Full Report
At least four Russian regions have introduced restrictions or recommendations involving “zelyonka,” a bright green antiseptic commonly sold in pharmacies ahead…
Analysis Summary
# Incident Report: Physical Vandalism of Ballot Boxes and Resulting Security Restrictions
## Executive Summary
Multiple Russian regions have implemented emergency physical security restrictions following widespread vandalism during the March 2024 presidential elections. Protesters utilized "zelyonka" (a green antiseptic dye) and flammable liquids to sabotage ballot boxes, leading to a coordinated administrative and law enforcement crackdown ahead of the September 2026 State Duma elections. The impact included the physical destruction of voting records and a subsequent large-scale deployment of security personnel and surveillance hardware.
## Incident Details
- **Discovery Date:** March 2024 (Initial attacks)
- **Incident Date:** Ongoing; specific focus on Sept 18–20, 2026 (Election period)
- **Affected Organization:** Russian Central Election Commission / Regional Governments
- **Sector:** Government / Public Sector
- **Geography:** Russia (Tyumen, Khanty-Mansi, Kostroma, Chelyabinsk, Moscow, and others)
## Timeline of Events
### Initial Access
- **Date/Time:** March 2024 Presidential Election
- **Vector:** Physical entry into polling stations by individuals acting under the guise of voters.
- **Details:** Attackers bypassed standard security by carrying household liquids (antiseptics/flammables) that were not previously categorized as high-risk threats.
### Lateral Movement
- **Details:** N/A (Physical attack). The "movement" involved the propagation of these tactics across 29 polling stations in 20 different regions via social contagion or coordinated protest efforts.
### Data Exfiltration/Impact
- **Details:** Physical destruction of "data" (paper ballots). The staining liquids rendered ballots unreadable, compromising the integrity of the vote count in affected districts. In some cases, arson resulted in total loss of ballot integrity.
### Detection & Response
- **How it was discovered:** Real-time visual observation by election officials and security footage.
- **Response actions taken:** Immediate arrest of vandals; 2026 implementation of sales restrictions on antiseptics; installation of metal detectors and lockers; deployment of 800+ security personnel per region.
## Attack Methodology
- **Initial Access:** Social Engineering (posing as a legitimate voter).
- **Persistence:** N/A.
- **Privilege Escalation:** N/A.
- **Defense Evasion:** Use of common, legal medical supplies (zelyonka) to bypass traditional security screenings.
- **Credential Access:** N/A.
- **Discovery:** Physical reconnaissance of ballot box locations.
- **Lateral Movement:** N/A.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Environmental/Physical Denial of Service (DoS) of the voting process via chemical staining and arson.
## Impact Assessment
- **Financial:** Significant costs associated with increased security (700 police/100 National Guard per region) and expensive incentive programs (apartments/cars) to counter protest apathy.
- **Data Breach:** Integrity failure; loss of thousands of physical records (ballots).
- **Operational:** Disruption of the democratic process; requirement for new physical screening protocols at 448+ polling stations.
- **Reputational:** High public impact; highlighted domestic instability and opposition to the electoral process.
## Indicators of Compromise
- **Network indicators:** N/A.
- **File indicators:** N/A.
- **Behavioral indicators:**
- Possession of bulk quantities (5+) of staining liquids (zelyonka/iodine).
- Carrying flammable substances or sharp objects near ballot urns.
- Non-standard behavior near ballot boxes (attempting to pour substances).
## Response Actions
- **Containment measures:** Installation of additional lockers for personal belongings at entrances; use of metal detectors to screen for prohibited liquids.
- **Eradication steps:** Police-issued "recommendations" to pharmacies to limit the sale of antiseptics to a maximum of 5 units per customer.
- **Recovery actions:** Deployment of "Million Prizes" and "Viktorina-2026" incentive programs to encourage turnout despite the disruptive atmosphere.
## Lessons Learned
- **Key takeaways:** Low-tech, physical "denial of service" attacks using common household items can be highly effective at disrupting large-scale government operations.
- **What could have been done better:** Earlier identification of common antiseptics as potential "dual-use" tools for vandalism.
## Recommendations
- **Prevention measures:**
- Standardize prohibited items lists to include all high-staining chemical agents.
- Implement transparent ballot box covers that are resistant to liquid penetration or equipped with rapid-drainage systems.
- Enhance real-time monitoring of ballot urn perimeters by dedicated security staff.