Second GRU Officer Indicted in Montenegro Coup Unmasked

A joint investigation between Bellingcat and The Insider has identified a second GRU officer, who was involved in the 2016 Montenegro coup, as Vladimir Nikolaevich Moiseev.

Two officers from Russia’s military intelligence (GRU) are sought, via Interpol, as suspected organizers of an unsuccessful 2016 coup in Montenegro. The true identity of one officer is public, while the other officer is known only under his cover identity. Bellingcat has been able to unmask the real identity of the second suspect indicted by the Montenegro prosecutor, and to confirm that he is indeed a senior GRU officer.

The name of the first Russian officer, Eduard Shishmakov, and his employment with GRU at the time of the events in Montenegro, was confirmed in a series of investigations by Bellingcat and its Russian investigative partner The Insider.

The second person is only known to Montenegro prosecutors under his cover identity, Vladimir Popov. It is under this cover name that he is being sought by Interpol and by Montenegro’s partner law enforcement agencies in Europe, as can be seen in the court case file.

Bellingcat and the Insider have now succeeded in unmasking “Popov”’s actual identity, which is Vladimir Nikolaevich Moiseev. Moiseev, who is a lieutenant colonel or colonel with Russian military intelligence, was born on 29.06.1980, the same date as the fictional “Popov.”

Bellingcat’s findings in the case of Popov/Moiseev add important and intriguing details to GRU’s modus operandi in undercover operations, including use of sham business operations, and add to the understanding of GRU’s covert operatives’ world, previously provided by our reporting on the two Skripal suspects, Anatoliy Chepiga and Alexander Mishkin. As in the case of Chepiga and Mishkin, findings directly contradict Kremlin’s statements that “Popov” was an innocent Russian tourist unjustly accused by a hostile foreign government.

Who is Vladimir Moiseev?

Vladimir Nikolaevich Moiseev was born in the small West-Siberian village of Pivkino (population just over 500 people) in the Kurganskaya region in the Urals, not far from Chelyabinsk. He attended the local village school before he moved Tyumen, about 200 km north of Pivkino, for his military service. Immediately following or during his military service, Moiseev enrolled at the Tyumen Military Engineering Institute, an advanced program churning out military engineers specializing in anything from radio-signal encryption to remote bomb detonation. He finished his studies with the rank of lieutenant.

It is not certain at what time — during his studies or thereafter — Moiseev was recruited by the GRU. Bellingcat last traced his registered address to the Tyumen Military Institute in 2005. At some point between 2005 and 2009, he was relocated to Moscow to serve at a GRU airborne Spetsnaz unit known as military unit № 48427 . In 2008, the Spetznaz unit took part in operations in Georgia during the Ossetia-Georgian conflict and the Russia-Georgia war. Thus, assuming Moiseev was assigned to this unit prior to 2008, he would have taken part in Russia’s military operations in Georgia.

In 2009, Moiseev was issued his new identity under the name Vladimir Popov. Like his GRU colleagues, Skripal suspects Chepiga and Mishkin, Moiseev “exists” in Russian databases with two parallel identities, as Vladimir Moiseev and as Vladimir Popov.

Until 2014, Moiseev and his family resided at the 48427 Spetznaz unit’s dormitory at Matrosskaya Tishina 10 in Moscow. In March 2015, Moiseev was given an apartment in the same residential building where Skripal suspect Mishkin was also given an apartment several months earlier. As in Mishkin’s case, the apartment is registered in the name of Moiseev’s wife and children, and the GRU officer is not mentioned in the real estate deed.

Under his new cover identity, “Popov” was employed by as a “photo correspondent” and “journalist” working for an insurance periodical called Morskoye Strakhovanie (literally: “Marine Insurance”) and used this cover to travel across Europe in the period 2012-2016. He even published “articles”; a now defunct website for the periodical featured “Popov”’s work listing the world’s greatest seafarers. It was namely under the cover of a journalist for Morskoye Strakhovanie magazine that “Popov” travelled to Serbia in October 2016.

How was Moiseev unmasked?

The starting point for this investigation was the name “Vladimir Nikolaevich Popov,” birthdate June 29, 1980, passport photo and international passport that was published by Montenegro prosecutors and by Interpol. The passport data also had a place of birth: “Kurganskaya oblast” (misspelled on the Interpol website as “Kurgastaya”).

Additionally, there were three color photographs posted by “Popov” on social media; as well as a still from a video surveillance tape made by Serbian police capturing a meeting between Shishmakov and Popov in a Belgrade park a few days before the Montenegro events.

Bellingcat’s working assumption was that the name “Popov” was an alias. This hypothesis was confirmed when they obtained passport and address data for a person with this name and birthdate from a publicly available Moscow database (Larix).  Only one matching entry in the database was found; the individual had only one passport listed,  issued in 2009, and was listed as being born in “Kurganskaya oblast.” No earlier references to this individual were found in this or any other databases Bellingcat consulted.  The entry also listed a Moscow address.

Then they obtained an ownership certificate for the Moscow address from Russia’s official real estate registry, Rosreestr. It listed a Russian couple in their 70s as owners of a small one-bedroom apartment. Investigators located the family’s home telephone number via a search at the popular Russian reverse phone lookup website They contacted the family and were told that they had never heard of a Vladimir Popov. This lent more weight to the initial hypothesis, as Bellingcat had observed a similar “random assignment” of a residential address to other undercover GRU operatives, such as Chepiga.

At this point, it was decided to search for Vladimir Popov in Moscow’s vehicle ownership databases. Several iterations of these vehicle databases maintained by GIBDD, a.k.a. Russian Traffic Patrol, have been leaked over the years and are freely available on Russian torrent websites. In a 2011 version of the database, it was found that a Vladimir Popov, having the same age as the person wanted by Interpol and the same (fake) Moscow address, owned a Kia CEED.

This new information gave three significant additional leads. One was the fact that the passport issuing authority was the Central Migration Directorate in Moscow; the same passport-issuing agency that issued the undercover passports for Chepiga and Mishkin. The second was the contact telephone number. The third were two numbers identifying the vehicle owned by “Popov” (VIM number and car passport number).

Using these vehicle details, investigators were able to log into the Russian government e-services portal and obtained a list of traffic violations linked to the car in question. They found 10 unpaid speeding tickets, of which 4 were concentrated near two GRU addresses in Moscow: Khoroshevskoye Shosse 76b (the GRU headquarters building), and the “Tower” GRU building in Khimki.

Then, Bellingcat’s investigators cross-referenced the phone number listed on “Popov”’s car registration against online reverse search phone databases, and found it on one of them, listed with the name “Vladimir Nikolaevich Popov.”

At this point, it was decided to test the hypothesis that had previously helped them to track down the true identity of GRU operative Alexander Mishkin. They searched Moscow databases with the first name and patronymic used by “Popov”, using the birthdate of 29 June 1980, while leaving the last name blank as a wild card.

In the 2011 Moscow vehicle registration database, only one matching entry was found. A certain Vladimir Nikolaevich Moiseev is listed as the owner of a Subaru Legacy Outback. This person has a passport issued in the Tyumen region. Tyumen is a city not far from Kurganskaya oblast, and was listed in “Popov”’s now defunct VK profile as his place of studies, thus this entry appeared interesting. What is more interesting, however, is the listed address for this individual, as of 2011.

The address is Matrosskaya Tishina 10, with a further specification of Military Unit 48427. This military unit number was the alias for a Separate Spetsnaz Airborne Reconnaissance Unit, under GRU’s command, which played a critical role in the two Chechen wars and in the Russia-Georgia war.

At this point, working hypothesis was that Moiseev— matching the alias pattern seen with Mishkin and Shishmakov, and also registered to a military unit under a GRU command, and, furthermore, having a link to Tyumen just as “Popov” did — was, in fact, the real individual hiding behind the “Popov” persona.

Intending to work purely with open source data, Bellingcat chose not to procure a passport copy for Moiseev. Instead, they searched through various additional leaked or commercially available databases for further clues about this man. Tyumen residential database was searched, and it was found that a Moiseev — having the same passport number as the one listed above — registered in 2004 and 2005 to the address of the Tyumen Military Engineering Institute. Then they looked into the residential databases of Kurganskaya oblast, and found the same Moiseev with a registered address — and an indicated birthplace — in the tiny village of Pivkino. Thus the candidate also matched the place of birth as indicated in the fake passport: Pivkino is in Kurganskaya oblast.

After that, they digged the online system for traffic for violations made by Moiseev under his true name, with the Subaru. They found one traffic violation from 2017, and a corresponding speed-cam photograph, but it was not sufficiently clear to serve as identification.

Then it was decided to search for family members who might have a photograph of Moiseev. They searched the Moscow residential database for people having the family name Moiseev/a and having a residential address at а the 48427th unit’s military base in Moscow. A woman was found, with the last name Moiseeva (as per the rules of the Russian language, the female version of Moiseev is Moiseeva), and of similar age to our Moiseev. But also a child with the same family name and the patronymic of Vladimirovich (meaning the father’s name was Vladimir). Hypothesis was that they may have just found Moiseev’s wife and child.

They were able to identify a social media account for the woman. It was a closed-access account on the Russian social network Odnoklassniki, which prevented them from accessing photographs. However, they were able to browse through a list of friends of this account, and came across a woman that had the same birthdate as Moiseev, and had “Moiseeva” in her name in brackets, which is customarily how women list their maiden names on the Odnoklassniki social network, a site originally meant for locating old classmates. The investigators assumed that this woman is Vladimir Moiseev’s twin sister. This was confirmed when they found her name in the residential database of Pivkino.

Moiseev’s sister’s account contained an extensive photo gallery, including photographs of children whom she identified in comments as her brother Vladimir’s children, and who bore a strong visual resemblance to the person known as “Popov.” However, there was no photograph of her brother.Ultimately, they stumbled upon the smoking gun, a link between “Popov” and Moiseev, in a more recent version of the GIBDD’s vehicle database of Moscow residents. In it, Moiseev was listed as owning a newer version of the same car as in 2011 (a 2015 Subaru Outback). In this database, Moiseev was listed with a contact telephone number identical to the number listed for “Popov” under his car registration entry.

Furthermore, the recent database contained a new address for Moiseev, which was in the same apartment complex as the residence of Skripal poisoning suspect Alexander Mishkin. The exact address allowed us to receive ownership information from the Russian real-estate database, which showed a similar-sized apartment as Mishkin’s and a similar arrangement: a transfer of ownership, unencumbered with any mortgage, directly from the city of Moscow (as it was the original owner of the newly built apartment building) to Moiseev’s wife and children.