- On 29 July 2020, Belarusian state media announced that the country’s security services had arrested 33 fighters from the Wagner private military contractor. These men were, according to the report, part of a group of more than 200 fighters present in Belarus to destabilise the country in the run-up to its Presidential elections in early August. All of the men, whose names and dates of birth were published in the initial 29 July report, were Russian nationals while a handful also had dual citizenship with Ukraine and Belarus.
- Although Belarus initially accused Russia of meddling in the August election, the two countries appeared to reconcile with the return of the mercenaries to Russia and further cooperation in military and economic spheres.
- It later transpired that the appearance of the Russian mercenaries had nothing to do with the Belarusian elections or Russian meddling, rather it was part of a Ukrainian sting operation that had been cut short. The political fallout from these events continues to be felt over a year later, drawing in the last two presidents of Ukraine and much of the country’s security, military, and intelligence services.
A year-long investigation by Bellingcat and the Insider has established that the operation which resulted in the capture of 33 mercenaries in Minsk in July 2020 was in fact an elaborate sting conducted by Ukraine’s military intelligence service GUR MOU with the support of the counterintelligence department of the domestic intelligence agency, the SBU. Through the false-flag recruitment of mercenaries for a now defunct private military contractor (PMC), the operation aimed to lure dozens of Russian, Ukrainian and Belarusian citizens who, in the assessment of the Ukrainian authorities, had committed serious crimes while fighting for Russia-supported military entities in the country’s East.
Many, but not all of the targeted mercenaries, had fought in Ukraine’s Donbas region as part of the infamous Wagner private military contractor (PMC). Others fought as part of Russia-sponsored “volunteer corps” while others had been working directly for Russia’s military or security services. Most of the targeted men had at some point served as mercenaries for the Wagner group, whether in Ukraine or subsequently in Syria, Libya or the Central African Republic (CAR).
The operation had begun as early as 2018 as a run-of-the-mill intelligence-gathering campaign by GUR MOU. By late 2019, following the success of Ukrainian rendition operations such as the retrieval of former separatist military commander Vladimir Tsemakh, the project had taken a more ambitious turn. By early 2020 it had morphed into an opportunistic sting operation targeting hundreds of former mercenaries idling away during the Covid-19 lockdown in their home towns and villages across Russia. At this point, a number of outcomes were still under consideration. These included terminating the operation after sufficient intelligence had been gathered or luring the targets to a third country — such as Hungary, Poland, or the Baltic nations — and requesting their extradition to Ukraine.
In late 2019 and early 2020, several special operation commanding officers with successful rendition experience crossed over from the SBU to GUR MOU. Under their influence, the sting operation developed more concrete — and even more ambitious — contours. The mission became to lure, detain and prosecute a core group of several dozen mercenaries. At this point, the SBU was involved in the project planning with the aim of creating a shortlist of targets whose alleged crimes could be amply substantiated and were thus assessed to have a high likelihood of being convicted in court.
This final operational scenario was, according to three former security officers who spoke to Bellingcat, including the former director of GUR MOU, Vasily Burba, presented to and approved by Ukraine’s political leadership in early July 2020. It included the capture and detention of 33 mercenaries by staging the emergency landing on Ukrainian soil of an aircraft carrying the targets to their fictitious deployment destination. The choice of Minsk in Belarus as a starting point for the journey was a circumstance both forced (no commercial flights were taking off from Russia during the 2020 Covid-19 lockdown) and convenient. A flight from Minsk to Istanbul, the transfer hub to any number of plausible destinations, would require that the plane cross into Ukrainian airspace for approximately 28 minutes — just long enough to allow for an emergency landing at Kyiv’s Boryspil airport.
As the bus carrying the mercenaries crossed the border from Russia into Belarus on 25 July, the daring operation appeared to proceed according to plan.
But at the very last moment, a controversial decision was made to postpone the active part of the operation for a few short days. A new departure date to Turkey was set for 30 July, and the mercenary group was checked in, first to a Minsk hotel, and later to a spa hotel outside the city, to wait out the delay. In the early morning hours of the penultimate day at the hotel, Belarusian special services stormed the hotel. They detained the mercenaries, inadvertently compromising the remainder of the Ukrainian sting operation.
The timeline and context of the events chronicled in this investigation was compiled on the basis of dozens of interviews with participants in the sting operation: including Russian mercenaries who had fallen for the Ukrainian ploy and former Ukrainian intelligence operatives who had taken part in various aspects of the operation. Both groups spoke to Bellingcat to dispel what they perceived as disinformation narratives spread in both Russia and Ukraine.
To validate what these sources had to say, Bellingcat’s investigation team analysed and verified hundreds of electronic files including job applications filled out by the mercenaries, photographs of military awards and medals, letters of recommendation from former military commanders and health records which they had emailed to their fictitious new employer. Crucially, the analysis covered hundreds of audio files collected during the false flag recruitment process. Some of these documents and audio components had been leaked to Ukrainian media; however their authenticity had not been independently verified.
Bellingcat also verified key parts of the timeline of events with the Adhoc Inquest Committee of the Ukrainian Parliament. This committee has investigated, independently from Bellingcat, the circumstances surrounding the alleged failure of the same sting operation.
A detailed breakdown of the technical methods applied for this story, including our reasoning for including information from sources who could not be named, can be found in a companion article here.
The Origins of the Sting
According to interviews with four former Ukrainian special service operatives, who requested anonymity to discuss classified matters, and the former Ukrainian President Petro Poroshenko, Ukraine’s military intelligence agency, GUR MOU, and the domestic security agency, the SBU, began gathering data and creating profiles on Russian militants — including mercenaries — fighting in the East of the country in early 2014. The SBU, which also has a law-enforcement investigative function, began compiling criminal dossiers on individual militants who were judged to have committed serious crimes.
By the middle of 2018, Ukraine’s intelligence services had achieved a detailed understanding of the structure, practices and composition of Russia’s PMCs, primarily the so-called Wagner PMC affiliated with and funded via Evgeny Prigozhin, an entrepreneur close to the Kremlin. As Wagner PMC re-shuffled mercenaries from Ukraine to other hotspots such as Syria, Libya, CAR, Mozambique and other African countries, Ukraine’s intelligence agencies learnt more about military contractors’ methods of recruitment, promotion and rotation, as well as their interplay with Russia’s security services.
According to the aforementioned former special service operatives, two of these insights turned into crucial knowledge for the future sting operation. Firstly, the PMC mercenaries are rotated in and out of assignments and have to wait in their home towns or villages, sometimes for months or years, for their next job. This forces them to seek alternative…