Unveiling GRU’s Information Operations Troops with OSINT and Medals
We tracked the infrastructure of one of the most secretive units of Russian intelligence by using phaleristics (i.e. the academic study of medals and military decorations) and traditional OSINT techniques.
Last year we published a report examining the infrastructure of the FSB’s 16th Centre, drawing on a year‑long survey of websites and forums specialising in insignia collection together with traditional OSINT techniques. Building on that initial study—and once again relying on the analysis of military decorations, known as phaleristics—we are now releasing a report on the Information Operations Troops (VIO) of Russia’s military intelligence service, better known by the acronym GRU.
Thanks to our corpus of 118 photographs of insignia, patches and military pennants produced in honour of the GRU, we have obtained an unprecedented view of the units that comprise the VIO, partially reconstructed their chain of command, and identified most of their known facilities across Russian territory. While some units were already well‑documented, others have been scarcely recorded—or not at all—in open sources. Information gathered from the Internet also helped us to pinpoint their likely locations.
Why Is It Important?
While the VIO has been publicly known since 2014, its infrastructure remained unclear until now. At a time when Russia continues its war of aggression against Ukraine and intensifies its covert information and cyber operations against European countries, we consider it essential to refine and update our understanding of the Russian intelligence ecosystem, which is likely to keep expanding in the years ahead.
A Creative Point of View
By issuing this second report, we demonstrate that the methodology employed in the first study is efficient and can be readily replicated. Nevertheless, our research does not resolve all outstanding questions—particularly those relating to the internal structure of the units, the number of officers involved, and the concrete, observable actions they may have undertaken. Moreover, unlike the first report, the insignia we collected do not indicate the locations of the units to which they belong. We will, of course, continue investigating decorations linked to the GRU’s VIO in the hope of answering these questions, and we plan to extend our enquiries to other Russian security and intelligence services in the coming months.
Indeed!, the CheckFirst Newsletter
Discover Indeed! our homemade newsletter delivered straight in your inbox with all the updates from Check First and it’s projects!
Subscribe
Decoding Secrets Through Symbols: How Military Insignia Revealed Russia’s Hidden SIGINT Network
Sometimes the best intelligence comes from the most unexpected sources. Our latest investigation proves this by using Russian online military insignia stores to map one of the FSB’s most secretive units.
Are YouTube Algorithms Addicted to State-Controlled Media?
Since the ban of Russia Today and Sputnik in the EU, the CrossOver project has been observing that CGTN Français, a Chinese State-run media, replaced the Russian fed content on Youtube when looking up the word “Russia”.
Disinformation on Donbas is only a Google autocomplete away
An investigation to demonstrate how French speaking Belgians were hinted at searching for dubious sources when looking up the word “Donbass” in the Google search bar.
“Pravda” Network: Worldwide Expansion and LLM, Wikipedia Pollution
CheckFirst, in partnership with DFRLab, shows how the Russian propaganda and disinformation “Pravda” network extended its coverage and aims (and succeeds) at polluting large language models (LLMs) and Wikipedia. Lastly, we demonstrate the inability of X’s Community notes to aptly address the spread of “Pravda” content on the platform.