Chasing Russian Assets Using OSINT: A Case Study by UnderYourNoZ
No(more)Z
They are acting right under your nose, without you noticing. Yet they contribute, directly or not, to Russia’s big plans regarding our societies and the whole world equilibrium/balance. Who are they? Sometimes just individuals, be them Russian nationals or your own fellow countrymen and women, sometimes whole companies playing Russia’s long run game. Starting in Ukraine where the war is raging for nearly three years now.
What’s troubling is that we don’t act more despite the fact that you just need to know who, where and what to look at. Because as we told you: these agents of Russia are acting right under your nose. Therefore, we decided that we might help expose these people and companies, using what we do best: OSINT! A bunch of relentless sleuths, of curious minds who like to dig up gems and reveal Russia’s dirty secrets through the power of open-source craft.
As we are stronger together, we invite you to contribute to this effort: come discuss with us on our socials (Discord, Telegram), subscribe to our Medium and X accounts and above all share our articles on your own media so that Russia’s warmongers can’t hide anymore. You feel like you can do more by giving us tips on individuals or companies playing dirty tricks in the shadows: reach out using our Proton mail address: underyournoz@proton.me.
Introducing the Kornienko “drone” sisters:
This little introduction being made, let’s get practical. As a warm up, let’s make an example of the lot of things you can actually dig up when you know where to look and how to search. Ever heard of the drone sisters?
A year ago, the Insider wrote a compelling article entitled “No volunteers in their own country: How foreigners in Russia raise money for the war with Ukraine and engage in pro-Kremlin propaganda” (link) about claimed volunteers engaged in fundraising for the benefit of the Russian army in Ukraine. They investigated John Robles, a native American Puerto-Rican, the serial liar Frenchman Adrien Bocquet and Valentina and Ekaterina Kornienko.
The latter, two Ukrainian nationals born in Makiivka in the separatist Donetsk region, started to shine by providing supplies to the Berkut special forces cracking down on protesters during the Maidan events in Kyiv. Meanwhile they acquired Russian passports and became close to Igor Girkin, self-claimed Defense minister of the LNR.
Pictures of the sisters disclosed by The Insider
Through flight data, The Insider proved that the sisters consistently travelled between Rostov-on-Don where they now seem to live, Moscow and Saint Petersburg in order to acquire military gear. All of this was promoted on the sisters’ socials (we’ll come back to this soon!) and very easy to check using OSINT.
The sisters were nicknamed after Autel Robotics offered them a significant discount on their drones to be tested in combat. They were also trading with Chinese companies to bypass sanctions and provide the separatists backed by Russia with aircraft defence systems.
A picture at Autel Robotics headquarters can be found on the Vkontakte page administered by the sisters.
OSINTing the sisters: there’s more!
The Insider did a really good job but we thought we could definitely push further using OSINT. One can easily find more information on these two blonds thanks to some useful tools and A LOT of curiosity! In a few hours of work, here’s what UnderYourNoZ was able to unravel on the sisters to add to The Insider’s article.
Whenever you have someone’s name in Russia, a good resource to check is the website list-org.com.
A simple query at the full name of Ekaterina hits 7 results for individuals and 8 for organizations. Same query with Valentina hits 2 and 2. The INI (tax identification numbers) of the sisters is displayed.
Comparing the two profiles, one common “foundation” can be identified: the Dobrorussiya charity (INN: 6150079755). Registered on the 25th of May 2015, it used to be the front NGO for the sisters’ activities until it was stopped by court decision of the 5th of April, 2019. They declared that they were providing “financial services”, a strange name for fueling a conflict.
Going through the list-org files, the association presided between 2015 and 2019 by Ekaterina was located at two spots: 344007, Rostov-on-Don, Defense St., 49 and 346400, Rostov region, Novocherkassk, St. Pervomaiskaya, 164, Apt. 32.
Their Vkontakte account seem pretty inactive lately but can still easily be found: @drobrorussiya1. The phone number of Dobrorussiya (+79897053575) is linked to a Telegram account now associated to “Ksenia Mihailovna”, someone who’s not on the list of the charity’s founders. One can easily imagine that the account has been taken over by someone who’s not involved in the sisters’ war effort.
The Dobrorussiya VK account
The new owner of the Telegram account linked to Dobrorussiya’s phone number
It’s also pretty easy to found the main partners of the sisters in the foundation, people that should probably be good candidates for sanctions, if not the case yet: Zaryanov Roman Mamedovich, Korzhov Evgeny Evgenevich or Tarasenko Grigory Alexeevich.
Ekaterina’s social medias can easily be identified on Vkontakte (https://vk.com/kornienko_ekaterina) and Facebook (https://ru-ru.facebook.com/kornienko.ekaterina).
She’s also presented as the head of the press service of Kassad (or Cassad) on the “Voice of Sevastopol” project page. Back to list-org, LLC IAC Kassad (INN: 9203000411) is indeed listed among the companies linked to Ekaterina. Registered in May 2014, Kassad was directed by Evgeniy Igorevich Istyagin (INN: 920456106240) until it supposedly stopped its propaganda effort in January 2018. It was standing in Sevastopol, precisely at the following address: 299012, Istomina St, Building 25. Among the founders are also Kozhanov Yakov Yurievich, Proshchenko Peter Vladimirovich and Rohzin Boris Alexandrovich.
Two phone numbers can be identified linked to Ekaterina through the Kassad trail: +380997099710 and +79160882203. These numbers weren’t linked to social media accounts. But we kept digging. Through an article on the website nts-tv.com, we identified more phone numbers linked to the sisters: +79889964626 and +79185778057. The material they were asking isn’t usual for an NGO as one could possibly imagine a charity might need more diapers and food than thermal imagers and surveillance equipment.
Once you check for the linked Telegram accounts, one might even think that these are actually their personal profiles.
To complete our panorama, a good way to find data on Russia’s supporters is to check Myrotvorets' website. Though one should always be careful and cross its data with other online sources as it assumed a very partisan stance. This helped us in finding some information on the sisters:
- The date of birth of the sisters: 05/12/1992 for Ekaterina and 07/07/1996 for Valentina.
- An ok.ru profile for Ekaterina: ok.ru/profile/577158316037
- Some more numbers: +380713325103, +380991099710, +79160882203, +380505752938 and +380713325104 (Valentina for the latter). None is linked to a Telegram account. The sisters might have given up on these numbers after they were disclosed by Myrotvorets.
- Media channels on Telegram and Vkontakte used by the sisters to keep fuelling the destabilization of Ukraine by the Russian government: t.me/katya_valya_dnr (32,727 subscribers), t.me/volonteri_rf (“only” 90 subscribers), t.me/moscow_katya_valya_dnr (422 subscribers) and https://vk.com/katya_valya_dnr (191 followers).
We could keep on pivoting for ages in order to track the sisters and their whole network online (including Igor Viktorovich Puzik, husband of Ekaterina) but we don’t want you to get bored. This was just a foretaste of how you can expose the malign actions of pro-Russian activists from home, using the good resources and your will to not let them get away.
If you want to help or just read more (oh yeah there’s more to come), join us on our Discord server and our Telegram channel. Follow us on X and share our content as much as possible so that they can’t hide under your noz anymore. Tips on where to look will always be welcome at underyournoz@protonmail.com.
