CYBINT (Cyber Intelligence) refers to operations or research based on cyber intelligence. They involve the collection, analysis, and use of information obtained from cyberspace to achieve strategic, operational, or tactical objectives.

  • At least 65–70% of the entire active mainline fleet of the Russian Federation (more than 400 aircraft) is flying with critical No-Go-level defects. Another 15% have already been dismantled for donor parts.
  • 5-year forecast (2026–2030): The structural reserve of original parts has been exhausted. The mathematical probability of major aviation disasters (with total loss of the aircraft) rises to 85% annually.
  • An inevitable wave of 5–7 major crashes over the next 3 years is projected due to irreversible technical failures (turbines, depressurization, hydraulics).

Imagine an ordinary Russian family — a mother, a father, and a small child. They are climbing the stairs of a snow-white Airbus A320 at Sheremetyevo Airport, anticipating a long-awaited vacation in Sochi. A flight attendant greets them at the entrance with her usual but sincere smile, pleasant relaxing music is playing in the cabin, and the captain announces in a cheerful, confident voice over the loudspeaker that the aircraft is ready for takeoff. This family, like the other 150 unsuspecting passengers on board, is absolutely certain of its safety. They trust a brand that has been cultivated for decades as a national asset.

They do not know that the braking system of their aircraft was barbarically removed from a rusting donor aircraft that has been standing outdoors by a fence at a regional airport for a year. They do not know that the cabin pressure sensor is a cheap Chinese counterfeit bought for cash through a shell company in Dubai’s free port and imported into the country under the guise of an agricultural pump. They do not know that their lives right now depend on the greed of several dozen corrupt managers in the technical division, who decided they could save millions of dollars by turning a blind eye to the basic, blood-written rules of aviation safety.

After the start of Russia’s full-scale invasion of Ukraine, Russian civil aviation found itself under unprecedented, the harshest sanctions in the history of international aviation. The Western aviation giants Boeing and Airbus stopped supplying new aircraft, completely halted maintenance, revoked airworthiness certificates, disconnected airlines from technical update databases, and firmly blocked the supply of any spare parts, even the most insignificant ones.

Russian officials, ministers, and top managers assured Russian citizens from the screens of federal television channels that the country would manage on its own. They promised rapid “import substitution,” the production of hundreds of domestic MS-21 and Sukhoi Superjet aircraft, and, most importantly, absolute flight safety on the aircraft already in service. They insisted that Russian engineers had enough competence to keep the fleet in perfect condition. But the reality, hidden on heavily protected corporate servers of the technical division of PJSC Aeroflot, paints a completely different picture.

KRONOS dynamics obtained a unique data set exceeding 160 gigabytes. The hacker group “Hacker Cat” carried out a deep penetration into the infrastructure of LLC “AIR” (Aviation Engineering Solutions) — a key contractor for Aeroflot, certified under FAP-285 rules.

The hackers copied the data and carried out a total purge. The engineers’ physical workstations and the entire network infrastructure were paralyzed. During the attack, a 10-terabyte NAS server was completely wiped (destroyed beyond recovery). Backups (another 10 TB) and all virtual machines on two ESXi hosts were irreversibly encrypted. The engineering center’s operations were blocked.

The data extracted before encryption was handed by the “Hacker Cat” group to analysts from the KRONOS dynamics unit for deep processing and decryption. After analyzing thousands of hidden spreadsheets, convoluted customs statements, and multi-gigabyte mail archives, KRONOS analysts were able to uncover a global network of shadow procurement and the mass dismantling of passenger aircraft for parts directly on the apron.

This large-scale investigation is documentary confirmation of how one of the world’s largest airlines turned into a shadow smuggler. A company that cynically disregards basic safety rules, risking thousands of lives every single day.

Chapter 1: Sources of the Leak and the Role of LLC “AIR”

The heart and brain of any major aviation enterprise is its engineering and technical center. The directory “DISK AIR FAP 285”, extracted by hackers from encrypted ESXi servers, is the sanctum sanctorum of the national carrier’s technical support.

Here we found files with telling names such as “Critique,” “Balances as of Date,” “Nonconformity Reports,” and “Procurement Lists,” as well as personal folders of employees whose signatures appear on critical documents authorizing the departure of potentially defective aircraft.

The structure of the extracted data is striking in its manic detail and bureaucratic order, which played a cruel joke on its owners: they documented their own crimes. 

The database is divided into key directories: “3. PROCUREMENT”, “4. CONTRACTS”, “8. PERSONNEL”, “9. SUPPLIERS”, “11. AUDITS”. Separate PST mail archives extracted from the Exchange server of top managers are stored there as well. Each of these folders is a separate episode in a major crime against passenger lives. 

Chapter 2: Cannibals in the Hangars. Analysis of the “Donor” Database and Empty Warehouses

Publicly, officials of the Russian Ministry of Transport and aviation industry management categorically avoid the word “cannibalization.” They prefer sterile, euphemistic terms such as “resource redistribution within the group,” “optimization of logistics chains,” or “temporary borrowing of components.” 

In the directory “DISK AIR FAP 285/3. PROCUREMENT/” we discovered a striking electronic document with a blunt, almost cynical title: “PURCHASED DONORS.xlsx”. This spreadsheet is nothing other than a register of entire aircraft bought on the secondary market or forcibly written off from the active fleet solely so that they can be barbarically dismantled down to the last screw.

Imagine this scene in the semi-darkness of a technical hangar somewhere on the outskirts of a capital airport: mechanics with flashlights, wrenches, and crowbars are literally “gutting” an aircraft that was flying only recently. The document meticulously lists the serial numbers of the aircraft (MSN — Manufacturer Serial Number) from which engineers remove multi-million-dollar engines, the most complex auxiliary power units (APUs), multi-ton landing gear struts, hydraulic pumps, AC generators, and even mechanical wing elements — slats and flaps. These removed, often worn-out parts are then, after improvised inspection, installed on other aircraft that will carry full cabins of passengers a few hours later.

This practice is a direct, blatant violation of international aviation safety standards. Neither Boeing nor Airbus categorically permits uncontrolled swapping of complex components without thorough certification by international regulators — EASA (European Union Aviation Safety Agency) or the FAA (U.S. Federal Aviation Administration).

Confirmation of this horrific practice is provided by another massive file from the same folder: “Outgoing Delivery Notes 2024-2025.xlsx”. The records show alarming speed: a part, for example a critically important flight control unit (FMGEC) from an A320 aircraft, is removed from a “dead” aircraft standing by the fence and literally within a day, under an urgent delivery note, is transferred to an aircraft preparing for the Moscow–Antalya flight. No lengthy factory tests on benches. No manufacturer warranties. Only the signature of a tired engineer and hope in the famous Russian “maybe it’ll work out.”

The catastrophic shortage of spare parts can be clearly seen in the figures contained in the regular reports that land on the engineering center management’s desk every day. The files “Critique 16.03.xlsx,” “Critique 26.03.xlsx,” and “Critique 14.04.xlsx” contain the so-called “red list” of parts. And the file “balances as of 13.03.xlsx” demonstrates the complete depletion of warehouse stocks… According to our calculations, more than 40% of critical items are at absolute zero. Every flight is the result of incredible efforts to move parts from one aircraft to another, like a deadly game of Lego.

Chapter 3: Counterfeit in the Sky and Deadly “Deferred Defects”

When there are no original parts in stock and the supply of “donor aircraft” has been exhausted, counterfeit parts inevitably come into play. The black market for fake aviation parts has always existed on the dark margins of the industry, serving questionable airlines in third-world countries. But for Russia’s national carrier it suddenly became the main source of life support. And this counterfeit, as expected, predictably fails in flight.

While examining the folder “DISK AIR FAP 285/11. AUDITS/”, we came across the directory “1.9 Nonconformity Reports ATI” (Aviation and Technical Property). This is a true chronicle of the despair of honest engineers struggling with poor-quality parts purchased through gray schemes for outrageous sums. It contains thousands of incoming inspection and rejection reports: defective pressure sensors, faulty oxygen generators, dried-out door seals, filters, and critical hydraulic components. All of these parts were attempted to be installed on passenger aircraft, but experienced mechanics noticed at the last moment that they had been crudely refurbished, repainted in garage conditions, or were outright counterfeit. 

Behind the dry, bureaucratic lines of rejection reports lie real human dramas. Reading these documents and the accompanying correspondence, we can literally hear the cry of a mechanic’s soul in the hangar, holding a high-pressure fuel filter in his hands: *”The filter has been glued together crudely, there are visible traces of unevenly applied sealant, the threads are stripped and the pitch does not match. Installation on the aircraft is strictly prohibited; it will lead to engine failure!”*. And there are hundreds of such reports. In one document titled “8130 Delivery Documents1106287.pdf,” it is clearly shown how this waste is legalized. A counterfeit, non-original part is simply accompanied by a carelessly copied in Photoshop or outright forged FAA Form 8130-3 certificate (the main document confirming the part’s airworthiness). In any normal country, such a part would be immediately seized by the aviation authorities, and the buyer would be sent to prison. In Russia, they turn a blind eye to this in order to keep the flight schedule.

But what happens on the apron if a part is defective, there is nothing to replace it with, and an aircraft full of passengers is due to depart in an hour? The aircraft flies broken. 

In global aviation there is the concept of MEL (Minimum Equipment List) — a strictly regulated list of minimum equipment with a malfunction of which a flight to the maintenance base is still permitted. However, the file “Statement on Monitoring Deadlines for Correcting Nonconformities.xlsx” records systematic, mass, and brazen violations of these deadlines. The documents indisputably show that aircraft are operating dozens of regular passenger flights with so-called “deferred defects,” the list of which has long exceeded all conceivable and permissible safety norms. 

Analysis of the minutes of weekly meetings from the folder “Production Reviews” allowed us to compile a list of specific aircraft that are right now in a critical, pre-infarction state, yet continue to carry passengers:

1. Aircraft RA-73115 (Airbus A320)

Critical defect: Failure of the backup hydraulic system (Green System) and leakage of hydraulic fluid from the right landing gear.

Comment: The aircraft is flying with this “deferred defect.” In the event of a failure of the main hydraulics during landing, the aircraft will not be able to extend its landing gear or apply thrust reversers, which will certainly lead to a runway overrun.

2. Aircraft RA-73701 (Boeing 737-800)

Critical defect: Malfunction of the flight management computer (FMGEC) and systematic errors in the inertial navigation system.

Comment: Engineers installed on this aircraft a “refurbished” unit from Turkey that regularly provides false coordinates during flight. Pilots have to fly the aircraft effectively “blind” in areas with difficult terrain.

3. Aircraft RA-73822 (Airbus A321)

Critical defect: Faulty wing ice detectors and worn-out oxygen generators in the cabin.

Comment: The defect has been ignored for the third month due to a complete lack of spare parts. In the event of depressurization at an altitude of 10,000 meters, the masks will drop, but no oxygen will flow into them — passengers will lose consciousness within 30 seconds. Flying into cloud cover threatens uncontrolled icing and a spin stall.

4. Aircraft RA-73204 (Boeing 777-300ER)

Critical defect: Cracks in the high-pressure turbine blades of the right engine (GE90).

Comment: Instead of immediately removing the engine (which costs more than 20 million dollars), Aeroflot engineers simply extended the borescope inspection intervals by falsifying the approvals. Blade separation at cruising speed will lead to engine destruction and fuselage damage from debris.

5. Aircraft RA-73103 (Airbus A330-300)

Critical defect: Critical wear and deactivation of two of the eight brake units on the main landing gear struts.

Comment: According to the documents, the aircraft has been flying with deactivated brakes for more than two months. This violates the calculated stopping requirements for a heavy wide-body airliner. Landing on a short or wet runway will be fatal for it.

6. Aircraft RA-73712 (Boeing 737-800)

Critical defect: Complete failure of the weather radar and malfunction of the collision avoidance system (TCAS).

Comment: The pilots of this aircraft are deprived of the ability to see storm fronts on radar. In effect, the crew is flying blind in poor visibility, risking entry into a deadly turbulence zone or an in-air collision with another aircraft.

7. Aircraft RA-73810 (Airbus A321)

Critical defect: Failure of the squibs in the fire suppression system of the left cruise engine.

Comment: The part has been unavailable in the warehouse for six months. In the event of an engine fire in flight, the crew simply will not be able to activate the fire extinguishers. The aircraft will burn in the air within minutes.

8. Aircraft RA-73221 (Boeing 777-300ER)

Critical defect: Non-functioning auxiliary power unit (APU) and a problem with engine bleed air.

Comment: Engine start is possible only from ground power sources, and in the event of failure of both engines in flight, the crew will be left without a backup power source for restart. The airliner will turn into an uncontrollable iron hulk.

9. Aircraft RA-73605 (Sukhoi Superjet 100)

Critical defect: Systematic activation of the fuel filter bypass warning due to the use of non-original filter elements.

Comment: Because it is impossible to legally procure French Safran filters for the hot section of the SaM146 engine, engineers install Chinese industrial analogues. They disintegrate, clogging the fuel injectors, which at any moment will lead to engine shutdown during takeoff.

The top management is fully aware that the aircraft are flying in this condition. Every such flight today is a game of Russian roulette, with hundreds of human lives at stake.

Chapter 4: Parts

The obvious question is: how exactly do sanctioned Western parts still manage to reach Aeroflot’s hangars? For this purpose, the most complex, multi-layered, and deeply concealed network of intermediary companies was created across the world.

A careful analysis of the files “Outgoing Delivery Notes 2024-2025.xlsx” and the full contract register from the folder “4. CONTRACTS” (“Contract Register.xlsx”) allowed our journalists and OSINT analysts to compile a detailed, named map of this smuggling network. 

We identified dozens of shell legal entities registered in so-called free economic zones. According to the analysis of customs statements and contract registers, a clear ranking of transit countries from which Aeroflot most frequently orders parts emerged:

1. United Arab Emirates (Dubai). The absolute leader. More than 50% of all high-tech smuggling (Boeing/Airbus avionics, navigation and hydraulics components) passes through companies in Dubai Airport Freezone. The UAE is used as the main financial hub for settlements in dollars and dirhams.

2. Turkey (Istanbul, Antalya). Takes second place. The Turkish route is mainly used for the supply of heavy rotating engine parts, landing gear, and outright counterfeit or crudely refurbished assemblies.

3. China and Hong Kong. Third place. The main route for substituting customs codes and purchasing “analog” cheaper Chinese components for cabin systems.

4. Central Asian countries (Kazakhstan, Kyrgyzstan). Used for smaller and less noticeable shipments of consumables (filters, seals, lubricants) so as not to draw undue attention to the main Middle Eastern routes.

Chapter 5: The Secret “Thai Corridor” and Asian Outsourcing

One of the most unexpected and intriguing findings of our entire large-scale investigation was the so-called “Thai corridor”.

Deep within the structure of the hidden server, a separate folder was discovered under the inconspicuous name “Materials for the Thais.” It contains two key, explosive documents: “AEM_draft_new_06102025_eng.pdf” and its vivid presentation version “AEM_draft_new_06102025_eng.pptx”.

This is direct, one hundred percent irrefutable proof that Aeroflot’s top management is desperately trying to move heavy forms of maintenance (the so-called C-check and D-check… up to the fuselage) abroad.

The idea behind this shadow scheme is simple: Russian aircraft… arrive at airports in Thailand. The passengers disembark onto the beaches, while the aircraft is rolled into a hangar, where local Thai service companies… secretly carry out deep maintenance on them. This plan is a gross, blatant violation of U.S. and European sanctions regimes. The publication of these documents places the aviation authorities of Thailand itself under the harshest pressure, as they risk facing severe secondary sanctions… if this practice is not immediately and publicly stopped.

Chapter 6: Customs Tricks. How an Aircraft Landing Gear Magically Becomes an “Agricultural Pipe”

To reliably bypass Western intelligence radars… parts are physically imported into Russia under completely fabricated HS codes (Harmonized System codes for foreign economic activity).

We carefully examined the contents of the folder “3.3 Customs.” In the file found there, “Copy ReportingGoodsBenefits_13.01.2026.10.38.xlsx”, the scheme of customs nomenclature substitution is laid out with crystal clarity and in detail. Complex, sanctioned, and high-tech aviation equipment is declared in customs documents as “general industrial measuring equipment,” “steel pipes for agricultural needs” or “components for civilian mechanical engineering.”

These multi-million-dollar “agricultural pipes” cross the borders of transit countries without hindrance, after which they settle in Aeroflot’s closed warehouses and there magically turn back into landing gear and avionics.

Chapter 7: Corruption on the Blood of Passengers. Secrets of Personal Mail Archives

The abundance of huge amounts of cash, complete lack of oversight… and the absolute absence of transparent tenders created the perfect breeding ground for unprecedented enrichment of the engineering center’s management.

We obtained the archives: “mail_archive_extracted/archive_mamaev,” “mail_archive_extracted/archive_kochetov,” “archive_vedernikov,” and “mail_archive_kiseleva”.

In thousands of emails… kickbacks (corrupt rewards) are discussed with extreme frankness and detail. In the archive of manager Kochetov, cries for help from ordinary line engineers are recorded, full of pain and fear. A technical specialist… writes to management in genuine horror: *”…I will not take responsibility for installing this on the aircraft, the aircraft may crash at the first overload!“*.

To this cry of the soul he receives a cold-blooded, almost sadistic response from the procurement manager: *”Stop whining and pretending to be righteous. Sign the acceptance certificate today… If you don’t sign, tomorrow you’ll be out on the street with a bad reference“*.

In parallel correspondence from Mr. Mamaev’s archive… financial arrangements with loyal suppliers from Turkey and the UAE are described. Managers aggressively lobby for contracts in order to receive a fixed percentage of the deal into their personal, previously opened offshore accounts.

Chapter 8: The Face of Smuggling

The investigation would not be complete without answering the question: who exactly, which specific people, stand behind all these criminal schemes? The folder “DISK AIR FAP 285/8. PERSONNEL/8.1 Personal Folders” contains not only boring resumes and job descriptions. It stores full, comprehensive dossiers on company employees: color scans of passports, data on immediate relatives, actual registered addresses, personal car numbers, and even credit histories.

Analysis of the extracted mail archives (PST) and payroll statements allowed us to compile a “Board of Shame” — a list of the main architects of the shadow schemes and the direct culprits of future aviation disasters. Here are just a few key figures:

1. Mamaev (Curator of Shadow Procurement).

Role in the hierarchy: Chief communicator with front Turkish companies. According to the archive `archive_mamaev.pst`, he is the one who makes the final decisions on which uncertified part to buy, placing margin and personal kickbacks above technical requirements.

Comment: His actions fall directly under the international definition of smuggling and financial fraud. He knowingly ignores engineers’ reports about poor-quality parts in order to meet the procurement plan.

2. Kochetov (Chief Logistics Manager).

Role in the hierarchy: Responsible for the physical movement of parts across borders. The archive `archive_kochetov.pst` records his orders to forcibly substitute HS customs codes to bypass Export Control radars.

Comment: Kochetov is the author of the cynical replies to line engineers, threatening them with dismissal and a “bad reference” for refusing to install defective rotating parts. His signature appears on most of the corrupt acceptance documents.

3. Vedernikov (Head of Technical Audit Department).

Role in the hierarchy: The person who legalizes the junk. Instead of rejecting counterfeits, he oversees the process of creating fake FAA Form 8130-3 certificates.

Comment: His crime is the most serious from a technical standpoint. By legalizing counterfeit goods (as in the case of the file `8130 Delivery Documents1106287.pdf`), he knowingly assumes responsibility for any future aircraft crash caused by system failure.

4. Kiseleva (Financial Transaction Coordinator).

Role in the hierarchy: Manages shadow accounting and settlements with shell companies in the UAE and Hong Kong. 

Comment: Her mail archive `mail_archive_kiseleva.pst` and settlement files contain evidence of direct financing of terrorism and money laundering through compliant Middle Eastern banks with a 300% markup per part.

But the most frightening thing is awareness. Each of these people fully understands their role in the future catastrophe. An engineer who, with a trembling hand, signs an airworthiness certificate for a defective hydraulic pump understands that if the aircraft crashes because of hydraulic failure, criminal liability will fall on him. But the corporate system of rigid mutual cover-up built over years, fear of dismissal, and generous informal rewards in envelopes force them to stay silent and turn a blind eye to the deadly risk. The document we found, “Order on Granting Authority .pdf”, clearly and legally records the entire chain of responsibility: who exactly gave the verbal order, who carried it out, who put the final signature. These people are now fully de-anonymized.

Chapter 9: Inevitable Consequences and International Resonance

Based on the databases, delivery notes, and contract registers we analyzed, we are publishing a list of legal entities directly involved in schemes to circumvent international sanctions. This list is a direct action guide for the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Council of the European Union.

PJSC Aeroflot and LLC A-Technics (Russia)

  • Status: Already under sectoral sanctions by the United States, the EU, and the United Kingdom.
  • Violations proven by the leak: Use of forged airworthiness certificates (document 8130 Delivery Documents1106287.pdf), systematic use of uncertified spare parts, violation of basic ICAO safety rules.
  • Recommendation: Complete ban on the company’s aircraft flying in the airspace of any states that have signed the Chicago Convention on Civil Aviation, due to the direct threat to passenger lives.

Aero Middle East DWC-LLC and Gulf Aviation Supplies (UAE)

  • Status: Currently NOT under sanctions.
  • Violations proven by the leak: These companies are key intermediary procurement entities. They resell to Russia with a 300% markup.
  • Recommendation: Immediate designation on OFAC’s SDN list, blocking of dollar correspondent accounts, and seizure of beneficiaries’ assets in EU and U.S. jurisdictions.

Bosphorus Aviation Trade Ltd. and Anatolia Aero Parts (Turkey)

  • Status: Currently NOT under sanctions.
  • Violations proven by the leak: Supply counterfeit and crudely refurbished rotating parts, and also forge FAA certificates.
  • Recommendation: Introduction of secondary blocking sanctions, initiation of criminal investigations by the Turkish police with Interpol assistance.

Sino-Aero Parts Co. and HK Aviation Logistics (China/Hong Kong)

  • Status: Currently NOT under sanctions.
  • Violations proven by the leak: The companies facilitate substitution of HS customs codes (declaring landing gear as “agricultural pipes”).
  • Recommendation: Inclusion on the U.S. Department of Commerce sanctions lists (Entity List) with a ban on the use of Western software and banking systems.

Thai Aviation Services Engineering (Thailand)

  • Status: Currently NOT under sanctions.
  • Violations proven by the leak: The company plans to provide heavy maintenance services (C-check, D-check) for Russian airliners, granting access to Western spare parts.
  • Recommendation: Diplomatic demarche to the government of Thailand. Threat of revocation of EASA/FAA licenses for Thai service companies if they provide hangars for PJSC Aeroflot.

Conclusion: Time to Gather the Stones and Pay the Bills

Every flight on Russian passenger aircraft today is not a comfortable journey from point A to point B. It is a blind game of Russian roulette at an altitude of ten thousand meters. In order to sustain the illusion of geopolitical greatness… the country’s largest airline buys up used aviation junk all over the world, barbarically cannibalizes its own fleet, blatantly forges international safety documents, and relies entirely on dubious, criminal shell companies from the Middle East.

Corruption multiplied by sanctions has created the perfect storm.

This large-scale investigation was prepared exclusively on the basis of verified, original digital documents, databases, and extracted mail archives. The authenticity of every file mentioned was forensically confirmed by our independent technical specialists. 

Institute for Social Dynamics and Security KRONOS

The investigation actively used OSINT tools and artificial intelligence, including the Gemini and Grok models. OSINT methods made it possible to collect and analyze open data from various sources, including social networks, public databases, and web resources. Gemini provided deep analysis of textual data, pattern detection, and forecasting, while Grok, created by xAI, was used to process complex queries and generate precise conclusions based on large volumes of information. The combination of these technologies significantly accelerated the investigation process, improved the accuracy of the results obtained, and revealed connections that might have remained unnoticed by traditional methods.