Full Report
Mikhail Zvinchuk, founder of the Russian pro-war Telegram channel Rybar, returned to Russia after being detained and expelled from Montenegro. He arrived in…
Analysis Summary
# Threat Actor: Rybar (Mikhail Zvinchuk)
## Attribution & Identity
* **Primary Identity:** Mikhail Zvinchuk (Founder).
* **Aliases/Associated Entities:** Rybar (Telegram channel/project), "Rybar Team."
* **Key Personnel:**
* Valeria Zvinchuk (Creative Director).
* Sergei Belous, Pavel Lekatorchuk, Kira Doroshenko (Employees/Staff).
* **State Affiliation:** Closely coordinated with the Russian Government (Foreign Ministry, Security Services).
* **Sponsorship:** Financed by the Russian state defense conglomerate **Rostec** and previously linked to organizations associated with the late **Yevgeny Prigozhin (Wagner Group)**.
## Activity Summary
The actor recently conducted a multi-country European tour (Germany, Bosnia and Herzegovina, and Montenegro) ostensibly for filming and propaganda purposes. In October 2026, Zvinchuk and four staff members were detained in Risan, Montenegro, for violating sanctions-related entry protocols. Following diplomatic intervention from the Kremlin, the group was expelled and returned to Moscow via Belgrade. This operation follows a similar pattern of activities in the Czech Republic earlier in 2026.
## Tactics, Techniques & Procedures
* **Foreign Information Warfare:** Operating high-reach Telegram channels to disseminate pro-war propaganda and influence narratives.
* **Election Interference:** Accused by the U.S. State Department of participating in efforts to interfere in U.S. elections.
* **Field Operations/Intelligence Gathering:** Traveling internationally to collect footage and "on-the-ground" content using professional filming equipment and drones.
* **Sanctions Evasion:** Traveling through EU and Balkan countries despite being under active EU and UK sanctions.
* **State-Private Coordination:** Utilizing Russian diplomatic channels and security services to facilitate extraction/legal defense when detained abroad.
* **MITRE ATT&CK Mapping:** While primarily an information operations actor, their activities align with:
* **T1589:** Gather Victim Identity Information (via field operations).
* **T1597:** Search Closed Sources (Information operations).
## Targeting
* **Sectors:** Media, Government, and Information Environments.
* **Geography:** Ukraine, USA, European Union (specifically Montenegro, Czech Republic, Germany), and the Balkans.
* **Victims:** International audiences (propaganda), U.S. electoral systems (interference), and democratic narratives regarding the war in Ukraine.
## Tools & Infrastructure
* **Social Media:** Telegram (primary platform for the "Rybar" channel).
* **Hardware:** Professional filming cameras, GoPro cameras, and UAVs (drones) used for field operations.
* **Communications:** Encrypted mobile phones and mobile devices seized by Montenegrin authorities.
* **Defanged Digital Presence:**
* t[.]me/rybar
* rewardsforjustice[.]net/rewards/rybar-employees/
## Implications
Rybar represents a hybrid threat: part media organization, part state-sponsored influence operation. The actor’s ability to move through Europe despite sanctions highlights gaps in border security and sanctions enforcement within the EU and candidate states. The high-level Kremlin response to Zvinchuk’s detention confirms Rybar's strategic importance to Russia’s information warfare architecture and its integration with state intelligence apparatuses.
## Mitigations
* **Sanctions Enforcement:** Strengthening border alert systems for individuals on EU/UK/US sanctions lists.
* **UAV Restrictions:** Monitoring and restricting the use of drones by foreign "media" entities in sensitive geographic areas or near critical infrastructure.
* **Information Analysis:** Proactive monitoring of Rybar-affiliated Telegram channels to identify and debunk state-sponsored disinformation campaigns in real-time.
* **Diplomatic Pressure:** Coordinated international pressure on transit hubs (e.g., Belgrade/Sarajevo) that facilitate the movement of sanctioned Russian propagandists.