Full Report
A married couple with Russian and Israeli citizenship, Alexander Kruglyansky and Alexandra Kruglyanskaya, have been arrested in Montenegro, where they will be…
Analysis Summary
# Incident Report: Detention of Russian-Israeli Nationals for Suspected Espionage & Smuggling
## Executive Summary
A married couple with Russian and Israeli citizenship, Alexander Kruglyansky and Alexandra Kruglyanskaya, were detained in Montenegro following the discovery of specialized surveillance equipment and €1 million in cash. The incident suggests high-level espionage or intelligence activity, involving the smuggling of dual-use IT equipment and money laundering. The suspects are currently in custody pending a 30-day investigation by national and international security agencies.
## Incident Details
- **Discovery Date:** September 23, 2026
- **Incident Date:** Ongoing (detained during attempted exit)
- **Affected Organization:** Government of Montenegro (National Security Agency)
- **Sector:** Government / National Security
- **Geography:** Montenegro (Tivat Airport, Budva, Bar)
## Timeline of Events
### Initial Access
- **Date/Time:** September 23, 2026
- **Vector:** Physical Border Crossing
- **Details:** The suspects attempted to fly from Tivat Airport to Tel Aviv. During a customs search of 19 suitcases, officers discovered undeclared electronics and currency.
### Lateral Movement
- **Physical Movement:** The couple traveled through Montenegro on tourist visas, maintaining residences in Budva and Bar.
- **Logistical Movement:** The suspects moved large quantities of hardware and multi-national currency across borders undetected prior to the September 23 stop.
### Data Exfiltration/Impact
- **Surveillance Risk:** Seized equipment indicates the potential for unauthorized signal interception and physical tracking.
- **Financial Impact:** Approximately €1 million in various global currencies seized, including suspected counterfeit notes.
### Detection & Response
- **Detection:** Identified by Border and Customs officers at Tivat Airport during luggage screening.
- **Response Actions:** The suspects were arrested; search warrants were executed at properties in Budva and Bar. National Security Agency (ANB) and international intelligence communities were engaged for forensic analysis.
## Attack Methodology
- **Initial Access:** Misuse of tourist visas for long-term operational stays.
- **Persistence:** Utilization of multiple rental properties (Budva and Bar) to store equipment and cash.
- **Privilege Escalation:** N/A (Physical realm).
- **Defense Evasion:** Use of 19 suitcases to blend in as heavy travelers; dual citizenship to complicate background checks.
- **Credential Access:** N/A.
- **Discovery:** Physical reconnaissance using BugHunter Professional BH-04 radio-signal detectors and GPS trackers.
- **Lateral Movement:** Regional travel across Montenegro.
- **Collection:** Audio/Video surveillance via cameras and microphones.
- **Exfiltration:** Attempted physical removal of data storage devices and hardware via air travel.
- **Impact:** Potential compromise of local privacy or national security secrets.
## Impact Assessment
- **Financial:** Seizure of ~€1 million in cash (multiple currencies).
- **Data Breach:** Unknown; forensic examination of seized storage devices is pending.
- **Operational:** Potential compromise of Montenegrin security or target organizations being surveilled.
- **Reputational:** Highlights Montenegro as a potential hub for foreign intelligence "sleeper" or logistical activities.
## Indicators of Compromise
- **Hardware Indicators:**
- BugHunter Professional BH-04 (Radio-signal detector)
- GPS trackers with microphones (Russian-labeled)
- Polygraph machine
- Specialized communication devices
- **Behavioral Indicators:**
- Excessive luggage (19 suitcases for two people)
- Large quantities of undeclared cash in eight different currencies
- Frequent entry/exit on tourist visas without clear business purpose
## Response Actions
- **Containment:** 30-day detention of Alexander Kruglyansky and Alexandra Kruglyanskaya.
- **Eradication:** Seizure of all IT hardware, surveillance gear, and funds.
- **Recovery:** Coordination with international intelligence agencies to determine the scope of their mission.
## Lessons Learned
- **Customs Vigilance:** Routine luggage checks remain a primary defense against the physical exfiltration of intelligence hardware.
- **Visa Monitoring:** Frequent re-entry on tourist visas by foreign nationals carrying high-value IT equipment should trigger automated flags.
- **Regional Trends:** This incident follows a July 2026 expulsion of three other Russians with similar gear, indicating a pattern of using Montenegro for technical intelligence operations.
## Recommendations
- **Enhanced Screening:** Implement stricter scrutiny for travelers carrying high-density electronic hardware.
- **Forensic Cooperation:** Ensure rapid data sharing with EU and NATO partners regarding the seized digital storage.
- **Counter-Espionage:** Increase surveillance on temporary residents utilizing multiple properties across different municipalities (Budva/Bar).