Russia Bypassing Sanctions: Who’s Behind the Chimmed/Rusmedtorg scheme?
A few weeks ago, the UnderYourNoZ team introduced you to Chimmed and Rusmedtorg, two Russian companies working together in order to design an efficient scheme to pursue their business with Western companies while being under sanctions of the OFAC since at least June 2024.
We received exclusive documents from these companies into our mailbox (contact underyournoz@protonmail.com for any anonymous tip), sent by a whitsleblower we will call Nostril. Nostril’s preciously provided evidences highlighting that Chimmed (INN: 7724709468 and KPP: 772401001) became Rusmedtorg<(INN: 7727218122 and KPP: 771601001), or at least was trying to make it look like it. Here, we’d like to thank him once more for his act of bravery in the midst of an atmosphere where cowardness often prevails.
After assessing the authenticity of the documents, we identified mistakes into invoices sent to Chinese and Indian intermediate companies like Puretek, SynZeal and Chromatography World or email exchanges between suppliers and Rusmesdtorg employees writing from… Chimmed email addresses. Those documents illustrate the solid link between them.
But who’s behind the scheme? How to identify and learn more about them? Today let’s focus on some of Chimmed and Rusmedtorg employees — because they work for both, don’t they? — and how to use OSINT to expose their involvement into this scheme!
What could we learn on Chimmed-Rusmedtorg employees using OSINT?
Our starting point was the mail addresses used by the Chimmed employees to deal with their Chinese and Indian counterparts: miroshnikov@chimmed.ru & standart@rmedtorg.ru that we know was used by Polina Derevyannykh.
Our search for Ruslan Miroshnikov online felt short. We failed to identify social media profile attached to this address or to his name. The mail address being a corporate one, this might not be so surprising. First step was to look for any personal email address. Here we want to introduce a sometimes hotly debated but — according to UnderYourNoz — very useful OSINT tool to pivot on someone: data leaks. UnderYourNoZ gained access to a famous 2012 leak from Russian social media platform Vkontakte (i.e. their Facebook lookalike) and identified miroshnikov_ruslan@mail.ru, an email address linked to a VK account.
We also found a quite empty LinkedIn account linked to someone named Ruslan Miroshnikov but the company he worked for didn’t fit the profile we were after. A search for Ruslan on Ok.ru, a very common social media in Russia, left us with many accounts bearing the name but without clear proof that any of it belonged to someone working for Chimmed or Rusmedtorg. We decided to stop there, a good OSINT investigator also needs to know when to stop digging.
Probably not the Ruslan we are looking for
Our quest for Ruslan ended up being quite disappointing but we were luckier with Polina Derevyannykh. Through her online activity, we managed to establish that she was born in October 1997 and is probably from Perm. She’s most likely married to a man named Nikolay Kovalenko who appears many times in her posted pictures on her Instagram @polina_malina00.
Her profile on the Russian platform Needspec.ru, a place to look for private lessons in any sort of academic fields, tells us she has been an English tutor for 9 years and graduated in chemistry studies from Mendeleyev (St Petersburg) in July 2019. She also attended an “Higher School of Economics.”
Polina’s NedSpec.ru profile
On her tutor profile, Polina states she’s a devoted traveler for a work, something that also seems true in her personal life as we manage to identify travels to Bangkok, Tashkent, Shanghai, Tokyo, Antalya, Marmaris, Minsk, New Delhi, Prague and Dresden!
Like many Russians, Polina also have a VK account.
We wanted to understand the company better and look for more people, especially those who could be involved in trading with Western companies. Using a sock puppet on b2b.house, a website dedicated to company information, we gained access to various phone numbers and email addresses belonging to Chimmed employees.
Screenshot from email provided by Nostril
But it was complicated at first sight to determine their position, so we kept looking with online queries on the domain name “*@chimmed.ru” and discovered a PDF file entitled “USP authorized distributors”. The sales director for Chimmed LLC is displayed there as Olga Gurentsova, using gurentsova@chimmed.ru and 12@chimmed.ru email addresses.
Screenshot from email provided by Nostril
The position seems to fit someone being the public face of the company, to client companies and intermediaries like USP. We focused our effort on finding more about her, and here’s what we found!
First, Olga is indeed working for Chimmed, at least her partially filled LinkedIn and Facebook profiles say so (NB: LinkedIn is nowadays inaccessible from Russia if not via VPN).
On Russian forums, one can easily find comments on her ethics and behaviour. While some deem her a great “professional” and seem to recommend working with her…
The Chromatography World invoice
Others are quite furious about her behaviour. One more reason to think twice before working with Chimmed-Rusmedtorg!
The Puretek Invoice
We wanted to try to find more on Olga, so we used x-ray.contact/russian-search/ (a website offering the opportunity to search Russian citizens for free, based on an email address, a phone number or a social media account) to do so. Thanks again to our dear OSINTer friends for the tip! Using her working email address (gurentsova@chimmed.ru), we found a phone number: +7 909 661 92 77. Unfortunately, nothing interesting came out of that number.
We’ve tried to find more from that phone number
While looking for our already well known Chimmed employees, we found another interesting lead through a man named Ilya Karzov.
According to his LinkedIn profile, Ilya works for Chimmed as Import Sales Development Manager since June 2022, and he’s working with… Chinese and Indian companies! We are pretty sure he knows SynZeal and Chromatography World very well!
Basic investigation led us to a full name: Ilya Mikhailovitch Karzov and to following email address: karzov@chimmed.ru.
Seems like Ilya won some kind of contest on Telegram
Ilya Karzov is also mentioned on several websites for his academic work and research.
After the employees, we decided to move forward and focused on Chimmed and Rusmedtorg CEOs. It was pretty easy to find them on List-org.
Chimmed’s CEO is named Nikolay Aleksandrovich Tsurkov.
It’s pretty difficult to find more on Nikolay Tsurkov such as a telephone number or any account on social medias. However, we found a few videos where he’s giving interviews or even better, where he’s attending Chimmed’s Christmas Party, enjoy!
You’ll find the full video here: https://www.youtube.com/watch?v=I9Vl0fZy0Lc
Rusmedtorg CEO is named Vladimir Sergeevich Vozhennikov. Unfortunately, we were not able to collect interesting data about him.
What’s next?
This is where our investigation ends, for now… We expected to find more but sometimes you have to let it go and move on to something else for a better comeback! We are not done with Chimmed-Rusmedtorg and are still working on other shady leads.
As we are currently working on other people and companies, we would like to thank people who gave us a little hand on this investigation. Stay tuned for more content about Chimmed, Rusmedtorg or on another target!
If you want to share your story or send us some information, please write at: underyournoz@protonmail.com
