Ukrainian hackers exposed a Russian weapons smuggling network linked to Russian military officers and the 'shadow tanker' fleet facilitating arms transfers globally, including to terror groups.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

On January 10, 2026, Ukrainian hacker group 256 Cyber Assault Division, in cooperation with InformNapalm and international intelligence partners, uncovered and exposed a covert Russian weapons smuggling network. This illicit operation involves officers of the 291st Guards Motor Rifle Regiment and the Kadyrovite battalion 'Vostok-Akhmat' using Crimea as a hub to transport smuggled arms to Russia and onward to Europe, Western Asia, Africa, and terrorists worldwide by leveraging Russia's 'shadow tanker' fleet. Ukrainian hackers successfully infiltrated the accounts of Russian officers, including Major Yevgeny Dmitriev, platoon commander of the 291st Regiment assault company 'Storm V' active on the Zaporizhia front. They revealed cooperation between Russian military personnel and Kadyrovite representatives in weapon sales. Additionally, Ukrainian hackers conducted a social engineering operation, deceiving the administrators of a Russian military fundraising public group 'Two Majors', redirecting funds to support Ukrainian Special Operations Forces. This intelligence represents critical evidence of Russia’s hybrid warfare involving illicit arms trafficking and covert financial operations supporting aggression in Ukraine and beyond.

Classification

Confidence: High

The event clearly describes hostile Russian activity involving illegal arms smuggling by Russian military personnel and their proxies, uncovered by Ukrainian and allied intelligence, constituting aggressor activities. There is no indication of defense preparations in the report.

Source URL

https://x.com/i/web/status/2009951814586613944

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 4, 2026, 08:36 UTC
Event time: Jan 10, 2026, 11:33 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "66b81d3d-ec3a-433c-ac70-a7689fb6c354",
  "url": "https://x.com/i/web/status/2009951814586613944",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Ukraine",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "shadow tankers",
    "Russia",
    "weapons smuggling",
    "Russian weapons smuggling",
    "Cyber intelligence",
    "Ukrainian hackers",
    "291st Guards Motor Rifle Regiment",
    "Vostok-Akhmat",
    "Shadow tanker fleet",
    "Crimea",
    "Social engineering",
    "inform napalm",
    "Hybrid warfare"
  ],
  "nodes": [],
  "countries": [
    "Ukraine"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Ukrainian hackers from the 256 Cyber Assault Division, collaborating with InformNapalm and the international intelligence community, conducted a cyber intelligence (CYBINT) operation exposing a Russian weapons smuggling group. Officers of the 291st Guards Motor Rifle Regiment and the Kadyrovite battalion 'Vostok-Akhmat' organized smuggling through Crimea, serving as a hub for onward arms transport to black markets in Russia, Europe, Western Asia, and Africa. The operation uncovered the use of Russia's 'shadow tanker' fleet for illicit arms shipments. Compromised accounts include Major Yevgeny Dmitriev, commander of the Russian assault company 'Storm V', involved in the Zaporizhia direction of combat. Cooperation between Russian officers and Kadyrovite fighters was revealed in illegal arms sales. Ukrainian hackers also used social engineering to trick operators of the Russian fundraising public group 'Two Majors' into transferring regiment funds to Ukrainian Special Operations Forces.",
  "summary_short": "Ukrainian hackers exposed a Russian weapons smuggling network linked to Russian military officers and the 'shadow tanker' fleet facilitating arms transfers globally, including to terror groups.",
  "summary_extended": "On January 10, 2026, Ukrainian hacker group 256 Cyber Assault Division, in cooperation with InformNapalm and international intelligence partners, uncovered and exposed a covert Russian weapons smuggling network. This illicit operation involves officers of the 291st Guards Motor Rifle Regiment and the Kadyrovite battalion 'Vostok-Akhmat' using Crimea as a hub to transport smuggled arms to Russia and onward to Europe, Western Asia, Africa, and terrorists worldwide by leveraging Russia's 'shadow tanker' fleet. Ukrainian hackers successfully infiltrated the accounts of Russian officers, including Major Yevgeny Dmitriev, platoon commander of the 291st Regiment assault company 'Storm V' active on the Zaporizhia front. They revealed cooperation between Russian military personnel and Kadyrovite representatives in weapon sales. Additionally, Ukrainian hackers conducted a social engineering operation, deceiving the administrators of a Russian military fundraising public group 'Two Majors', redirecting funds to support Ukrainian Special Operations Forces. This intelligence represents critical evidence of Russia’s hybrid warfare involving illicit arms trafficking and covert financial operations supporting aggression in Ukraine and beyond.",
  "actor_primary": "256 Cyber Assault Division",
  "target_primary": null,
  "location_text": "Crimea",
  "location_region": null,
  "location_coordinates_lat": 48.379433,
  "location_coordinates_lon": 31.16558,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly describes hostile Russian activity involving illegal arms smuggling by Russian military personnel and their proxies, uncovered by Ukrainian and allied intelligence, constituting aggressor activities. There is no indication of defense preparations in the report.",
  "event_time_utc": "2026-01-10T11:33:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:35.250Z",
  "updated_at": "2026-11-04T08:36:03.522Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Jan 10, 2026, 11:33 UTC

Event time confidence

unknown

Location

Crimea

Primary actor

256 Cyber Assault Division

Country

Ukraine

Countries

Ukraine

Tags

shadow tankers, Russia, weapons smuggling, Russian weapons smuggling, Cyber intelligence, Ukrainian hackers, 291st Guards Motor Rifle Regiment, Vostok-Akhmat, Shadow tanker fleet, Crimea, Social engineering, inform napalm, Hybrid warfare

Loading signal...

{ "id": "66b81d3d-ec3a-433c-ac70-a7689fb6c354", "url": "https://x.com/i/web/status/2009951814586613944", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Ukraine", "source_reliability": "C", "info_credibility": "3", "tags": [ "shadow tankers", "Russia", "weapons smuggling", "Russian weapons smuggling", "Cyber intelligence", "Ukrainian hackers", "291st Guards Motor Rifle Regiment", "Vostok-Akhmat", "Shadow tanker fleet", "Crimea", "Social engineering", "inform napalm", "Hybrid warfare" ], "nodes": [], "countries": [ "Ukraine" ], "where_text": "Cyberspace", "headline": null, "description": "Ukrainian hackers from the 256 Cyber Assault Division, collaborating with InformNapalm and the international intelligence community, conducted a cyber intelligence (CYBINT) operation exposing a Russian weapons smuggling group. Officers of the 291st Guards Motor Rifle Regiment and the Kadyrovite battalion 'Vostok-Akhmat' organized smuggling through Crimea, serving as a hub for onward arms transport to black markets in Russia, Europe, Western Asia, and Africa. The operation uncovered the use of Russia's 'shadow tanker' fleet for illicit arms shipments. Compromised accounts include Major Yevgeny Dmitriev, commander of the Russian assault company 'Storm V', involved in the Zaporizhia direction of combat. Cooperation between Russian officers and Kadyrovite fighters was revealed in illegal arms sales. Ukrainian hackers also used social engineering to trick operators of the Russian fundraising public group 'Two Majors' into transferring regiment funds to Ukrainian Special Operations Forces.", "summary_short": "Ukrainian hackers exposed a Russian weapons smuggling network linked to Russian military officers and the 'shadow tanker' fleet facilitating arms transfers globally, including to terror groups.", "summary_extended": "On January 10, 2026, Ukrainian hacker group 256 Cyber Assault Division, in cooperation with InformNapalm and international intelligence partners, uncovered and exposed a covert Russian weapons smuggling network. This illicit operation involves officers of the 291st Guards Motor Rifle Regiment and the Kadyrovite battalion 'Vostok-Akhmat' using Crimea as a hub to transport smuggled arms to Russia and onward to Europe, Western Asia, Africa, and terrorists worldwide by leveraging Russia's 'shadow tanker' fleet. Ukrainian hackers successfully infiltrated the accounts of Russian officers, including Major Yevgeny Dmitriev, platoon commander of the 291st Regiment assault company 'Storm V' active on the Zaporizhia front. They revealed cooperation between Russian military personnel and Kadyrovite representatives in weapon sales. Additionally, Ukrainian hackers conducted a social engineering operation, deceiving the administrators of a Russian military fundraising public group 'Two Majors', redirecting funds to support Ukrainian Special Operations Forces. This intelligence represents critical evidence of Russia’s hybrid warfare involving illicit arms trafficking and covert financial operations supporting aggression in Ukraine and beyond.", "actor_primary": "256 Cyber Assault Division", "target_primary": null, "location_text": "Crimea", "location_region": null, "location_coordinates_lat": 48.379433, "location_coordinates_lon": 31.16558, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event clearly describes hostile Russian activity involving illegal arms smuggling by Russian military personnel and their proxies, uncovered by Ukrainian and allied intelligence, constituting aggressor activities. There is no indication of defense preparations in the report.", "event_time_utc": "2026-01-10T11:33:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:35.250Z", "updated_at": "2026-11-04T08:36:03.522Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }