Full Report
In January 2025, FSB officers searched the home of an 18-year-old trans girl from Tyumen, found correspondence with the Combat Organization of Anarcho-Communists (BOAK) on her phone, and threatened her with criminal charges that could have led to years in prison. Under pressure, she agreed to cooperate with the authorities, and her handlers tasked her with approaching LGBTQ people, gaining their trust, and trying to obtain compromising information on them. In an interview with The Insider, she described how recruitment works, how she managed to outwit the FSB, and how she fled the country without contacts, money, or an international passport.
Analysis Summary
# Threat Actor: Federal Security Service (FSB) of the Russian Federation
## Attribution & Identity
* **Actor Identification:** Federal Security Service (FSB) – specifically the regional directorate in Tyumen.
* **Aliases:** FSB, Russian Federal Security Service, "The Handlers."
* **Known Associations:** Combat Organization of Anarcho-Communists (BOAK) (monitored group/adversary), Prosecutor’s Office (legal facilitator).
## Activity Summary
In January 2025, the FSB conducted a domestic intelligence operation in Tyumen targeting individuals suspected of anti-war and anarchist activities. The operation involved the forceful recruitment of an 18-year-old trans woman to act as an informant and agent provocateur. The objective was to infiltrate LGBTQ+ circles and anarchist groups to gather compromising information ("kompromat") and identify other dissidents.
## Tactics, Techniques & Procedures
* **Physical Coercion & Intimidation:** Use of physical violence during interrogation (striking the victim) and psychological pressure (good cop/bad cop routines).
* **Legal Leverage (Compromise):** Threatening long-term prison sentences (15–25 years) for "training in terrorist activity" to force cooperation.
* **Unauthorized Device Access:** Seizure and technical bypass of mobile device security (passwords reset within 15 minutes of seizure).
* **Human Intelligence (HUMINT) Recruitment:** Forcing individuals to sign cooperation agreements under duress.
* **Entrapment / Agent Provocateur:** Tasking informants to "gain trust" and elicit confessions of LGBTQ+ status or illegal political views from targets.
* **Surveillance:** Monitoring of encrypted correspondence and email (specifically targeting communications with BOAK).
* **MITRE ATT&CK IDs:**
* **T1566:** Phishing/Social Engineering (via recruited informants).
* **T1213:** Data from Information Repositories (monitoring private correspondence).
* **T1005:** Data from Local System (physical seizure of phones/laptops).
## Targeting
* **Sectors:** Civil Society, Human Rights, Political Activism.
* **Geography:** Russia (Tyumen region), with cross-border monitoring.
* **Victims:**
* **Individuals:** LGBTQ+ people, trans individuals, youth activists.
* **Groups:** Combat Organization of Anarcho-Communists (BOAK), anti-war graffiti groups.
## Tools & Infrastructure
* **Malware:** Not specified, but involved technical tools for mobile device password resetting and bypass.
* **Infrastructure:**
* **Physical:** FSB City Headquarters at 40 Sovetskaya Street, Tyumen.
* **Communication:** Telegram (used for handler-informant communication).
## Implications
The FSB is increasingly using domestic "social cleansing" tactics, specifically targeting vulnerable marginalized groups (LGBTQ+) to weaponize them against political dissidents. This highlights a shift where the state uses social identity as a tool for recruitment and surveillance. The speed at which they bypassed mobile security suggests high-level technical capabilities for local device forensics.
## Mitigations
* **Operational Security (OPSEC):**
* Use of disappearing messages and strict data hygiene for political communications.
* Avoiding the storage of sensitive contacts or "kompromat" on physical devices within Russian jurisdiction.
* **Legal Defense:**
* Refusal to sign any documents without a lawyer present (as recommended by the article's legal section).
* Immediate reporting of recruitment attempts to human rights organizations if safe to do so.
* **Technical Defense:**
* Use of strong, non-biometric encryption and full-disk encryption.
* Defang and isolate communication hardware when operating in high-risk zones.