Full Report
Whether by coincidence or not, soon after 67-year-old Sergei Alpatov stepped down from his post as head of the FSB’s Economic Security Service “for health reasons,” his subordinate, General Alexander Kumanyaev, was taken into custody — as was Maxim Denisov, head of the FSB directorate in the Yaroslavl Region. Arrests of FSB generals at this level are extremely rare. Formally, both are accused of protecting major construction contractors, extortion, and using classified information for personal gain. But sources who spoke to The Insider believe corruption was only a pretext for the arrests of both men. The real reason, they say, was that Kumanyaev and Denisov “went after” a major construction company whose founders are tied to Alexei Dyumin, Vladimir Putin’s former bodyguard and one of his closest allies.
Analysis Summary
# Incident Report: Internal FSB Corruption & Political Purge
## Executive Summary
A high-level internal compromise involving FSB General Alexander Kumanyaev and Yaroslavl FSB head Maxim Denisov was neutralized following their arrest. The subjects are accused of leveraging classified intelligence and state influence to extort construction contractors and shield cartel activities. While formally charged with corruption, the incident appears to be a targeted counter-intelligence or political response triggered by the subjects "going after" a construction firm linked to Alexei Dyumin, a key ally of the Russian President.
## Incident Details
- **Discovery Date:** September 12, 2026 (linked to the resignation of Sergei Alpatov)
- **Incident Date:** Ongoing activities identified back to 2017/2019; Arrests occurred October 2026.
- **Affected Organization:** Federal Security Service (FSB), specifically the Economic Security Service.
- **Sector:** Government / National Security
- **Geography:** Russia (Moscow, Yaroslavl, Saratov)
## Timeline of Events
### Initial Access
- **Date/Time:** 2017–2019
- **Vector:** Exploitation of Trusted Relationship / Insider Threat.
- **Details:** General Kumanyaev utilized his position as a high-ranking official to provide "protection" (krysha) to the EKS group of companies.
### Lateral Movement
- **Details:** The actors expanded their influence across regional directorates, specifically the Yaroslavl Region via Maxim Denisov, and infiltrated civilian oversight bodies like the Federal Antimonopoly Service (FAS) to suppress investigations.
### Data Exfiltration/Impact
- **Details:** Misuse of classified FSB intelligence for personal financial gain; diversion of state funds (est. 10 billion rubles) through artificially inflated government contracts (Mosvodokanal, Defense Ministry).
### Detection & Response
- **How it was discovered:** Political friction arose when the subjects targeted a company (GC EKS) tied to Alexei Dyumin (Putin’s former bodyguard).
- **Response actions taken:** Forced resignation of department head Sergei Alpatov; simultaneous arrests of Kumanyaev and Denisov; seizure of secret bank accounts belonging to Oksana Kumanyaeva.
## Attack Methodology
- **Initial Access:** Position of Authority (FSB General rank).
- **Persistence:** Establishment of a "protection" racket and placement of family members (e.g., Oksana Kumanyaeva) in financial roles within compromised entities.
- **Privilege Escalation:** Use of FSB authority to block administrative and criminal proceedings by the Federal Antimonopoly Service.
- **Defense Evasion:** Using secret bank accounts and shell founders (e.g., Denis Kulakov) to mask the flow of illicit funds.
- **Credential Access:** Access to classified state databases and billing records for extortion.
- **Discovery:** Monitoring of competitor financial activities and government bid auctions.
- **Lateral Movement:** Expansion of the corruption scheme from Moscow to the Yaroslavl Region.
- **Collection:** Gathering of financial intelligence and sensitive documents on major construction firms.
- **Exfiltration:** Transfer of state funds to private offshore or secret accounts.
- **Impact:** Market manipulation via cartel agreements and erosion of state agency integrity.
## Impact Assessment
- **Financial:** Estimated 10 billion rubles ($117.5M) diverted via cartels; additional billions in secret accounts.
- **Data Breach:** Compromise of classified FSB operational data for personal extortion.
- **Operational:** Disruption of FSB Economic Security Service leadership; 400+ government facilities potentially impacted by fraudulent contracting.
- **Reputational:** High-profile exposure of systemic corruption at the General level within Russia's primary security agency.
## Indicators of Compromise
- **Behavioral indicators:** Sudden blocking of legitimate antitrust investigations; recruitment of "reserve officers" (GRU) into civilian construction management; use of government emergency vehicles for private transportation.
- **Financial indicators:** Secret bank accounts linked to family members of government officials; 1000% increase in revenue for companies linked to specific FSB handlers.
## Response Actions
- **Containment measures:** Arrest and physical custody of General Kumanyaev and Maxim Denisov.
- **Eradication steps:** Removal of Sergei Alpatov from his post as head of the Economic Security Service.
- **Recovery actions:** Ongoing investigation into the EKS group and Everest Financial Group to reassess current government contracts.
## Lessons Learned
- **Key takeaways:** Insider threats at the executive level pose the greatest risk to organizational integrity, as they can bypass standard compliance (FAS) controls.
- **What could have been done better:** Earlier cross-referencing of telephone billing records and "crony" networks between the FSB and the entities they oversee could have flagged the conflict of interest in 2019.
## Recommendations
- **Prevention measures:** Implementation of independent oversight for the FSB's Economic Security Service that reports outside the direct chain of command.
- **Auditing:** Enhanced financial disclosure requirements for the spouses and immediate relatives of high-ranking security officials.