The VNIIFTRI Data Leak Part 1: JSC ZASLON and the circumvention of sanctions
Dearest gentle readers, the Under Your NoZ team is back with a brand-new investigation!
While we had the privilege to gain access to some exclusive documents from whistleblowers (and we can’t thank them enough for that), today we would like to get back to some pure OSINT work through a very interesting study case: the VNIIFTRI data leak.
Its main target is Russia’s VNIIFTRI but it also exposes the institute links to some shady front companies involved in sanctions circumvention, such as JSC ZASLON.
What makes VNIIFTRI an OSINT case study?
In May 2026, multiple cyber threat intelligence (CTI) sources and websites flagged a VNIIFTRI data leak on Dark Forum. The hacker dropped a free sample of the data, and naturally, we couldn’t resist! Our team got a secured access to this sample and started to investigate.
We’ve previously mentioned in our investigation on Chimmed how data leaks can serve as a valuable OSINT material. This time, however, the leak isn’t just a supporting element, it’s our primary focus.
Over the past few months, we’ve analyzed thousands of documents from the VNIIFTRI leak. Among them, we identified multiple files exposing connections between VNIIFTRI and Russian companies actively bypassing sanctions! Yes, it’s our ALL-TIME favorite sport, so let’s expose them!
The sample was huge, so we’ve structured our findings into a series of articles, each one dedicated to a single company.
What is VNIIFTRI?
VNIIFTRI (INN: 5044000102) stands for the All-Russian Scientific Research Institute for Physical-Engineering and Radio Technical Metrology (Всероссийский научно-исследовательский институт физико-технических и радиотехнических измерений - ВНИИФТРИ). It operates as Russia’s State Scientific Metrology Institute.
Its headquarters are located in Mendeleyevo (just outside Moscow), but VNIIFTRI also has several labs and facilities all over Russia.
VNIIFTRI is closely tied to the Russian Federal Agency for Technical Regulation and Metrology – Rosstandart (Федеральное агентство по техническому регулированию и метрологии - Росстандарт). This agency is responsible for ensuring measurement uniformity, developing and maintaining state standards, and advancing new measurement techniques.
What does Meterology has to do with our usual suspects? Here it is: both VNIIFTRI and Rosstandart are under EU sanctions since 2022 for their involvement in Russia’s invasion of Ukraine.
VNIIFTRI and Rosstandart are heavily involved in developing technologies to enhance the drones used by the Russian military on the battlefield, as well as Russia’s military space program.
JSC ZASLON: Exporting Dual-Use Material through China
Meet JSC ZASLON (INN: 7826092350) - АО ЗАСЛОН, a company based at Koli Tomchaka St, 9, Saint Petersburg. Officially, it describes itself as “a leading Russian engineering company specializing in the development and manufacturing of aviation, maritime, and land-based systems.”
What they conveniently omit? Their role in sanctions evasion schemes.
JSC ZASLON is already sanctioned by the OFAC but the EU? Not yet. That might be about to change.
In February 2026, JSC ZASLON sent VNIIFTRI a proposal, a document titled 469_АО Заслон.pdf in the sample, for different types of electronic components.
The company doesn’t just offer parts, it openly markets its expertise in sanctions evasion, sourcing components from European and U.S. manufacturers through a network of Chinese institutes and companies acting as intermediaries.
This clandestine supply chain eliminates the need for VNIIFTRI to navigate multiple intermediaries, significantly reducing both procurement time and costs.
So, what does this specific document say? In short: Since 2022, JSC ZASLON has proudly accumulated “significant experience” in building its own procurement networks for foreign electronic components and microelectronics, including those subjects to Western export controls. Periodt.
The letter is signed by “E.O Ivanov”, a name we investigated but which unfortunately remains a mystery. If you have any leads, we’d love to hear from you at underyournoz@protonmail.com.
In another invoice (document 651__652_АО Заслон.pdf) from February 2026, JSC ZASLON sold noise generators and horn antennas to VNIIFTRI. What are these devices used for? Based on our research, horn antennas are used to measure electromagnetic radiation as well as to calibrate other measurement systems. They can also be employed in radar and communication systems. Noise generators can be used to jam signals in electronic warfare applications, such as those involving drones. All of this appears highly relevant for military use.
This document reveals additional key details: ZASLON’s bank account information and the identity of its Chief Technology Officer named Anatoliy Igorevich Anisimov. We’ll talk about him later on but let’s first focus on…
Beyond this revealing document, what else can OSINT uncover about JSC ZASLON? Let’s find out!
The ZASLON Franchise Model
Digging a little bit on ZASLON’s official website, we found out that the company operates on a franchise system, meaning any company joining the system brings its own products, network an access to the market, but can also enjoy ZASLON’s. You can easily find on ZALSON’s website what’s required to become a part of the ZASLON family.
Why does this matter? We discovered ZASLON is actually bragging about its ability to provide sanctioned Western electronics. With more franchised companies joining its network, each new partner becomes another node in Russia’s sanctions-evasion machine.
Tracing the franchise network, we uncovered that JSC ZASLON’s operations extend far beyond Saint Petersburg. Thanks to its partners, the company now has a foothold in Krasnodar, Stavropol, Ufa, Petrozavodsk, Kazan, and Nizhny Novgorod. The kids are alright, thank you.
https://www.retail.ru/rbc/pressreleases/ao-zaslon-zapuskaet-sobstvennuyu-franshizu-v-sfere-vysokotochnogo-mashinostroeniya/
https://tadviser.com/index.php/Company:Zaslon,_St._Petersburg
Starting with Open Sanctions’ data, we walked the OSINT trail to ZASLON’s CEO: Andrei Igorevich Lyubimov. His profile was our first lead after combing through the company’s website.
We couldn’t unfortunately uncover further details about him. Someone seems to be careful about his online presence. If you’ve got leads or insights about Andrei Igorevich Lyubimov, feel free to contact us!
ZASLON's merch
Reaching a dead-end with its CEO, we turned our attention to ZASLON’s domain (zaslon.ru) and ran a WHOIS lookup, revealing several nameservers linked to the company.
From one of them (ns2.onegroup.ru), we found four domains:
• zaslon.com redirects to zaslon.ru (a classic loop)
• sk-atlas gave us nothing
• r-focus is our winner and appears to sell ZASLON-branded merchandise
It seems the two websites are deeply linked. Click the "Privacy Policy" link on ZASLON’s website, and you’ll land on… r-focus.ru’s privacy page. Same content, different domain. Coincidence? We don’t think so.
But here’s where it becomes really interesting: r-focus.ru doesn’t just sell merch, it’s a treasure trove.
The site openly lists:
• ZASLON’s bank account details
• Multiple contact points (emails, phones)
• An active Telegram account tied to the company
Who’s behind ZASLON?
Beyond its elusive CEO, who’s working for the company? First, ZASLON is very active on its VK account. A useful reminder for OSINT lovers: you’re looking for Russians, go to Russian social networks first.
But ZASLON is also on LinkedIn, where it lists only 61 associated members, and this is where it gets funny guys.
One employee’s LinkedIn profile caught our attention. Svetlana Anisimova seems to be working for ZASLON but also for another company at the same time! This one’s named Zavod Leninetz.
Digging a little bit further we realized Zavod Leninetz was renamed to ZASLON.
How do we know that? Because the two companies share the same KPP number: 781001001. The KPP number also known as the registration reason code is a 9-digit code assigned to companies in Russia to identify the specific regional tax authority where they are registered.
We traced the company’s history under its old name, and who should reappear but Anatoly Anisimov, ZASLON’s Chief Technology Officer. Small world, isn’t it?
One last funny thing? Zavod Leninetz website is still live, but now, it’s all about cryptocurrency. A coincidence? Or just another way for ZASLON to dodge sanctions and get paid under the radar? Draw your own conclusions.
We could go on and on and on! There’s plenty more in this leak to expose, but we’ll save that for our next piece. You’d get bored if we dumped it all at once!
Share our work and follow us on our socials. This is what really help us in getting bigger to put more and more pressure on Russia’s war machine and its affiliates.
If you want to share your story or some exclusive content, write at: underyournoz@proton.mail.com. Anonymity guaranteed, no exceptions.
