How the world's most dangerous hacker group, Humpty Dumpty, was uncovered. All the hackers of Humpty Dumpty And who is the buyer?

On the morning of August 14, 2014, Dmitry Medvedev’s Twitter was hacked: within 44 minutes, hackers controlled the prime minister’s official account. During this time they managed to write several tweets. The first tweet announced the prime minister's resignation due to "shame at the government's actions." Next, “Medvedev” wrote about the president’s upcoming speech in Yalta, criticized the annexation of Crimea to Russia and spoke about the abolition of the funded part of the pension. By 11:00, all tweets written by the hackers had been deleted.

Gazeta.ru then wrote that the publication’s correspondent contacted a representative of the Anonymous International and asked him a question about hacking Medvedev’s Twitter.

“The official position of the team is that Twitter was not [hacked] by us. Unofficial - well, maybe. Well, they'll probably think about us. Since several of his [Medvedev’s] mailboxes and the contents of three iPhones fell into our hands quite by accident,” Gazeta.ru’s unnamed interlocutor responded on behalf of the group.

In August, the publication spoke with the authors of the blog “Humpty Dumpty” Look at me, to whom they told that the hacking of the Prime Minister’s Twitter was “timed” to coincide with Vladimir Putin’s speech in Yalta. Representatives of the Anonymous International claimed that they had seen drafts of the speech and considered it meaningless. They also said that Medvedev also has a personal Twitter account, which, in particular, is subscribed to politician Mikhail Khodorkovsky, founder of the Anti-Corruption Foundation Alexei Navalny and journalist Oleg Kashin.

A few days before this interview, Anonymous International published screenshots of several letters from different mailboxes that allegedly belonged to Medvedev. The hackers called the publication a response to “stupid initiatives in the field of tightening regulation on the Internet.” The blog noted that letters that fall into the hands of hackers are not of particular interest. Thus, Medvedev allegedly used the address for personal correspondence and linking to some services, and the address for “light work correspondence.”

According to hackers, Medvedev used the account to purchase new equipment and other goods in foreign online stores. Among them was the American Amazon: hackers noted that Amazon“is experiencing certain problems with delivering orders to protected facilities.” For purchases, someone else’s account and someone else’s credit card were used: they were issued in the name and work address of Vladimir Dyachenko, who, as he wrote The Insider, was the general director of several construction companies and the Harmony Foundation.

Dyachenko told the publication that he often buys things on the Internet, but has nothing to do with the prime minister and has never met him. He confirmed that he had made some of the purchases mentioned in the letters, but denied authorship of several of the letters. Among them was a letter discussing US and EU sanctions against Russia and a list of “current affairs” that was expanded several times, including a plan to equip a “full-fledged cinema hall” in the “main house.”

Kristina Potupchik and a bag of money

The famous photograph of the former press secretary of the Nashi movement, Kristina Potupchik, with a bag full of cash was published by Anonymous International in December 2014. Judging by the date on the computer screen, the photo was taken on October 17th. Hackers told The Insider, that in the photo, a member of the Public Chamber Potupchik is captured in the office of the former leader of the Young Guard, deputy head of the Presidential Administration for Domestic Policy Timur Prokopenko.

“It’s not known exactly how much was in the bag, but she received both five lyams and ten lyams [million rubles - MZ]. Just this time we decided to take a photo for reporting purposes. The loot was given to Potupchik for his current needs. She constantly works for the Presidential Administration [Presidential Administration - MOH]. Working in the blogosphere, paying bloggers, commentators, organizing events,” Anonymous International told the publication.

The Insider Potupchik also published another photo: she posed with the medal “For Services to the Fatherland,” II degree. The Anonymous International claimed that she received the medal “for organizing the campaign for Crimea.” Later, hackers published excerpts from Potupchik’s correspondence: reports on social media campaigns, a classification of Russian media by degree of opposition, and “propaganda recommendations.”

AP against Alexei Navalny and his associates

Anonymous International also published the correspondence of Prokopenko himself, a detailed analysis of which was made in December 2014 The Insider. From the letters and messages, in particular, it followed that Prokopenko was responsible for posting ordered materials about all criminal cases related to the founder of the Anti-Corruption Foundation, Alexei Navalny. For example, in November 2013, Prokopenko received for approval a text about the Yves Rocher case, which was later published on Yevgeny Lavrov’s blog and on various resources dedicated to “compromising evidence against Navalny.”

Another time, Prokopenko received 24 pages of a report on the “working out” of Navalny’s topic on the Internet and a letter from Potupchik with screenshots of correspondence between Navalny and Vladimir Ashurkov, where they, in particular, discussed their sources in Alfa Group. From Prokopenko’s correspondence it follows that Anastasia Kashevarova, assistant to the general director of the publishing house, helped him in the media campaign against Navalny News Media Aram Gabrelyanov. Thus, Kashevarova was responsible for the publication in Izvestia of materials about the criminal case against Ashurkov’s common-law wife Alexandrina Markvo.

Prokopenko’s trace was also found in the case against the head of the FBK investigation department, Georgy Alburov, who was involved in the theft of the painting “Bad and Good Man” by amateur artist Sergei Sotov, who decorated a fence in Vladimir with his naive works. In June 2014, Prokopenko received a letter with a video recording in which Sotov noted that he had no complaints about the people removing his drawings from the fence. The next day, the video appeared in the “Emergency” program on the NTV channel - but Sotov’s words about the absence of complaints were cut out. In March 2015, hackers published SMS- correspondence between Prokopenko and a TV channel employee LifeNews Nikita Mogutin: on the evening of June 19, Mogutin received a disk with a video recording and instructions, and the next morning he informed Prokopenko that investigators had arrived at Navalny’s place.

The big hack of Aram Gabrelyanov

In the summer of 2016, Anonymous International announced the hacking of an email account in Facebook, and IPhone And iPad owned by the owner of the media holding News Media Aram Gabrelyanov. The hackers published correspondence, personal photographs and other files in parts (, , ,). Gabrelyanov’s assistant Anastasia Kashevarova had no doubt about the authenticity of what was published and wrote a post in defense of her boss, noted The Insider.

Gabrelyanov’s stolen correspondence discussed cooperation with pro-Kremlin publicists: for example, Alexander Prokhanov asked for 80 thousand rubles a month for weekly broadcasts. The nephew of the co-owner of the Izvestia newspaper Yuri Kovalchuk conveyed the request of businessman Vasily Anisimov to be removed from the channel on YouTube video recording of his debauchery. Vladimir Markin, who then held the post of press secretary of the Investigative Committee, discussed with Gabrelyanov the story of the fake law degree: according to Markin, this topic was raised by Deputy Prosecutor General Alexander Buksman. Employees Life approved the boss’s presentation of the topic of the murder of Boris Nemtsov, in particular, the version about the involvement of the Security Service of Ukraine.

Who is behind the Anonymous International?- this question haunted journalists throughout the three years of activity of the hacker group. One of the first to collect and systematize the versions discussed in near-political circles was Ekaterina Vinokurova from Znak.com: the first is the special services, the second is the PR agency KROS (Public Relations Development Company), whose president is the husband of the ex-chief editor of RIA Novosti Svetlana Mironyuk, Sergei Zverev, the third is the deputy head of the presidential administration, Alexey Gromov. Later, two more hypotheses were added to the list: “Humpty” is “these are fragments of the Nashi movement” or someone who is “connected with the group of German Klimenko, the owner Liventernet, who is also in contact with the AP.” At the same time, a man who introduced himself as Lewis and spoke on behalf of “Humpty” with Meduza correspondent Daniil Turovsky, insisted: “But we claim that we are an independent team. It’s simply often impossible to understand who the customer is. Sometimes we obtain information for intermediaries without knowing the end customer.”

A certain Kucherena (“Anonymous International” suggests that this is lawyer Anatoly Kucherena, author of books about Edward Snowden) was selling Life photos of Snowden for 100 thousand rubles each: Gabrelyanov bought one photo, which was used to advertise a mobile application Babo- this is the project of his son Ashot Gabrelyanov. It follows from the published array that Gabrelyanov Sr. paid special attention to materials about the founder of the Anti-Corruption Foundation, Alexei Navalny. Authors Life and Izvestia agreed in advance with the boss on materials about the activities of the oppositionist.

Among the published files there are several faxes from Deputy Head of the Presidential Administration Alexei Gromov, in which he asked Gabrelyanov to focus on certain topics. Despite cooperation with high-ranking officials, it follows from the correspondence that many of Gabrelyanov’s assets were experiencing financial difficulties: in the first quarter of 2016, the losses of the Izvestia newspaper amounted to almost 47.5 million rubles, and the zeolite processing plant owned by the media magnate had problems with government contracts.

Ministry of Defense against Spetsstroy

In July 2015, Anonymous International published screenshots of letters from Ksenia Bolshakova, who at the time of the correspondence was working as an assistant to the head of the Construction Department of the Ministry of Defense Roman Filimonov. From letters dated 2014, it follows that Bolshakova was interested in publications against the Federal Agency for Special Construction (Spetsstroy), including in the Kommersant newspaper. For example, in November 2014, a certain Anna Gryazeva discussed with Bolshakova an article by journalist Ivan Safronov “Spetsstroy is disrupting the deadline for rearmament of a group of Russian troops in the South Kuril Islands” and its promotion on social networks.

Another letter to Bolshakova talked about paid bloggers: from Polina Bykhovskaya, the secretary of the Construction Department of the Ministry of Defense received a list of blogs and prices - from nine to 135 thousand rubles. In addition, the correspondence contains examples of tasks for “trolls” and reports on paid comments posted on forums and websites of various publications. Bolshakova’s interlocutor also explained to her the specifics of different social networks: Facebook- “for the smart ones”, “VKontakte” - “for the stupid ones”, “Odnoklassniki” - “for the completely stupid”. The Anonymous International suggested that the commissioned publications were paid for from the budget of the Ministry of Defense. The complete archive of letters from the Secretary of the Department of Construction of the Ministry of Defense, which fell into the possession of hackers, was put up for sale.

Ministry of Defense and custom publications

The published correspondence between Bolshakova and Bykhovskaya indicated prices for custom publications in various publications. Thus, in one of the letters “Rossiyskaya Gazeta”, “Vedomosti”, “Moskovsky Komsomolets” and “Arguments and Facts” appear: there the “average price” of placement was 1.8 million rubles for half a page. According to Bykhovskaya, they advise “not to get involved” in the Kommersant newspaper, since there are cases when “they can agree with everything, take the money and not print it.”

The next letter mentioned Novaya Gazeta, Argumenty Nedeli, Rossiyskaya Gazeta, Moskovsky Komsomolets and Argumenty i Fakty. The price of custom material for half a page in each of these publications ranges from 23 to 78 thousand dollars. In conversation with The Insider Bolshakova and Bykhovskaya did not deny the authenticity of the correspondence, but argued that the Ministry of Defense did not order any materials. Bolshakova stated that she was interested in the prices out of “journalistic curiosity.”

In addition, Anonymous International published a screenshot of Bolshakova’s correspondence with Lesya Ryabtseva, who at that time worked as an assistant to the editor-in-chief of Ekho Moskvy, Alexei Venediktov. The letter contained a list of topics that Bolshakova proposed to discuss on Saturday broadcast. In conversation with The Insider the ex-official called this “coordination of topics” and stated that Ekho Moskvy was not paid for that broadcast. However, Ryabtseva told the publication about the agreement between the Ministry of Defense and “Echo of Moscow”, which concerned the programs “Arsenal” and “Military Council”. However, Ryabtseva could not explain what the essence of the agreement was.

Letters from Dmitry Kiselev

In April 2016, Anonymous International gained access to email and whatsapp TV presenter Dmitry Kiselev. The hackers put up the entire array of letters and messages for auction, publishing selected excerpts on their blog. From the publication one could, for example, find out that in February 2014, Kiselev bought an apartment with an area of 204 square meters on Tsvetnoy Boulevard in Moscow for 162 million rubles, and earlier, an American motor boat, the cost of which, together with accessories, was almost 49 thousand dollars.

Also, from the letters posted in the public domain, it follows that in 2016, police officers came to Kiselyov’s villa in Koktebel: the TV presenter’s neighbor complained about the inconvenience associated with his winery. Apparently, the complaint was not pursued, and the police had to come to Kiselev’s estate a second time - with an apology for the inconvenience caused and a promise not to disturb the owner in the future.

With the help of highly paid lawyers from London, Kiselev tried to get the sanctions lifted from his person; The TV presenter was going to involve Western PR agencies in this same task. However, as follows from the letters, he forgot to pay the lawyers, which is why the British lawyers wanted to stop cooperation.

IN whatsapp Kiselyov spoke in particular with the pranker “Vovan” and the former host of the “Rural Hour” program, director of the Department of Administrative Work and Interaction with the Regions of the Ministry of Agriculture, Konstantin Likutov. IN whatsapp Kiselev sent photographs of himself from a trip to Syria, on which his wife accompanied him.

Letters from the latter's mailbox also ended up in the possession of Anonymous International. The correspondence from the address of the TV presenter’s wife discussed the purchase of a thesis and finished scientific articles on psychiatry for further paid placement in specialized publications. The hackers noted that Maria Kiseleva made translations of educational literature at the expense of the state - in the translation department of the Rossiya Segodnya MIA: in particular, she studied literature on “perversions in borderline disorders” and “narcissistic and borderline psychopathology.”

In addition, Anonymous International published Kiselev’s correspondence with the head of the social philosophy sector of the Institute of Philosophy of the Russian Academy of Sciences, Valentina Fedotova, who advised the TV presenter in the preparation of his programs. Thus, Fedotova insisted on “American criticism” of publicist Viktor Shenderovich, believing that this would be a “blow” for him, and wanted to “remove” Ksenia Sobchak from the public sphere. In March 2013, long before the start of Euromaidan, Fedotova gave Kiselyov advice on Ukrainian politics and asked her to increase her salary so that she would have enough for rest after an illness.

MGB DPR

In September 2015, Anonymous International published official correspondence between employees of the “prosecutor’s office” and the “Ministry of State Security” of the self-proclaimed Donetsk People’s Republic. From the released files, dated from the end of 2014 to the beginning of 2015, it follows that the “departments” were in conflict with Alexander Zakharchenko and his associates: the MGB accused the head of the DPR of “leading a criminal group.”

Dozens of pages of the “Information on the destabilization of the political and economic situation in the DPR” contain corruption schemes involving separatist leaders, including the sale of seats in the elections to the “people’s council” of the DPR, held on November 2, 2014. The certificate states that fighters of some units kidnapped people for ransom, mentions torture, murder, theft of vehicles and raider takeovers of enterprises. The correspondence contains complaints from local residents about the actions of fighters of the separatist armed forces.

Among the published documents there is a report on the visits of the Ukrainian oligarch Rinat Akhmetov: for example, it is alleged that in October 2014 he came to Donetsk for two days, accompanied by his associates and “criminal authorities.” During these days, the businessman allegedly held closed meetings with Zakharchenko, the “Minister of Revenue and Duties” of the DPR Alexander Timofeev and their proxies. Among the agreements reached as a result of these meetings were the appointment of Akhmetov’s people to the positions of “ministers” and “deputies of the people’s council” of the DPR. Zakharchenko and his associates were allegedly guaranteed “almost lifelong” retention of power with full financial support.

It is difficult to judge the reliability of the correspondence published by Anonymous International. However, among the published files were the results of a sociological express study among residents of Donetsk and Makeyevka, which was conducted from December 6 to December 9, 2014. From the results of the study it follows that the majority of respondents negatively assess the actions of the DPR authorities and what is happening in the territory controlled by the separatists, do not trust the “newly elected government” and are dissatisfied with the behavior of the DPR fighters and their attitude towards civilians.

Mail of the head of Roskomnadzor

In April 2015, Anonymous International claimed to have gained access to letters from the personal email of the head of Roskomnadzor, Alexander Zharov. “We are forced to acknowledge the fact that even the head of the relevant department uses personal email to discuss official and non-official issues of public interest,” the group’s blog said. The hackers published excerpts from the correspondence, noting that several personal letters were deleted from the array.

Most of the posted letters related to Zharov’s correspondence with Mikhail Demin, who on November 20, 2014 became an adviser to the general director of Echo of Moscow, and from December 23 to March 2015 served as the general director of the radio station. Thus, on February 24, Zharov received for approval videos from opposition politicians Boris Nemtsov and Mikhail Kasyanov, who called for participation in the opposition “Spring” march, scheduled for March 1. Demin also complained to the head of Roskomnadzor about non-fulfillment of salary agreements and discussed with him the blogs of Echo of Moscow employees, the radio station’s budget and the deprivation of Echo of Petersburg’s license.

In addition, in an excerpt from Zharov’s correspondence published by hackers, one can find a letter from entrepreneur Konstantin Malofeev, who lobbied for the Spas TV channel, comments on organizing an attack on the Dozhd TV channel for a survey about besieged Leningrad, a discussion of the “anti-blogger” law and ensuring the information security of the Unified State Exam. , as well as “analytics” related to Internet regulation.

“Putin’s personal chef” and his waiters

In May 2015, the Anonymous International blog published correspondence from employees of the Concord catering company. It belongs to businessman Yevgeny Prigozhin, who is called “Putin’s personal chef” and the creator of the “troll factory” in Olgino, as well as attacks on St. Petersburg opposition bloggers. The Kremlin is also listed among Concorde's clients: the correspondence refers to dinners that were organized for Putin several years ago.

July 23, 2014 Roskomnadzor issued an order to block the blog “Humpty Dumpty” on Wordpress.com. On the same day, a representative of the department, Vadim Ampelonsky, told Kommersant that the reason for this decision was the appeal of a certain Igor Osadchy “to the Smolninsky District Court of St. Petersburg with a claim to recognize the information on this site as prohibited for distribution according to the Law “On Personal Data”.” .

The blog authors themselves linked the blocking to publications concerning the structures of Yevgeny Prigozhin. “According to our data, [this happened] at the suggestion of Concorde lawyers. Because of our reports on trolls and other Concorde matters,” representatives of Anonymous International told the newspaper.

“At the same time, the co-owner of Concord, Mr. Prigozhin, according to Humpty Dumpty, is actively involved in politics, and his structures are “surveilling and organizing provocations against oppositionists and the media” with the help of the Internet Research Agency. It was in the correspondence of one of the employees of this agency, Denis Osadchy, that the plaintiff or his namesake Igor Osadchy appeared. One of the letters written on his behalf contained a report on an information project with news portals and social networks,” Kommersant wrote.

The published array was parsed The Insider: The publication noted that in addition to the reports of the waiters who reported to Prigozhin about everything that happened at dinners, there were also Prigozhin’s memoirs, which he sent to his personal secretary Anastasia Gubareva. Thus, in a note about the events of October 18-19, 2011, Prigozhin admitted that he used contacts with Anatoly Serdyukov to obtain service contracts for the Ministry of Defense. In a memoir dated December 10, 2010, about a dinner with the Prime Minister of Finland, the businessman wrote that Putin personally helped him get the Eliseevsky grocery store in St. Petersburg.

Strelkov-Girkin mail: career and hobbies of Igor Ivanovich

In May 2014, Anonymous International published an archive of correspondence from Igor Strelkov (Girkin), the former “Minister of Defense” of the self-proclaimed Donetsk People’s Republic. A detailed analysis of the leak was made by Fontanka; the publication noted that from the array published by Anonymous International it follows: Strelkov “is really who he claimed to be - a retired Russian officer acting out of conviction.”

Igor Vsevolodovich Girkin was born in 1970 in Moscow. He studied to become a historian-archivist at the Moscow Institute of History and Archives, but “didn’t work a day in the profession”: in the early 1990s he fought as a volunteer in Transnistria and Bosnia, and later under contract in Chechnya. Since March 1996, Girkin served in the FSB, from 1999 to 2005 - almost continuously in Chechnya. Then, due to reduction, he was transferred to the reserve with the rank of colonel: the last place of work of the future “Minister of Defense” of the DPR was a company Marshall Capital Orthodox businessman Konstantin Malofeev. There, the retired security officer worked as a security consultant: from the correspondence, in particular, it follows that he coordinated the work of security during Malofeev’s trip to New York in September 2013.

Good salary from Marshall Capital Strelkov spent on his main hobby: machine guns from the First World War - "Maxims", "Hotchkiss" and "Schwarzlose". At the end of December 2013, Girkin was engaged in the restoration of the Schwarzlose and Colt, and in mid-January he was busy with the next Maxim. Since February, Girkin began going on certain business trips, and in March he became a freelance military adviser to the Chairman of the Council of Ministers of Crimea, Sergei Aksenov. However, in response to a request for help with documents on March 31, Girkin replied that he himself had not received any official status at all and was staying in Crimea only through personal connections.

Another hobby of Girkin, as it turned out from the hacked correspondence, was fiction: for children he wrote fairy tales about brownies living in the old family estate of the Haldiborn knights, for adults - stories about the war in Bosnia and Chechnya. In addition, Girkin participated in the organization of the Noble Assembly, “where gentlemen of blue blood communicate with their equals.” Among the visitors to the meetings was Alexander Trubetskoy, a descendant of the Trubetskoy and Golitsyn princes living in Paris, who, together with Malofeev, was once on the board of directors of the state holding Svyazinvest.

Surkov Post: Ukraine, Abkhazia and South Ossetia

At the end of October 2016, the Ukrainian group “Cyberjunta” announced that the work email account of presidential aide Vladislav Surkov (, ,) had been hacked. Hackers published thousands of letters and documents, including scans of the foreign passports of Surkov, his wife and three children.

In Surkov's correspondence, the conversation was mainly about Ukraine, Abkhazia and South Ossetia. Thus, among the published documents was the “Plan of priority measures to destabilize the situation in Ukraine “Shatun”” and a letter from Konstantin Malofeev, dated May 13, 2014. Attached to the letter was a list of candidates for the government of the self-proclaimed Donetsk People's Republic. As noted The Insider, people from this list actually received positions in the “government” of the DPR.

The influence that Surkov has on the separatists of eastern Ukraine is indirectly evidenced, for example, by a letter from the first vice-president of the Russian Wrestling Federation Georgy Bryusov, who conveyed a request to “ask for good” a fighter of the Luhansk battalion “Zarya” Alexander Slabiev with the call sign “Felix”, who “is a good performer when organizing PR projects.”

Among the documents posted by the hackers was a certain “Plan of priority measures for the development of laws and other regulatory legal acts” for Abkhazia, aimed at accelerating the socio-economic development of the republic. It is noteworthy that the bill “On Enforcement Proceedings” passed through the Russian Ministry of Justice.

According to a source from the Rosbalt agency, it was the circumstances of the publication of Surkov’s correspondence that were primarily of interest to FSB officers when they detained journalist Vladimir Anikeev in St. Petersburg at the end of October. As an interlocutor of Rosbalt, the intelligence service believes that he is not only involved in this leak, but is also the notorious “Lewis” - the creator of the blog “Humpty Dumpty” was previously known under this pseudonym.

Who was responsible for what in the hacker group that stole correspondence of Russian officials and businessmen

Journalists became aware of all the main participants in the Humpty Dumpty project, which became famous thanks to the public publication of stolen personal email correspondence of such government officials as the Prime Minister (and ex-President) of the Russian Federation Dmitry Medvedev and the assistant to the President of the Russian Federation (former first Deputy Head of the Administration of the Head of State) Vladislav Surkov. Most of the members of the hacker group are wanted, and one of the creators, Vladimir Anikeev (Lewis), is in custody in the Moscow Lefortovo pre-trial detention center.

Leaders

Chat. Pseudonym of a major St. Petersburg PR specialist. He worked with many major officials and businessmen. In recent years, his sphere of interest has shifted to Moscow. It was after meeting Boltai that Anikeev’s activities in collecting incriminating evidence on civil servants and entrepreneurs reached a new level. Boltai and Anikeev together came up with the Shaltai-Boltai project. Boltai determined the editorial policy - whose correspondence should be posted on the Internet. He also performed the unique functions of State Secretary: all communication with officials, business representatives and security officials was conducted through him. Based on the results of this communication, the editorial policy of the resource was determined. In addition, Boltai was involved in replenishing the project’s budget, receiving money for posting or not posting other people’s correspondence. The lion's share of the funds ended up with him. Anikeev was next in terms of the volume of funds received.

The correspondence of high-ranking Russian officials was stolen on a grand scale by the Hatter, Alice and the March Hare

Vladimir Anikeev (Lewis). He worked as a journalist in the St. Petersburg media, then took up “black” PR. Having connections in various departments, he “mined” dirt on officials and businessmen. After meeting Boltai, according to Rosbalt’s interlocutors, he organized a series of hacks into the “boxes” of civil servants in the Northern capital. This was done using phishing. After the Humpty Dumpty project reached the federal level, he organized the theft of the contents of officials’ phones and tablets using equipment that created false cells and fake Wi-Fi. He was a member of the presidential administration. He spent most of his time in Ukraine, where his official wife lives, and also in Thailand. In October 2016, he was detained by FSB officers while heading from Ukraine to St. Petersburg.

Junior partner

Humpty. IT specialist from St. Petersburg. Worked as a system administrator on a number of resources controlled by Boltai. After creating the Humpty Dumpty project, he left for Estonia. Has citizenship of this country. It was Humpty who received the entire volume of information downloaded using fake cells and fake WI-FI. He studied the content and selected from it belonging to officials, heads of state corporations and other persons from whom he could get money. Reported the results to Dumpty and Lewis. He, on the instructions of the latter, posted content on the resources of “Humpty Dumpty”. Humpty received 20-30% of the total earnings of the project. He was a junior partner without voting rights.

Vladimir Anikeev - founder of the hacker group

Ordinary participants

Alice. Citizen of Ukraine. In Russia, she changed several professions until she got a job as an instructor at the St. Petersburg fitness center where Anikeev worked out. The young people became close, after which Alice began to carry out Lewis’s instructions. An attractive girl sitting with a laptop in cafes and restaurants where employees of the presidential administration gather did not arouse suspicion. In fact, content was downloaded onto this laptop from visitors’ phones and tablets. Also in Kyiv, Alisa was engaged in “cashing out” the bitcoins earned by “Humpty Dumpty” by selling other people’s correspondence.

The Hatter and the March Hare. IT specialists who worked in Russian regions. Later they moved to Moscow, where they worked as system administrators on various resources. During one of the parties we met Anikeev. They began to carry out his one-time orders. After creating the Humpty Dumpty project, they moved to Thailand. Maintained bookkeeping for the resource, processed the received content, and performed various technical work. In the summer of 2016, together with Anikeev, they created a company in Thailand that provides real estate rental services to tourists.

German Alexandrov

"Life", 01/30/17, “High-ranking officials appeared in the Humpty Dumpty case”

Intelligence agencies are studying materials on government officials and businessmen who collaborated with hackers or paid them for non-disclosure of compromising information about themselves.

The Shaltai-Boltai case promises to be the largest process in the field of information security in Russia. As Life found out, 6 people have currently been arrested in connection with the hacking of phones and instant messengers of officials and businessmen, and a dozen more people are in the works. Among them are employees of large government agencies, who will soon be summoned for questioning. The intelligence services are also studying materials on those “opened” officials and businessmen who paid hackers belonging to the Humpty Dumpty group: they may become involved in corruption cases. It was for the non-disclosure of this information that they could pay.

Lewis Carroll

On December 31, 2013, the hacker group Anonymous International, better known as Humpty Dumpty, published the President’s New Year’s address on its website. This was the group's first statement about its activities.

Then the hackers posted the correspondence of Deputy Prime Minister Arkady Dvorkovich, and opened the Twitter account of Prime Minister Dmitry Medvedev. The correspondence of a number of major officials and businessmen was made public.

And in October 2016, the founder of the group, a certain Lewis Carroll, was detained (the hackers took their names from the children’s book “Alice in Wonderland”). It turned out to be journalist Vladimir Anikeev. He was detained not in St. Petersburg, as some media claim, but practically on the border of Belarus and Russia.

He flew to Minsk by plane (from which country is not known for certain) and then went by car to St. Petersburg.

After Anikeev drove along the highway to the village of Ezerishche and crossed the border of Belarus and Russia, the special services detained him, notes Life’s source.

The founder of Shaltai often visited St. Petersburg. And he constantly stayed at the Angleterre Hotel, where the poet Sergei Yesenin once died. The craving for life on a grand scale and the desire for fame, by the way, led to the fact that Lewis Carroll was declassified. While giving an interview to Meduza in Bangkok, which was published in January 2015, Lewis made a mistake and allowed the journalist to photograph his hat as confirmation that the interview was real. A stupid confirmation, of course. But before that, on his page on the VKontakte social network, Vladimir Anikeev posted photographs from Bangkok wearing this hat.

After his arrest, Anikeev-Lewis made a deal with the investigation and told FSB investigators about everyone who in one way or another worked and collaborated with Humpty Dumpty.

Nothing personal, just business

Life sources say that over the years of work to identify members of the Anonymous International, it was established that it was not just an association of altruists and supporters of goodness, truth and justice. The Shaltayevites worked in conjunction with officials, top managers of large companies and representatives of law enforcement agencies.

A serious basis has been documented. Over the years, it has become clear who has what to do with hackers. During the detention of Lewis Carroll, the information was confirmed. The executors, customers and founders have been identified,” notes one of the interlocutors in the investigation.

There are currently 6 people under arrest. Four detainees are known: journalist Vladimir Anikeev, head of the FSB Information Security Center Sergei Mikhailov and his right-hand man Dmitry Dokuchaev, as well as the head of the computer incident investigation department of Kaspersky Lab Ruslan Stoyanov.

The last three were arrested after Anikeev was detained. Mikhailov and Dokuchaev have been charged with treason; Anikeev and Stoyanov are currently charged with Article 272 of the Criminal Code of the Russian Federation (“Illegal access to computer information”).

There are two versions of the collaboration between a high-ranking FSB officer and Shaltai-Boltai. According to the first, Mikhailov was tasked with establishing who the Anonymous International were, and, having found this out, he led their work, which provided significant profits to all participants. Blackmailing officials and businessmen with their personal correspondence brought enormous dividends.

According to another version, “Humpty Dumpty” was originally created with the participation of the above-mentioned persons. But both versions suggest that the main ideology of the hacker group was “business” - extorting money from high-ranking officials.

According to Life, many government officials and businessmen bought their correspondence even before putting it up for public auction. The hackers were paid by more than 30 officials (regional and federal) and representatives of the business community. There are more than a hundred victims of the publications who appeared in some way in the correspondence.

“Humpty Dumpty” also opened correspondence “to order.” According to Life, the collected database can lead to officials and businessmen at any level who either collaborated with hackers or provided protection for them. In the near future, some high-ranking representatives of government agencies will be summoned for questioning in the Humpty Dumpty case.

Pay for silence

According to the case materials, many Russian high-ranking officials and businessmen paid Shaltai-Boltai so that their correspondence not only would not be sold to others or published, but that it would not even be put up for auction.

The correspondence of those who did not make a deal with the hackers was published for two reasons - either those “opened” had nothing to hide, or they were confident that their roof was stronger and the publication of compromising evidence would not lead to their resignation or other consequences. Those who were afraid of uncovering some kind of corruption schemes and their dishonest attitude towards their partners were ready to pay a lot of money for the silence of “Humpty”.

“Humpty Dumpty” worked with his victims according to several schemes.

As part of the first, “opened” officials or businessmen were immediately sent a message that the hackers were ready not to publish correspondence for a certain amount. The amount was set, of course, by the hackers themselves. The official either agreed and paid, or refused.

According to the second scheme, the opened correspondence was put up for auction. A message was sent about this to the victim, and he had to give a larger amount than other participants in the auction, if there were any.

The third scenario: an official or businessman learned from an intermediary that he had been opened. And the mediator helped negotiate with Humpty Dumpty. If a person could not pay the established amount, then part of the correspondence was still exposed, but not all.

Now, as part of the investigation into the Anonymous International case, the special services are also checking those who paid for the correspondence and materials of this correspondence, which may have serious prospects in the investigation of corruption schemes of officials and businessmen close to them.

Many of them paid precisely to ensure that information about corrupt deals and tenders in which they were involved did not become public. Now it is possible that they will become involved in cases - but not as victims, but as accused, says a source in the investigation team.

How did you get Humpty Dumpty?

Blackmail of the Russian establishment brought high income, the group’s popularity grew, but they were known by their fictitious names from “Alice in Wonderland.” There seems to be glory, but it is impersonal.

Members of the Anonymous International did not hide the fact that they love Asia and periodically visit Vietnam, Thailand and Laos. And they sent messengers to meetings with their victims or their representatives, who were under surveillance.

Some oligarchs and officials hired detectives and conducted their own investigations, the results of which also became known to the intelligence services. Abroad, the Shaltayevites and those involved in them were led, among other things, by private foreign intelligence structures. The ring around the hackers was tightening.

Screen © L!FE

By the way, the fact that “Tsargrad” became the first media outlet to announce the connection of a high-ranking officer of the Information Security Center of the FSB of the Russian Federation with the hacker group “Humpty Dumpty” is explained by the fact that the owner of the media, Konstantin Malofeev, is closely acquainted with a high-ranking official, whose correspondence was also opened “Humpty Dumpty”, and at his request conducted his own investigation.

In addition, the same schemes were used that Humpty Dumpty himself used - phishing letters through which they learned the passwords and logins of officials and businessmen, also through false cells or fake Wi-Fi. For example, phishing emails were sent to the Internet mail addresses of Shaltay residents who fell into the hands of the intelligence services. It was thanks to them that it was possible to connect the activities of the FSB CIB, where Mikhailov worked, with Shaltai. The suspicion against Mikhailov was finally confirmed by the arrested Lewis Carroll.

Ukraine and NGOs

A number of media reported that members of Shaltai-Boltai worked with hackers from the Cyberjunta, and Anikeev himself visited Ukraine very often.

The publication’s sources explain that the only connection with Ukraine that “Humpty Dumpty” has is a member of the group, Alisa (the publication does not know her real name). Alisa is a former Kyiv prostitute. She, as a girl with low social responsibility, was still a kind of leisure organizer for “Humpty”: she “motivated the girls” (since the guys didn’t particularly stand out in appearance and used the services of night butterflies), arranged trips, and had a large client base, including which sometimes had the right people.

The topic of Ukraine is absent from the case materials. But the theme of Donbass is present. As Life found out, the Anonymous International servers are located on the territory of the DPR. These servers store all the information about Shaltai-Boltai’s activities. Neither Russian nor Ukrainian law applies there. In fact, the territory is outside the legal framework, which was very convenient for hackers. However, it will still be easy for Russian security forces to seize the servers, unless there are those in this territory who have already eliminated all the information on the servers.

But an international theme also appears in this case. Representatives of the human rights organization “Team 29” are one of the defenders of those arrested. According to some reports, this NGO is sponsored by the Soros Foundation, and the Shaltayevites themselves have often visited the United States.

Team 29 was created by former employees of the Freedom of Information Foundation (FOI). In 2014, the fund ceased its activities as it was included by the Ministry of Justice in the register of foreign agents. By the way, the ex-wife of Team 29 leader Ivan Pavlov, Jennifer Gaspar, was expelled from Russia on the basis of an FSB report.

According to sources familiar with the investigation, the Humpty Dumpty case affects almost all aspects of Russian politics. And during the investigation, data emerged that pointed to famous and respected people.

All roles - customer, performer, liaison, guarantor, witness, and so on - will be precisely established for each of the suspects. All culprits will be punished, no matter what their status. This case will definitely go to trial, says one of the publication’s interlocutors, emphasizing that those involved in the group’s activities are currently trying to present themselves as victims.

Alexander Zazykin

Most of the members of the hacker group are wanted.

On Saturday, January 28, Rosbalt reported that FSB officers in St. Petersburg detained the creator of the Humpty Dumpty website, Vladimir Anikeev, better known in certain circles as Lewis. As the agency learned, the special operation was the result of a long work, during which the man was lured out of the territory of Ukraine.

Anikeev was taken to Moscow, where the FSB Investigation Department charged him under Article 272 of the Criminal Code of the Russian Federation (Illegal access to computer information).

The pinnacle of Lewis’s “career” was the publication of correspondence allegedly belonging to Vladislav Surkov. A group of Ukrainian hackers calling themselves the “Cyber Junta” claimed responsibility for it in October 2016. But over the years of “creativity”, other familiar names appeared every now and then in the “plums” of “Humpty Dumpty”. Rosbalt recalls the most resonant publications.

Putin's New Year's address

A few hours before the onset of 2013, the Anonymous International organization published a New Year's address from Russian President Vladimir Putin. Then, for the first time in history, the head of state recorded two congratulations - this was connected with the terrorist attacks in Volgograd. The hackers had at their disposal the text of a version recorded not at the walls of the Kremlin, but read from the Far East, where the president arrived to help those affected by a natural disaster.

"Temniki" for federal channels

People started talking about a mysterious group that publishes various secret documents in 2014. Then journalists received a number of letters, including with a script for a rally in support of Crimea, data from closed opinion polls on the issue of annexing the peninsula to Russia, and reports on the activities of the Young Guard of United Russia.

On March 31, the Anonymous International blog published a link to documents in which, as stated, “the administration of the President of the Russian Federation prescribed the emphasis of coverage of certain topics.” Allegedly, the heads of federal channels were given instructions on how to show certain events. For example, in a story about a meeting with Prime Minister Dmitry Medvedev, it should have been explained that “over 23 years of being part of independent Ukraine, Crimea, due to the fault of the Kiev authorities, has mainly degraded,” and “the goal of the Russian government now is to ensure the establishment of a new life on the peninsula , bring Crimea to all-Russian standards in quality of life.”

That was just the beginning. Later, Humpty Dumpty published huge amounts of correspondence allegedly belonging to the heads of some media outlets.

Exposing the Kremlin chef

On May 23, 2014, Anonymous International posted a photograph with the headline “A small announcement for Monday” and a quote from Victor Pelevin’s novel Empire V. The picture depicted Vladimir Putin, Dmitry Medvedev and the famous entrepreneur Yevgeny Prigozhin, owner of the Concord company, which is part of the among the main food suppliers for the Administration of the President of Russia. He is also credited with overseeing the so-called “Troll Factory” in St. Petersburg, whose employees are engaged in posting comments on the Internet on political topics.

Three days later, correspondence from alleged employees of the Internet Research Agency was published, containing various documents, reports, notes, estimates of the so-called “trolls.” And then another portion. The letters contained, among other things, a mention of a certain confidential certificate that must be given to “Volodin” and “EV”.

According to Anonymous International, the “troll factory” was engaged not only in commenting and promoting news on the Internet. Allegedly, employees of the Internet Research Agency infiltrated their agents into a number of media outlets. Thus, Andrei M. described the work of one of the state news agencies: “Opposition actions are reflected with skepticism. We try to write about power in a positive way, but without breathiness, so as not to alienate readers.”

Another publication is related to Kremlin cuisine. The hackers allegedly obtained correspondence from employees of a catering company, which tells about what happened at dinners organized for high-ranking officials of the state. One of the reports is entitled: “February 15, 2013, Moscow, RGO restaurant Birthday of S.B. Ivanov with the participation of V.V. Putin.” According to the document, the menu that day included marinated Vasileostrovskaya smelt and black caviar with pancakes, as well as Somali ostrich meat, crocodile, goat meat, gray shark, and piranha. “Hot food was served on stones with meat from exotic animals and fish. Putin V.V. I ate grilled beef for main course,” the report says.

More than a year passed between the series of above-mentioned publications, during which time Roskomnadzor blocked access to the blog of the anonymous group “Humpty Dumpty”.

Medvedev's "resignation"

On August 14, 2014, it became known that the Twitter of Russian Prime Minister Dmitry Medvedev was hacked. Within a few minutes, the following entries appeared on his account: “I’ve been wanting to say this for a long time. Wow! You’re wrong”, “I’ll become a freelance photographer anyway!”, “I’m resigning. I'm ashamed of the government's actions. Sorry".

The fact of the hack was subsequently confirmed by the prime minister’s press service, noting that “the latest messages posted on the microblog are not true.”

On the same day, representatives of “Anonymous International” for hacking Medvedev’s account.

Correspondence of Timur Prokopenko

In December, hackers announced that they allegedly had personal letters and SMS correspondence from the deputy head of the internal policy department of the presidential administration.

SMS correspondence contains links to various news of a political nature, discussion of recent events - special attention is paid to Ukraine. There is, for example, the following message: “Youth organizations will lay candles and flowers at the Ukrainian Embassy (Address: Moscow, Leontyevsky Lane, 18) in memory of those killed at the hands of Bendera in Odessa. Number of participants in the event: 100 people. Time 20:00. Zhen, write to all the channels with information about this promotion for their decision and call, write to me, who will definitely be there if possible, but don’t drive me away.”

It was also reported about the cooperation of the Kremlin with State Duma deputies.

In addition, the letters indicated that the presidential administration was engaged in a campaign against Alexei Navalny.

Hacking of Kiselev and Gabrelyanov

2016 brought unpleasant news for two Russian media managers at once. At the end of April, Anonymous International announced the hacking of mailboxes and the Whatsapp messenger belonging to the famous TV presenter Dmitry Kiselev.

“The main part of the correspondence is occupied by letters related to Kiselev’s professional activities - the TV project “Russia Today” and everything connected with it, information about finances and assets, both personal and related to VGTRK television projects, is also presented. There is also a large amount of other very interesting information,” the hackers’ message said.

Some of the correspondence was put up for sale, some was in the public domain. From the published screenshots it follows that “Dmitry” corresponded with a man named Vladimir Kuznetsov, known as the pranker Vovan.

The archive also contains a letter from Vladimir Medinskiy, in which he asks to employ his friend in the Rossiya Segodnya news agency headed by Kiselev. In addition, the data array contains personal photographs of Kiselev, for example, from a “tourist trip” with his wife to Syria.”

A group of hackers put the correspondence up for auction with a starting price of 33 bitcoins, that is, just under $15,000. It is unknown whether anyone bought the archive.

At the end of June 2016, Anonymous International struck the head of the News Media holding Aram Gabrelyanov. The hackers put the complete archive with photographs and videos up for auction, and published some of them on their blog.

According to the hackers, the archive contains information about the LifeNews working kitchen, the channel’s accounting, as well as “letters of indignation from journalists fired from the editorial office.” So, in the file there is a letter from a certain Leysan S., who sends a report with information about employees to the addressee signed by Aram Gabrelyanov. Among them, as the author notes, there are those “from whom you can expect not very good news in relation to the team.”

Among the letters there is a price tag that famous writers and political scientists are supposedly ready to ask for their speeches. As well as screenshots of SMS correspondence, which contains, among other things, promises to delete unwanted information.

Ilya Davlyatchin

In short, “Humpty Dumpty” or “Anonymous International” is a hacker group that became famous for publishing a number of documents on Russian internal politics, as well as the personal correspondence of many members of the government. They first announced themselves in 2013 by leaking Vladimir Putin’s New Year’s address online ahead of schedule. Then, in less than a year and a half, Shaltai-Boltai published 75 publications that directly compromised Russian officials and deputies. At first, all this was done on a voluntary basis, but capitalism won, and Humpty Dumpty began selling information for a lot of money. They even have a logo:

By the way, it was they who hacked Dmitry Medvedev’s Twitter account in 2014. In the same year, they published personal letters from employees of the internal policy department of the Russian Presidential Administration. Judging by these letters, they monitored the actions of Alexei Navalny on the Internet, discussed the editorial policy of independent publications, seriously discussed the posts of ordinary people on social networks and thought about the possibility of blocking resources that were objectionable to the state. Just in 2014, Roskomnadzor included their blog in the register of prohibited sites. The Humpty Dumpty hackers regarded this as free PR for the group.

In 2016, hackers hacked the mailbox and WhatsApp account of TV presenter Dmitry Kiselev. In their hands was 11 GB of information, which included not only Kiselev’s personal correspondence, but also data on the purchase of luxury real estate in Moscow and so on. The hackers also took part in the creation of an information exchange and put up for sale correspondence between Medvedev’s press secretary Natalya Timakova and the head of Roskomnadzor Alexander Zharov. By the way, Medvedev’s correspondence published by Humpty Dumpty gave impetus to the FBK investigation, which resulted in the film “He’s Not Dimon for You” and the protests on March 26.

In general, Humpty Dumpty initially used stolen personal correspondence of high-ranking officials and famous people in order to put pressure on them and extort money for the safety of information. The official either agreed to the established amount, or the documents became public. Then they started selling the data at auctions for bitcoins. Their activities are more reminiscent of business than an attempt to undermine the authority of the authorities.

At the end of October 2016, the group’s organizer, journalist Vladimir Anikeev, known under the pseudonym “Lewis,” was arrested. At the end of 2016, the head of the FSB information security center Sergei Mikhailov, his deputy Dmitry Dokuchaev and the head of the computer incident investigation department of Kaspersky Lab Ruslan Stoyanov were also detained. The connection between these arrests and the Humpty Dumpty case has not yet been officially confirmed.

The last remaining hacker, Alexander Glazastikov “Shaltaya-Boltaya”, even gave an interview to BBC Russia:

www.youtube.com/embed/60BsQfd8HEk?wmode=opaque

The day before, law enforcement officers conducted a search in the apartment of the former deputy head of the FSB CIB Sergei Mikhalkov. About $12 million in cash was seized from him.

The hackers from Humpty Dumpty first became known in 2013. A few hours before the New Year, they published a congratulatory speech from Russian President Vladimir Putin.

Prime Minister Dmitry Medvedev, the secretariat of Deputy Prime Minister Igor Shuvalov, Deputy Prime Minister Arkady Dvorkovich, head of Roskomnadzor Alexander Zharov and many others became victims of cybercriminals.

The group was led by Vladimir Anikeev, known under the pseudonym “Lewis”. The hacker hacked into the computers of officials and asked for money for non-publication of data.

Vladimir Anikeev was detained in the fall of 2016. In December of the same year, Sergei Mikhailov and his subordinate Dmitry Dokuchaev were arrested. The head of the cybercrime investigation department at Kaspersky Lab, Ruslan Stoyanov, is also involved in the case.

____________________________

Blogosphere opinion

Three years of work by the FSB have yielded good results. The group was taken almost entirely. There are currently 6 people under arrest. Four detainees are known: journalist Vladimir Anikeev, head of the FSB Information Security Center Sergei Mikhailov and his right-hand man Dmitry Dokuchaev, as well as the head of the computer incident investigation department of Kaspersky Lab Ruslan Stoyanov.

The last three were arrested after Anikeev was detained. He turned them in. Mikhailov and Dokuchaev have been charged with treason; Anikeev and Stoyanov are currently charged with Article 272 of the Criminal Code of the Russian Federation (“Illegal access to computer information”).

The media are highlighting the circumstances surrounding the identification of Anikeev. While giving an interview to the online resource “Medusa” in Bangkok, which was published in January 2015, Lewis made a mistake and allowed the journalist to photograph his hat as confirmation that the interview was real. Stupid move. But even before that, on his page on the VKontakte social network, Vladimir Anikeev posted photographs from Bangkok wearing this hat.

However, this is not the most interesting thing. For ordinary citizens, is the question of the welfare of “domestic” officials much more interesting? The people have a question that arose from the housekeeper and wife to citizen Gorbunkov - Where did they get that kind of money?! After all, the size of the kickbacks ranged from 10 million rubles, and this was not the last money. Far from being the last... But this is a blow to the president as well. None of those who gave "Humpty Dumpty" their hands were fired or imprisoned. But we have declared a war against corruption...

As an interlocutor familiar with the investigation told Life, hackers from Shaltai-Boltai have come to the attention of the FSB since the beginning of 2014. The development and establishment of their identities took almost three years. And in October 2016, the founder of the group, a certain Lewis Carroll, was detained (the hackers took their names from the children’s book “Alice in Wonderland”). It turned out to be journalist Vladimir Anikeev. He was detained not in St. Petersburg, as some media claim, but practically on the border of Belarus and Russia.

The founder of Shaltai often visited St. Petersburg. And he constantly stayed at the Angleterre Hotel, where the poet Sergei Yesenin once died. The craving for life on a grand scale and the desire for fame, by the way, led to the fact that Lewis Carroll was declassified. While giving an interview to Meduza in Bangkok, which was published in January 2015, Lewis made a mistake and allowed the journalist to photograph his hat as confirmation that the interview was real. A stupid confirmation, of course. But before that, on his VK page, Vladimir Anikeev posted photographs from Bangkok wearing this hat.

As you can see, we slept on little. The level of detainees is impressive: Four are known: journalist Vladimir Anikeev, head of the FSB Information Security Center Sergei Mikhailov and his right-hand man Dmitry Dokuchaev, as well as the head of the computer incident investigation department of Kaspersky Lab Ruslan Stoyanov.

I am watching with interest (probably like all of you) the story of the caught hackers - the Humpty Dumpty group.

I think there was no doubt that they would be caught.

It was only a matter of time.

And the fact that high-ranking officials are involved is also probably quite expected.

This is what intrigued me:

“According to the case materials, many Russian high-ranking officials and businessmen paid Shaltai-Boltai so that their correspondence not only would not be sold to others or published, but that it would not even be put up for auction.