Ministry of Defence GRU close access cyber operation against OPCW Tuesday 10 April 2018 - Arrival from Moscow at Amsterdam Schiphol Airport Tuesday 10 April 2018 Accompanied by embassy personnel E awmxa 00 Humsonm Wm3 A m1 macmn Port'm u'KAa Rl' u a Inn- hm - '7 Run Illa-Overview of Russian persons Diplomatic passports Unclassified For Official Use Only I r- 17'0 135I'Ibho 17 04 2017 Mini 90601414 Li 5 10m Name Aleksei Sergeyvich MORENETS Date of birth 31-07-1977 Place of birth Moermanskaya Oblast Passport nr 100135556 Role Cyber operator Unclassified For Official Use Only Evgenii SEREBRIAKOV 1- - I 20 07 1931 w tui Name Evgenii Mikhaylovich SEREBRIAKOV SEREBRYAKOV Date of birth 26 07-1981 Place of birth Kursk Passport nr 100135555 Role cyber operator Unclassified For Official Use Only 65's Name Oleg Mikhaylovich SOTNIKOV Date of birth 24-08-1972 Place of birth Ulyanovsk Passport nr 120018866 Role HUMINT support Unclassified For Official Use Only Alexey MININ outrun museum mm m 'Wtzm - saetcs aanerssluw ALEXEY FoccwWIW notation i-M Hi it H 954 Name Alexey Valeryevich MININ Date of birth 27-05-1972 Place of birth Perm Oblast Passport nr 120017582 Role HUMINT support Unclassified For Official Use Only Car rental agreement Citro n C3 PF-934-R Nuarn Adros warns -an Telefocn uerklaren oat 2i een overeenkc-mst hebben gesloten ham 2 z-mum 'u 0M Sc-tmkoa' Strum IO 21 55 IA Ru fla 061 76 1 539 5 mun cr 3 Minin Jov- w'nr 99no areaver - WINNROVE REENKOMSI 11 5 ch I I'll a we II 'b m an 60on 1 1 n- omvm' mm- 70 15 cr- Ivutw' me u u 74-12 Hats a as cawu nun A ca um unu c-hL-l un - -- your '11 luihl'n- 1 4 1 - I l r xx w '17' - ll new u 9-921 rwLIKI 'cuxl 2 T v-u a nucn vucc erv n -r um 93 0 '22 39' 2 19 3 'Ii lli 5 46 AIRMHC lh1 I 11 H hhAJJ- n mfnih am on u I'm' 1 L It in an mm a S q r 4 I19 3 91 Vtvill i 'l '63 2 30' 9 '0 bliw l l9- tlLU-l bin bill'd II' 1 Lean 1 x mun-o haw-0 1 mu mum lu'uklof 'x mum-m - aura 47 vl may u ng uni-M nadaul-u vi 1 m I I d-A-cr In 4 41 31 31 Ira 75th nu 2min 7 lu-m Ir mm In - y In menu mew an ac nua H H- t c'1l- Ir 'le's an v- 'ru w 9- Pv-Ia- v-s mnv'unl-v lul- vlw'm' 0 1 5 91 91 3 3' '1 'r Una-nut mumg mu _9 with unit v l Unclassif'ed For Official Use Only Car rental agreement Citroen C3 PF-934-R ACCESSOIRES INNAME CH ECK-IN check-cut ml- p-l -jo lv 2 '3d 3 Iran-so I nu 0 th I- site v 1 m ans- mm 4-10m 1- n1 - is a I we Luau- ew 1 'umwvta'd El - 411 under Vmae DAMAGE vesz NO Hat mm chz' scrut- cat a In I Iv' v r nle s i - vxer c- 'r P baud-a 4 - I at on bur-rum 1 quagma'g room-run a um nv- - J nun-d all n zr'v mart- 1 I - nl-c -H MM Minn nr rut-1 c a s r e'rtr' a4 an 9 rot rru'rrk 4mm 9 A _lnd e1 ulot I angud-ogm udbant qowuat ard cknacn nr n'wzh Hm urn-runn- as sun d n in worn an 4 om van M1 m wg cum can return 1 3mm m V - nu_ldun am-Mm - EIa-dml-mvn a nay-gf glduir bumrekmnqu mar x- nhu dc' Warwick arm er nan-n 3mm 1 Unclassified For Official Use Only Reconnaissance of OPCW and surroundings Photos taken on 11 April found on camera Reconnaissance of OPCW and surroundings 0 Photo taken on 12 April found on camera 4 as 55 5 say Reconnaissance of OPCW and surroundings Photo taken on 13 April found on camera Unclassified For Official Use Only Situation map Location of rental vehicle on Friday 13 April narrow a Bel Cow on Even No awoke 8901390 Unclassified For Official Use Only 01w AA untru fu A - Y 5 WiFi panel antenna -Smartphone covered 4G -WiFi panel antenna Connected to Bag with battery Computer Transformer Specialist equipment in vehicle Setup for hacking WiFi connections Unclassified For Official Use Only Victim WiFi Router 0 Panel Antenna 2 i a use Smart LaptOD WiFi phone I USB I I Serial I I Power I use Computer in car Power Stabilizer Unclassified For Official Use Only WiFi panel antenna Hidden under coat Unclassified For Official Use Only Battery - an l 1 qt now my 4 mow um 83 on new Power supply 2 23 for equipment ITEM MOTOREN 5 WA TERSPORTARTIKELEN Pu a sed i Damn 1004MB Aamal The Hague 1 3 Unclassified For Official Use Only Unclassified For Official Use Only S 3 1 Ir Man 0 pl 3 A Operational modus operandi Security awareness Tried to destroy smartphone during disruption operation Operational modus operandi Security awareness GRU intelligence officers took their trash out of their hotel rooms crssilvsuza- 0-41 11 Kl-m I KB 28889518 8 Bz - HF906996678 2 Maul naszsauu31a_l 3 f lu l'l LIL 92 07039gfcj 9059967 r 58 3 I F6 v'J-u nrsoeaas7aa - f - MJ A Operational modus operandi Cash money 20 000 Euro s and 20 000 dollars Unclassified For Official Use Only 09-04-2018 OPCW 07 09 46 09-04-2018 07 09 46 09-04-2018 Oaganization for the Prohibition Chemical Weapos 07 10 16 09-04-2018 manization for the Prohibition Chemical Weapos 07 10 16 09-04-2018 1 1121 3 5078125 32 07 10 16 09-04-2018 Oaganisation for the Prohibition of Chemical Weapons 07 10 17 09-04-2018 gganisation for the Prohibition of Chemical Weapons 07 10 17 09-04-20 18 07 10 17 09-04-2018 Ogganisation for the Prohibition of Chemical Weapons 07 10 27 09-04-2018 manisation for the Prohibition of Chemical Weapons 07 10 27 09-04-2018 Online searches from SEREBRIAKOV's laptop Indicating interest in OPCW headquarters building and immediate surroundings 07 10 27 09-04-2018 Oaganisation for the Prohibition of Chemical Weagons 07 10 32 09-04-2018 Oaganisation for tha Prohibition of Chemical Weapons 07 10 32 09-04-2018 07 10 32 09-04-2018 The Hague Marriott Hotel 07 10 39 09-04-2018 The Hague Marriott Hotel 07 10 39 09-04-2018 The Hague Marriott Hotel 07 10 39 09-04-2018 07 10 39 I9-04-2018 7 10 39 Unclassified For Official Use Only ocau on- vow-90 hm I'm um upward- 11 rm-W 1 40K SoonAdditional specialist equipment Carried by SEREBRIAKOV Intended for hacking WiFi networks Opencelnd 51mg sec entenvmse you The world's largest Open Database of Cell Towers Locate devices without GPS explore Mobile Operator coverage and more 351 a 0 9 Search Cal Tents f5 c ucc 25 3 Nut 0 7' unz' - co Lamazeunima- 35 25 45 3 j h' Longwue 32 4 Ef c_l Range mu TU hi 4 u'wzumrtm 9 '2 33- Cream 2ch 74mm u- Upstma vrm 1 2 62-3511 LL 0 3 c l - - 2 J It-axm rwet rm 'mecmmt'saCmrbun' a U I Son erla F3311 Activated on 9 April through cell tower in Moscow GSM MCC 250 MNC 20 LAC 27813 CID 197679381 4h Ed in 3 10vp ll lumial l 30 1 1 k Il l CID 197679381 0 Nearest cell tower to known GRU barracks at Komsomolsky Prospekt 20 Moscow mul my II a V1 my Latcw Eddie Pedagogy tal lly k lv 1 mm yquQD hum rn I sad ta 1 t Khamovnikakh 3_ VP znb a m1 3 3 xaumwuv l-M-HC EAJ- upricso um My IL mpma Jsacwovu Market 3b to mun-zau-v FLU m_ locum own 7 '47 v ParryaI'ri KJ'andashu Klyath zurv an 9 yv l- rm rr0 3 Var y a hospis ll T Qf l inpuw Hero Monument mrm YUWU Ham-mu- Telmu Ich Ema tony I- rru nn'nrui arr - A r 9 A privacy reminder iom Google REMIND ME LATER 3 30 Casa de la Rosa VLL L l 3J1 rn r Pnskay'q im m wiu Kan rlvisk I Moscow Slate Academy of Choreograon Mary 33 3 I Ilz'r 5 l - fl Unclassified For Official Use Only McDonald 5 taxi receipt From Nesvizhskiy Pereulok to Moscow Sheremetyevo airport 0 Date 10 April 2018 22 7 22 rg pucmn I 2A Rear entrance of GRU barracks Opening onto Nesvizhskiy Pereulok i a Previous operations photo on laptop 14 August 2016 Olympic Games in Brazil picture above taken on 16 39 14-08- 2016 with Previous operations WiFi connections made by laptop 0 Grand Millenium Hotel Kuala Lumpur Malaysia from 16 to 22 December 2017 anag Gateway Mac Location etwork Name ype First Connect Last Connected ed DNS Suf x Address Profile GUID irelesQO16-09-17 2016-09-17 Unche 0 r 'r Airport Khimki Sheremetyevo Wi-Fi 19 10 57 00 00 19 10 57 00 00 cked 'r 1E-40 Russia WirelesQO16-09-20 2016-09-20 Unche 00-90-0B-29- F8A2C-7959-4COA- Lausanne LP_Public 5 20 17 39 00 00 20 29 12 00 00 cked lausanne-palace ne102-D7 Switserland WirelesQO16-09-20 2016-09-22 Unche 00-1A-A2-9F- Lausanne Hotel Alpha-Palmiers 5 21 26 51 00 00 08 59 34 00 00 cked monzoon net 9C-AE A81 Switserland Wirele 017-12-16 2017-12-22 Unche 90-E2-BA-58- Kuala Lumpur 5 3 21 01 00 00 12 39 21 00 00 cked localdomain ED-FB Malaysia Wirele 018-04-10 2018-04-12 Unche hotspot intemet-for- D0-BF-9C-3A- Noordwijk Palace-Hotel-Guests 5 2 58 44 00 00 09 53 14 00 00 cked Iguestscom 66-B5 Netherlands Wirele 018 04-12 2018-04-13 Unche 'r 'r 'r 50-9A-4C-6A- The Hague arriott GUEST 19 08 00 00 00 14 12 52 00 00 cked 'r F0-E5 9A9F896A5415 Netherlands Alpha Palmiers Hotel Lausanne Switzerland from 20 to 22 September 2016 Palace Hotel Lausanne Switzerland on 20 September 2016 Unclassified For Official Use Only v1s1ts visits - visits 09- 04- 2018 08 05 22 visits -admin OPCN Fact_ Sheets Russian Fact_ Structure visits noog1e j q esrc 0ahUKEwio7 7wxa2aAthE visits 09- 04- 2018 06217 17 LABOR SPIEZ - SPIEZ LABORATORY 0 d visits n-1ndex htm 09 04 2018 LABOR SPIEZ SPIEZ LABORATORY v1s1ts visits 3028 http swissinfo visits 3029 swissinfo ch eng safety _spiez 1aboratory aces chemica1 weap0ns visits 3271 swissinfo ch eng safety assessment visits 3272 swissinfo ch eng safety- assessment- visits 3931 swissinfo ch eng safety assessment - visits 3932 1abor spie2 ch enindex htm 09 04 2018 12 14 28 LABOR SPIEZ SPIEZ LABORATORY Austrasse 3700 Spiez wae uapm 09-04-2018 07 03 01 ttps google 6931311 7 6467636 19 052 data 4m5 3m4 150x478fadb1ff52 Ic9b 0xc55f8d818b681645 8m2 3d46 6913408 4d7 6432401 dcr 0 09-04-2018 07 03 01 ttps - 09-04-2018 07 03 01 le ru maps 09-04-2018 07 03 07 09-04-2018 07 03 14 Ie ru maos search hotels @46 6931311 7 6467636 09-04-2018 07 03 14 Target Spiez Laboratory Train tickets to Bern 0 Online searches for Spiez laboratory 0 Google-maps print-outs of Russian diplomatic facilities in Bern Unclassified For Official Use Only Unclassified For Official Use Only Google Maps print-outs B if99 315303 1719 4 17 3 Wm mm macaw 'Wmut-m M mom mm not I 1 MW mm no CACASH 1H Train tickets to Switzerland Departure from Utrecht for Bern Via mm 2 Basel gm 5 Planned date 17 April 2018 mm A Unclassified For Official Use Only