is #OKBMLeaks. informnapalm.org/en/okbm-leaks-… The compromised documents exposed not only details of Russian defense projects, but also specific production bottlenecks and mechanisms used to bypass sanctions. The information was used for many months in the interests of Ukraine’s Defense Forces and partner countries before part of it was eventually made public. And on 23 October 2025, OKBM was added to the EU’s 19th sanctions package. So today, the absence of a public article about a cyber operation often does not mean that “nothing happened.” Quite the opposite: it may mean that the acquired data still has practical value — and is continuing to work outside the public domain.

Operation “Poseidon”: what is known about the claimed compromise of Russian naval developments Our friends at Ukrainian Militant have announced the completion of a large-scale cyber operation codenamed “Poseidon”, which they say resulted in the acquisition of a substantial archive of documentation from Russian entities involved in naval navigation, hydrography, hydroacoustics, command-and-control systems, and underwater technologies. The organizations named include the Rubin Central Design Bureau for Marine Engineering, Malachite, Elektropribor, Okeanpribor, the State Research Navigation and Hydrographic Institute, and other structures linked to #Russia’s defense industry and Ministry of Defense. The published screenshots do appear to contain documentation related to different generations of systems and platforms, including Project 636.3 and Project 955M submarines, Project 22350 frigates, and navigation systems such as Andoga-M2, Chardash, KAMA-NS-VK, Simfoniya-PM, among others. Some of the documents are dated 2024–2026, suggesting that the material is not limited to historical archives but may also concern ongoing or relatively recent development work. At the same time, InformNapalm traditionally distinguishes between claims made by a source and information we have been able to verify independently. We have maintained friendly contacts with Ukrainian Militant for a long time and have previously worked with materials originating from several joint cyber cases. However, regarding “Poseidon,” we have not seen the complete dataset. We had access only to several documents containing the details of one Russian military structure mentioned among the compromised entities. The rest of the archive was not shared with us due to strict OPSEC restrictions. Therefore, at this stage, we cannot independently assess the full size of the dump, its structure, integrity, or the complete claimed scope of the compromise. This is not a matter of distrust toward friends and colleagues. In operations of this type, the beneficiaries and custodians of the acquired intelligence determine when, with whom, and to what extent such data can be disclosed. Moreover, we would fully understand Ukrainian Militant if a significant part of the “Poseidon” archive remains unpublished until the end of the war, or until the information loses its operational value. This is consistent with InformNapalm’s own experience. According to our internal estimates, in earlier years approximately 90% of cyber cases never reached public disclosure because of OPSEC considerations and the continued exploitation of identified networks, contacts, and infrastructure. In recent years, this tendency has become even stronger, with the proportion of materials remaining outside the public domain approaching 99%. However, the very fact that “Poseidon” has now been publicly announced suggests that at least part of the OPSEC restrictions surrounding the operation has already been lifted. In other words, the operation appears to have moved from a completely closed phase into a phase of cognitive pressure against the managers, military personnel, engineers, and organizations whose documents or systems may have been compromised. The Russian side has been shown evidence of penetration and selected fragments of the acquired archive — but it has not been given an answer to the most important question: What exactly was compromised? This preserves a kind of “fog of war.” Russian organizations can see the names of enterprises, systems, projects, and individual documents, but they do not know the actual depth of penetration, the full list of compromised materials, the extent to which internal communications and relationships were mapped, or what portion of the information may already have been exploited outside the public domain. For Russian military structures, intelligence services, and defense-industrial enterprises, this potentially creates a much broader requirement for internal audits and counterintelligence measures than could be inferred from the screenshots alone. Under such conditions, uncertainty itself becomes a separate operational effect. If #OPSEC restrictions eventually allow a larger portion of the archive to be released for public analysis, InformNapalm has already expressed its readiness to conduct an independent #OSINT and technical verification of the material. Our interest would not be in simply publishing an archive. The real value would lie in reconstructing the entire ecosystem behind it: developers, industrial cooperation chains, specific systems and components, naval and submarine projects, testing programs, modernization efforts, the actual status of development work, and the relationships between the organizations involved. If such an opportunity emerges, the “Poseidon” materials could become the foundation for a major international investigation, which InformNapalm would traditionally adapt and distribute in more than ten languages.

keyboard_arrow_left Previous keyboard_arrow_right Next

New article today from InformNapalm on the boundary between #OSINT, the public picture of the frontline, and OPSEC. Using concrete cases, we show how open-source analysts can sometimes identify battlefield changes before they appear in official reporting — and why public availability does not automatically remove #OPSEC risks. The article is currently available in Ukrainian. The infographic is bilingual, and translations into multiple languages will follow. informnapalm.org/ua/osint-opsec…

keyboard_arrow_left Previous keyboard_arrow_right Next

Important mapping by @TheStudyofWar of #Russia’s global cognitive #warfare infrastructure. A useful complementary layer: in 2024, InformNapalm and Insight News mapped a network of #European media websites amplifying Russian narratives through shared content, citations and referral traffic. Our OSINT investigation: informnapalm.org/en/website-net…

Institute for the Study of War @TheStudyofWar

5 days ago

ISW is releasing a new version of its interactive map displaying the pillars of Russia’s cognitive warfare infrastructure. Russia uses cognitive warfare to shape the decisions and will of its opponents. The Kremlin is expanding its network of global media partnerships, state-run

22 436 873 196K 426

Russia’s FSB has announced the detention of a 47-year-old resident of occupied Sevastopol, accusing him of attempting to organize the smuggling of weapons and military equipment through third countries. Publicly, the FSB is framing the case as an alleged attempt to “supply weapons to Ukraine via third countries” and claims that the detainee had contacts with the Ukrainian side. At the same time, no publicly available evidence has been presented so far showing that Ukraine was in fact intended to be the final recipient of the weapons. It therefore cannot be ruled out that the reference to Ukraine serves primarily a propaganda purpose. Ukraine receives substantial quantities of modern weaponry through official channels from dozens of countries, so a complex smuggling scheme involving Russian weapons routed through third countries appears, at the very least, questionable from a practical standpoint. The broader circumstances of the case — Russian weapons, occupied Sevastopol, third countries, and international trafficking routes — bear a much closer resemblance to the scheme described by InformNapalm and the 256th Cyber Assault Division in a January CYBINT investigation: “We Could Even Smuggle a Nuke”: How Officers of Russia’s 291st Regiment and Vostok-Akhmat Set Up an Arms Smuggling Network Through #Crimea. The investigation is available in 13 languages worldwide 🌎 informnapalm.org/en/we-can-smug… The intercepted correspondence examined in that investigation pointed to weapons being diverted from Russian military units through occupied Crimea and then moved onward to black markets in #Russia, #Europe, Western #Asia, and Africa. There is currently no direct evidence linking the two cases. However, it is entirely possible that what we are seeing here is not so much a “fight against arms supplies to Ukraine” as an attempt by the FSB to shut down one of the illicit trafficking channels and the financial flows associated with it, while Ukraine is invoked in the public version of the case as a convenient explanation for the Russian domestic audience. In any case, the very existence of such a case is another indirect indicator that the transnational black market for Russian military weapons — and the routes running through third countries — is a real problem that Russian security services are being forced to address.

One day before Russia’s elections, a major leak involving the internal infrastructure of GAS Vybory 2.0 came to light. Ahead of voting in Russia’s State Duma elections on September 18–20, @istories_media published an investigation based on nearly 200 GB of internal materials from the developers of GAS Vybory 2.0, Russia’s state automated election system. The archive includes technical documentation, source code, internal chats, and recordings of working meetings. The materials were provided to the newsroom by anonymous hackers operating under the CikLeak brand. Important Stories says it verified the authenticity of the archive and asked independent technical and electoral experts to examine it. These State Duma elections will be the first federal election conducted using the new GAS Vybory 2.0 system. One of the most significant findings concerns the handling of election protocols. According to the internal documentation, precinct-level results can be entered into GAS manually, without an automatic cross-check against the original signed paper protocol. Even protocols imported via QR code can subsequently be edited manually, although the system retains previous versions and records which user made the changes. Separately, the journalists found that the code of the module interfacing with Moscow’s remote electronic voting system (DEG) locates the electronic-signature files associated with election results but does not actually verify their validity before allowing the XML result files to proceed through the system. This finding concerns the Moscow module specifically and does not establish that the same issue exists in the federal DEG system. The scale of the leak is further illustrated by a dataset containing 111.3 million voter records from RUIP — the Registry of Participants in the Electoral Process — including names, dates of birth, registered addresses, and assigned polling stations. According to the metadata, the files were exported in July 2026. In most regions, the number of records differs from the Central Election Commission’s official figures by no more than 1%. Important Stories also identified at least 104,000 records belonging to people listed as deceased in other registries in the regions examined by the journalists. The leaked documentation further indicates that privileged users can manually upload CSV files containing applications for participation in remote electronic voting. The available documentation does not indicate that an electronic signature is required to verify the origin of such files. InformNapalm’s OSINT review of the screenshots published by CikLeak also supports the authenticity of at least part of the leaked material. Component names such as PAIP, RUIP and NSI correspond to the official GAS nomenclature, while the DevOps screenshots show Argo CD, Nexus, Helm/Kubernetes and repositories hosted under the cifro. tech domain. These correlations indicate access to the system’s development and deployment environment. They do not, by themselves, prove access to the production environment used to process actual election data. Ella Pamfilova, head of #Russia’s Central Election Commission, said on September 17 that the commission had prevented what she described as a “large-scale #cyber aggression” targeting GAS Vybory and the remote voting system the previous day. She did not identify who was allegedly behind it or specify what had been compromised. One metric worth watching in these elections will be United Russia’s officially reported vote share, alongside the aggregate results of other parties and candidates. With political competition heavily restricted and many anti-war candidates excluded, votes cast for alternatives to the ruling party may provide one of several quantitative indicators of political dissatisfaction. They should not, however, be treated as a direct measure of the size of Russia’s protest electorate.

Важные истории @istories_media

5 days ago

Новую систему для выборов в Госдуму делает «Цифротех» — компания, созданная под один этот проект. @istories_media изучили ее внутренние документы и обнаружили убытки в 1,7 млрд рублей, штрафы от заказчика, зарплаты до миллиона и сокращения сотрудников 🔽 storage.googleapis.com/istories/stori…

1 10 21 4K 2

217th or 237th? An Interesting OOB Signal on the Lyman Axis Requires Further Verification. OSINT analysts continue to track not only changes along the line of contact, but also the order of battle (OOB) — the composition, subordination, and areas of operation of Russian units. This picture is built by cross-referencing dozens of open-source indicators: geolocated photos and videos, publications by Russian units themselves, tactical vehicle markings, data on casualties and awards, the nature and geographic patterns of artillery, UAV, and aviation activity, satellite imagery, and other geospatial indicators. At the same time, individual indicators do not always allow a specific unit to be attributed with certainty. An open-source OOB is therefore not a precise “real-time table of organization,” but rather an analytical model that is continuously refined and may at times contain contradictory signals. This is exactly the kind of case that has now emerged around the 3rd Motor Rifle Division of Russia’s 20th Combined Arms Army, which is operating on the #Lyman axis. On September 16, military analyst Kostiantyn Mashovets, describing the Russian grouping in the area, listed the following units as part of the 3rd Motor Rifle Division: — 252nd Motor Rifle Regiment; — 362nd Motor Rifle Regiment; — 752nd Motor Rifle Regiment; — 217th Tank Regiment; (?) — 99th Self-Propelled Artillery Regiment. The Institute for the Study of War (ISW) @TheStudyofWar also drew attention to this reference. Its analysts noted that this was the first evidence they had observed of the 217th Tank Regiment and the 99th Self-Propelled Artillery Regiment operating in Ukraine, and assessed that the former may be a reconstituted Soviet-era unit. However, a closer examination reveals an important problem. We have found no independent contemporary reference to a 217th Tank Regiment of the Russian Armed Forces outside the “Mashovets → ISW” chain. Moreover, in previous OOB assessments, Mashovets himself listed not the 217th, but the well-documented 237th Tank Regiment as part of the same 3rd Motor Rifle Division. For example, on March 25, 2026: 3rd Motor Rifle Division — 252nd, 362nd, and 752nd Motor Rifle Regiments, 237th Tank Regiment. And again on June 3: 3rd Motor Rifle Division — 252nd, 362nd, and 752nd Motor Rifle Regiments, 237th Tank Regiment. The 237th Tank Regiment, military unit 91726, has long been documented as the organic tank regiment of the 3rd Motor Rifle Division. As early as 2017, InformNapalm described the structure of the newly formed division in Valuyki and Boguchar. At the time, its composition included, among others: — 237th Tank Regiment; — 99th Self-Propelled Artillery Regiment, military unit 91727. Incidentally, the 99th Self-Propelled Artillery Regiment is also not a “new” unit in the context of this war, as one might infer from ISW’s wording. InformNapalm documented the regiment and its servicemen before Russia’s full-scale invasion. In 2018, InformNapalm, in particular, investigated Yevgeny Silkin, a serviceman of the 99th Self-Propelled Artillery Regiment. Following the publication, hacktivists from the Ukrainian Cyber Alliance found correspondence that could indicate that the Russian sergeant had been deployed to Donbas. Therefore, ISW’s phrase about the “first evidence ISW has observed” should be understood specifically as a description of ISW’s own body of observations, rather than as a claim that the 99th Self-Propelled Artillery Regiment had never previously appeared in open sources. As for the number 217, a tank regiment with this designation did indeed exist in the Red Army — in 1941, as part of the 108th Tank Division. The 217th Tank Regiment was later reorganized, but at present there is no open-source evidence of organizational continuity between that formation and the modern Russian Armed Forces. At this stage, several explanations therefore remain plausible: — a typo: 217th instead of 237th; — an actual reorganization, renumbering, or formation of a new regiment that has not yet produced sufficient open-source traces; — Mashovets is relying on his own source of information that has not yet been disclosed publicly. This case illustrates one of the basic principles of #OSINT verification: the appearance of information in an authoritative analytical report does not constitute a second independent confirmation if that report explicitly relies on the same original source. Until an independent reference, document, photograph, video, military unit number, personnel data, or another verifiable trace emerges, the 217th Tank Regiment should be treated as an unconfirmed element of the current OOB of the 3rd Motor Rifle Division. InformNapalm will continue monitoring for independent confirmation of this unit’s existence. Kostiantyn Mashovets himself may also clarify whether this was simply a typo in the regiment number that was subsequently reproduced in an ISW report, or whether he has non-public information indicating that Russia has formed or reconstituted a 217th Tank Regiment. All additional source links are included in the post: t.me/informnapalm/2…

We also invite our readers to follow our Ukrainian-language #Telegram channel, where we publish more #OSINT and #CYBINT observations, findings, and updates every day. t.me/informnapalm

InformNapalm @InformNapalm

6 days ago

Revisiting the 8 Sept 2025 strike on #Russian command posts in Donetsk, we identified a 41st Combined Arms Army HQ officer killed in the attack — a case study in iterative #OSINT. The article is available in 10 languages; switch versions below the headline.

1 27 151 23K 26