Full Report
Czech police have detained and questioned Russians Vitaliy Chashchukhin and Igor Dolmatov, whom local journalists from the publication Seznam Zprávy had lured…
Analysis Summary
# Incident Report: Exposure and Expulsion of Russian Influence Operatives in Prague
## Executive Summary
Czech journalists and law enforcement successfully disrupted a European influence operation orchestrated by the sanctioned Russian propaganda project Rybar. Operatives Vitaliy Chashchukhin and Igor Dolmatov were lured into a sting operation in Prague while attempting to recruit local experts for a disinformation campaign. Following their exposure and subsequent police interrogation, both individuals were designated as undesirable persons and issued three-day expulsion orders.
## Incident Details
- **Discovery Date:** September 22, 2026
- **Incident Date:** September 2026
- **Affected Organization:** Czech Civil Society / Information Environment
- **Sector:** Media / Government / Civil Society (Cognitive/Influence Operation)
- **Geography:** Prague, Czech Republic and Berlin, Germany
## Timeline of Events
### Initial Access
- **Date/Time:** Prior to September 22, 2026
- **Vector:** Social Engineering / Pretexting
- **Details:** Representatives of the sanctioned Russian project Rybar approached Czech media literacy and disinformation expert Bohumil Kartous. They requested an interview under the false pretext of filming a documentary series detailing the political and economic situation in Europe.
### Lateral Movement / Campaign Expansion
- Operatives Vitaliy Chashchukhin (propagandist) and Igor Dolmatov (cameraman) traveled from Berlin to Prague to conduct the interview. Investigation revealed this was part of a wider effort by Rybar to recruit politicians, experts, and public figures across multiple European countries to embed pro-Kremlin narratives.
### Data Exfiltration/Impact
- The operation sought to gather video footage and commentary from European targets to construct propaganda. The objective was to portray Western Europe as being in economic decline and argue for the cessation of military aid to Ukraine.
### Detection & Response
- **September 22, 2026:** Journalists from the Czech publication *Seznam Zprávy* executed a counter-operation, setting a trap by secretly recording the meeting. When journalists identified themselves and confronted the operatives, Chashchukhin and Dolmatov fled the scene.
- **September 22–23, 2026:** Czech police detained and interrogated Chashchukhin for approximately nine hours. Both Chashchukhin and Dolmatov were issued official orders to leave the Czech Republic within three days. Czech security agencies initiated reviews of their activities and alerted German intelligence.
## Attack Methodology
- **Initial Access:** Social engineering via pretexting (masquerading as independent documentary filmmakers).
- **Persistence:** Exploiting long-term legal status; Chashchukhin held permanent residency in Germany for a decade to operate continuously within the EU.
- **Privilege Escalation:** N/A (Leveraging media credentials to gain access to high-profile targets).
- **Defense Evasion:** Using alternative credentials and working on behalf of various sanctioned/unsanctioned media cut-outs (e.g., Izvestia, Channel Five, REN TV) to bypass EU sanctions; utilizing an unlinked coordinator (Boris Dvorkin) to organize logistics.
- **Credential Access:** N/A
- **Discovery:** Target reconnaissance focusing on European media literacy experts, public figures, and politicians.
- **Lateral Movement:** Unrestricted cross-border travel within the Schengen Area (Berlin to Prague).
- **Collection:** Gathering video interviews and intelligence from European subjects.
- **Exfiltration:** Dissemination of tailored information operations through Rybar and state-controlled Russian media networks.
- **Impact:** Cognitive manipulation aimed at undermining European support for Ukraine and destabilizing public trust.
## Impact Assessment
- **Financial:** Disruption of funded Russian documentary and influence infrastructure within Europe.
- **Data Breach:** None reported; no sensitive technical data compromised.
- **Operational:** Temporary disruption of Rybar's European recruitment network.
- **Reputational:** High; public exposure of Rybar's operational tactics and the identification of Moscow-based coordinator Boris Dvorkin, linking him to the SVR-funded History of the Fatherland Foundation.
## Indicators of Compromise
- **Network Indicators:** N/A
- **File Indicators:** N/A
- **Behavioral Indicators:**
- Unsolicited requests for interviews regarding European economic decline or Ukraine policy from individuals linked to Moscow-based filmmakers.
- Media personnel operating within the EU who maintain hidden ties to sanctioned entities like Rybar or Izvestia.
## Response Actions
- **Containment:** Counter-pretexting and hidden recording by journalists to document and halt the immediate operation.
- **Eradication:** Nine-hour police interrogation of the primary operative.
- **Recovery:** Issuance of a 3-day expulsion order from the Czech Republic and cross-border escalation to German authorities.
## Lessons Learned
- **Exploitation of EU Residency:** Sanctioned threat actors rely heavily on operatives with valid EU residency permits to maintain physical access to European targets.
- **Use of Operational Cut-Outs:** Disinformation campaigns frequently use third-party documentary filmmakers (e.g., Boris Dvorkin) who are not yet publicly associated with sanctioned entities to obscure ownership.
- **Efficacy of Proactive Exposure:** Public exposure via investigative journalism remains a highly effective control for disrupting cognitive threat campaigns before they achieve distribution.
## Recommendations
- **Enhanced Vetting Protocols:** Implement rigorous background checks on independent or foreign journalists requesting interviews with public figures, cross-referencing names against sanctioned entities (e.g., Rybar, Izvestia).
- **Cross-Border Intelligence Integration:** Increase coordination between EU member states regarding individuals residing in one country but conducting suspected influence operations in another.
- **Public Awareness Campaigns:** Educate civil society experts and politicians on the social engineering pretexts currently favored by foreign intelligence operations.