In early November 2019, a video depicting several Russian-speaking men beating, decapitating, and burning a Syrian man in an unknown location began circulating widely on Russian social media platforms. Within days of the video being posted by open source investigators on Twitter, reporters with Novaya Gazeta, one of Russia’s only remaining independent daily news outlets, published a report that revealed that the victim’s name was Muhammad Taha al-Abdullah. It also revealed that at least one of the Russian-speaking men in the video had fought in the embattled region of Donbas in eastern Ukraine before traveling to Syria to work as a contract soldier for the Russian private military security company known as the Wagner Group.

Additional investigative reporting by a Paris-based Syrian investigative news outlet called al-Jessr Press, indicated that the video first surfaced on social media sites in 2017, but at that time little was publicly known about the identities of the men behind Abdullah’s killing or about the victim himself. Numerous reports have since linked Abdullah’s death to the Wagner Group’s operations at the al-Shaer gas facility in Syria’s Homs governorate, and to the private paramilitary group’s titular management company, EvroPolis, and paymaster Yevgeny Prigozhin, a Kremlin-linked Russian oligarch who has been the subject of a U.S. Department of Justice investigation into alleged interference in the 2016 U.S. presidential elections.

Data acquired from open sources as part of this preliminary case evaluation appears to corroborate Russian and Syrian media reports identifying perpetrators depicted in the film as members of a Wagner Group contingent. Preliminary findings from the investigation confirmed that Abdullah (محمد طه إسماعيل العبدالله), who is also known to family and friends as Hamdi Bouta, was most likely killed not far from a Wagner Group encampment near the al-Shaer gas plant northwest of the city of Palmyra, Syria in the early summer of 2017. Additional data culled from EvroPolis company records corroborates connections between Wagner Group operators and the involvement of EvroPolis, and other Prigozhin-linked firms, as well as Russian state-backed enterprises involved hydrocarbon exploitation in the al-Shaer fields. EvroPolis accounting records indicate that the al-Shaer gas plant and three other energy production sites generated roughly $162 million in revenues for Prigozhin’s firm in 2017 alone.

Analysis of digital evidence and data mined as part of this case evaluation revealed that the perpetrators of Abdullah’s gruesome killing at al-Shaer likely belonged to one of four of the reconnaissance units deployed by EvroPolis across the Homs area to retake and protect strategically important energy production sites in the region. Facebook pages for EvroPolis employees who traveled regularly in the Middle East and local Syrian state energy firm employees appear to corroborate a high degree of capacity for close coordination on issues such as security for the site where the killing occurred. While further investigation is needed to verify the perpetrators’ identities and the circumstances surrounding Abdullah’s death, the trail of digital clues points strongly to the Wagner Group’s involvement in the incident and indicates financial and logistical support from EvroPolis as well as financial and logistical support from Syrian and Russian state-backed firms active in the area at the time, including state owned Gazprom and Stroytransgaz, a Russian state-backed firm sanctioned by the United States for its alleged involvement in supporting Russia’s annexation of Crimea in 2014.¹

Social network analysis of online data also indicates that at least four Wagner Group operators on the scene at the time during the battle to retake al-Shaer in the spring and summer of 2017 at one point had links to Rusich, a Russian fighting contingent implicated in war crimes in the contested region of Donbas in eastern Ukraine. Exploration of social media data collected from Vkontakte, YouTube, and other sources also turned up potential evidence of a link between the men behind Hamdi Bouta’s killing and Wagner Group fighters who were killed in a U.S. strike on a column of forces loyal to the Syrian regime in Deir Ezzor on February 7, 2018. A considerable amount of work remains to fill in narrative gaps and verify the specific facts of the case, but analysis of available open source data strongly points to the potential culpability of individuals and entities that receive substantial backing from the Russian Federation in war crimes and mercenary activity. All these insights suggest that a combination of social network and supply chain analysis will be critical to understanding the trajectory of Russia’s private military security industry for the foreseeable future.

In June 2017, the world got a fresh glimpse into the heart of Russia’s burgeoning private military security industry from a social media post on a Reddit subchannel popular with military geeks. The anonymous post didn’t provide much commentary, only a link to a nearly two-minute long video clip shot with a shaky hand on a mobile phone camera.² The graphically violent video showed several men dressed in desert military uniforms taking turns beating a man with a sledgehammer. Within hours of the video’s appearance on the Reddit channel, a military affairs blogger reposted it and not long after that, Russian and Ukrainian open source investigators who track the activities of Russian mercenary fighters affiliated with the Wagner Group busily began dissecting clues to the assailants’ identities in the videos.³

Video footage subsequently circulated online in the summer of 2017 and late fall of 2019 and reporting in Russian, Arabic, and English media outlets indicates that at least five to seven Russian-speaking men beat, tortured, and beheaded a Syrian national named Muhammad Taha al-Abdullah⁴ (محمد طه إسماعيل العبدالله). The videos show the men who killed Abdullah, who is also known by his nickname Hamdi Bouta (حمادي طه البوطه), subsequently dismembered his body and then set it on fire amid the battle-torn remains of the al-Shaer gas plant.⁵ In early November 2019, the video of Bouta’s killing again went viral on Twitter and circulated widely on social media sites popular with Russian speakers, including Vkontakte, popular social media platform similar to Facebook that has hundreds of millions of users. This report is a summary of research efforts to date by Frontline Forensics, a joint initiative of New America and Arizona State University, to discover the circumstances surrounding the death of Hamdi Bouta.⁶

Bouta’s grizzly public execution at a site controlled by Wagner Group operatives illustrates how Russia’s new business model for expeditionary warfare poses serious challenges for the international security. The findings in this report show that the Russian state through its majority owned-stake in the companies that pay for Russian private military security contractors’ (PMSC) operations exercise effective control over a well-organized group of special operators for hire. Absent greater transparency and accountability for Russian PMSC operations and the Russian state enterprises who hire them to train and equip local fighters and to secure oil, gas, and mineral production sites are able to continue doing business as usual with impunity.

The purpose of this initial assessment of data discovered as part of our inquiry is to aid the general public, relevant international fact-finding bodies and project collaborators in developing a more complete account of this incident, and as well as a more comprehensive understanding of how overlapping social networks between Russian-backed foreign fighters in Ukraine and Syria have fused to form a sprawling, global social movement of mercenary fighters seeking to advance Russian ultranationalist causes. To the extent possible, investigators tasked with evaluating available digital evidence and open source data linked to the case endeavored to trace the identities of those directly involved in Hamdi Bouta’s death and to discover any links they may have had to other entities or individuals, who may have had a supervisory or contractual arrangement with those present at the time of Bouta’s killing. The research for this report was undertaken in collaboration with journalists, think tank analysts, and human rights investigators as part of a wider effort to analyze the role of Russian PMSC in contemporary armed conflict.

The analysis that follows below provides a detailed look at how a subunit of Wagner Group operators came to seize control of the Syrian gas plant where the gruesome video of Hamdi Bouta’s killing was recorded. It also explains how Yevgeny Prigozhin, a wealthy Russian oligarch who has been sanctioned for his role in interfering in the 2016 U.S. presidential elections, profited from the site where Bouta was executed and helped Russian state enterprises rake in billions from Syria’s energy sector. The analysis is divided into six sections, including this one, which briefly explains the methods we employed to exploit publicly available open source information and leaked data shared with Frontline Forensics about EvroPolis to trace the web of individuals and entities linked to the so-called Wagner Group’s operations in Syria. The second section describes the fact pattern surrounding the video of Hamdi Bouta’s killing in 2017. The third section provides contextual background on how EvroPolis and its PMSC operators came to be so central to Russia’s quest to bolster its export of military-technical and energy sector expertise to Syria, and hints at how the Kremlin has evolved its model for conducting the business of war since the start of the Arab Spring. The fourth section explains how new facts about Bouta’s killing emerged in late 2019 and shed more light on the connections between dozens of Russian special operators who fought in eastern Ukraine in 2014 and later in Syria. The fifth section dissects the videos of Bouta’s killing and related digital data that unearthed connections with a Russian PMSC contingent linked to war crimes in Ukraine and provides an overview of our early findings about links between the same PMSC contingent and Russian ultranationlist white supremacist group sanctioned by the United States in April 2020. The sixth section presents broader conclusions on the case and its meaning.

The Syrian civil war has often been referred to as the first “YouTube war.”⁷ Since the start of the conflict in Syria in 2011, countless videos, photos, and text-based commentary posted on social media platforms have traced the arc of the war’s rapid transformation from a popular peaceful uprising to a civil war and internationalized proxy war. The start of the conflict coincided with the peak proliferation of camera-enabled mobile phones and other sensing devices, expanded access to commercially available satellite imagery, and increased public access to data via the internet.⁸ Technological proliferation and the wider availability of tools for the collection, analysis, and archiving of large amounts of data subsequently has fueled the rise of a global movement of citizen journalists and investigators.

At the same time, the intractable stalemate between the five permanent members of the UN Security Council has led to the establishment of independent fact-finding bodies with a vested interest in documenting war crimes in Syria, including, most notably, the UN General Assembly mandated International Independent and Impartial Mechanism (IIIM) for inquiry into violations of international humanitarian law (IHL) since the start of the Syrian war in 2011.⁹ These developments underscore how the growing prevalence toward remote warfare and increasing shift to war by proxy¹⁰ is transforming the politics of evidence in the realm of international security and international law.

The tools, methods, and sources used by our team to discover the circumstances surrounding Hamdi Bouta’s killing at the al-Shaer gas plant are reflective of these massive shifts in the way war crimes and reported abuses of power can now be documented. In researching this case, we have collected and analyzed information that is publicly available either through open observation of publicly accessible websites and social media platforms or data that is obtainable by request or purchase. Our team also leveraged data shared by the Dossier Center, a Russian-language investigative research center, about the business dealings of the Wagner Group’s reputed management company, EvroPolis, and related Russian companies linked to Yevgeny Prigozhin and his firm Concord Management and Consulting LLC.¹¹ We additionally conducted independent analysis of publicly available data about EvroPolis’s key clients in Syria, the Hayan Petroleum Company and Syrian Petroleum Company, to triangulate and verify data shared with our team by the Dossier Center.

A substantial portion of the data collected as part of the research for this case study consists of information and insights gleaned from traditional media outlets and compared with openly available social media accounts and user groups on Vkontakte and Odnoklassniki, social media platforms popular with Russian language speakers. Social media data analyzed for this report in many cases contained basic demographic information about the gender, educational background, reported residential location, military affiliation of users with express links to user groups focused on Russian military affairs culture.¹² Our team has built and applied a number of different computational social science tools and techniques to gain insights into Russian language social media users. Data collected for this and other reports draws largely on the social media user profiles of those who either openly profess that they have worked at one time for a Russian PMSC or whose demographic profile and posts indicate that they have served in areas of Syria and Ukraine where Russian PMSC contingents have reportedly operated.¹³

It should be noted that some of the images and videos reviewed for our research contain highly graphic content depicting extreme violence. Some sources and content also included information that might be considered sensitive. In several cases, as a result, we have been selective about the content and data referenced in the main body of this report, but where warranted we have collected that material for separate, independent review in the appendices to this report.

Hamdi Bouta was born in August 1986 and grew up in a small village called Al-Khoraita, west of the Euphrates River in Deir Ezzor governorate, Syria.¹⁴ He attended high school in Deir Ezzor and completed two years of compulsory military service. After his brief stint in the Syrian Arab Army, Bouta went to work in the construction industry, working primarily as a bricklayer. He married and started a family before the civil war began while living in Deir Ezzor, and his wife and four children were believed to still be living in Syria as of February 2020.

In 2016, Bouta traveled to Lebanon in hopes of construction work after the situation in Syria deteriorated and large parts of Deir Ezzor came under the control of the Islamic State of Iraq and Syria (ISIS).¹⁵ Bouta traveled with several other young men from his area through portions of Deir Ezzor that were primarily under control of the Syrian Arab Army at the time, and so, reportedly, had no trouble reaching Lebanon. He crossed the border in the Damascus-Beirut corridor and arrived safely in September 16, 2016, according to Bouta’s relatives.

After working for a time in Lebanon, Bouta decided to return to his family in Deir Ezzor. On March 27, 2017, Bouta traveled across the border from Lebanon into Syria at the Beirut-Damascus crossing with a group of young men from his village. Syrian authorities arrested Bouta as he crossed the border and turned him over to members of the Syrian military. At this point, members of the group Bouta was traveling with notified Bouta’s brother-in-law, who was in Lebanon at the time, that the Syrian military had taken Bouta into custody.¹⁶ Bouta later got in touch with his brother-in-law directly and told him that members of the Syrian Arab Army had taken him to the al-Draij military camp in the northern suburban outskirts of the Syrian capital of Damascus.¹⁷

Almost from the outset of the war, the al-Draij camp served as a cantonment for Iranian, Russian, and Lebanese-Hezbollah military advisers to the Assad regime and a training base for the 4th and 5th Assault Corps, two of the main divisions established at the urging of Russian and Iranian military leaders after the Syrian Arab Army suffered a string of devastating losses in 2015 and 2016.¹⁸ The Syrian special forces and Republican Presidential Guard also reportedly camped at the base. Russian PMSCs tasked with training, equipping, and deploying with 4th and 5th Assault Corps contingents have also reportedly been housed at the base in al-Draij.¹⁹

After about a month of training with a reserve unit at al-Draij, Bouta was apparently deployed with a conscript unit to the Tiyas Airbase in Homs governorate.²⁰ Situated west of Palmyra and also known as the T-4 Military Airbase, the base is home to the Syrian Arab Army Airforce (SyAAF) and it is the largest airbase in Syria.²¹ As noted by Bellingcat researchers, control of the route from T-4 east to Palmyra has been hotly contested since at least 2013,²² and in October 2013 Russian contractors affiliated with a contingent of the Moran Security Group famously suffered a number of casualties during a battle with rebel forces along the route near the city of Tadmur.²³

It is unclear when exactly Bouta arrived at the T-4 airbase, but according to accounts given by relatives and journalists familiar with his case, Bouta may have arrived there sometime in the mid-March to early April 2017 timeframe. According to accounts relayed to the press by Bouta’s brother-in-law, Bouta escaped the T-4 base on foot soon after arriving there. “He got lost in the big desert, so he sent a voice note message via WhatsApp to his brother-in-law in Lebanon—with difficulty because of the lack of network coverage in the desert,” a journalist from al-Jessr Press who is familiar with the case recalled in an interview. ²⁴ “[Bouta] told him about his situation and told him he was lost. That was the last communication. It seems that when he got lost, the only place he could find refuge in was the Sha’er gas field. It was in ruins and it had just been liberated from ISIS and the guard present was a contingent of Russian soldiers who arrested him. He was tortured and killed during this period.”²⁵ The voice message from Bouta in late March 2017 was reportedly the last communication he had with his family. According to local news reports, fighting contingents affiliated with ISIS hunters, a 5th Assault Corps militia trained and equipped by the Russian PMSC known as the Wagner Group, began closing in on al-Shaer in late April 2017.²⁶

On June 30, 2017, a blogger named “Josh” posted commentary along with a 1:44 minute video for the combat veteran military specialist site Funker530.com with the headline, “Breaking: Terrifying Footage Of Russians Torturing Prisoner With Sledge Hammer.”²⁷ The video (Video A) opens with a warning in English about graphic content and depicts several men in tan military uniforms beating an unidentified man with a sledgehammer and kicking him. At least two of the men have what appear to be AK-74 rifles slung over their shoulders. The man is lying on the ground amid what looks like debris from an industrial site. The man lying on the ground is curled up in a semi-fetal position and the blue and white shirt and dark blue jogging pants he is wearing are stained with blood.²⁸ Not far from the man’s feet, there appears to be the severed head of the man. There is loud Russian rock music in the background and the men in military uniform laugh and joke with each other in a mix of Russian and Arabic.

There are no other obvious identifying labels on the video, and it is unclear when and where the video was shot or how the Funker530.com obtained it. But, the posting notes that one of the men is wearing a patch on his uniform with Cyrillic writing. The patch says “я просто отделаю тебе очень очень больно” (“I’m just going to hurt you very very badly”). The video went viral within hours of the video posting on Funker530.com.

An open source investigator who uses the Twitter handle “Necro Mancer” (@666_mancer) was among the first to post a link to the site with commentary on Twitter. ²⁹ Around the same time, Conflict Intelligence Team (CIT), an online investigative news outlet that tracks Russian military affairs,³⁰ published a Facebook blog about the video on June 30, 2017.³¹ In that post, CIT indicated that the lyrics of the song playing in the background referenced Russia’s wars in Chechnya and Russian special forces or spetsnaz. Although CIT made a strong case for a link with the Wagner Group, no definitive proof of the identities of those depicted in the video emerged at the time. The location of the incident was unclear and the victim’s identity remained unknown. Although YouTube ultimately removed this first video, others were quick to preserve it in formats that are still accessible on Russian-language chat channels as recently as April 2020.³²

Many facts remain unknown about what precisely occurred between the time Bouta arrived at al-Shaer and his death, but based on the timeline of events surrounding Bouta’s escape from the T-4 airbase as recalled by Syrian journalists who tracked down the victim’s family and the timeline of events surrounding the posting of the video, a crude assessment of the facts would suggest that Bouta was tortured and killed sometime in the late April to late June 2017 time frame. As will be seen below, this chain of events corroborates descriptions of the incident posted anonymously on Vkontakte by Russian-speaking Vkontakte users linked to subscriber groups on the platform that focus on news about Russian mercenaries and the military culture.

A little less than a year after Bouta’s death, in May 2018, members of Bouta’s family received a copy of a video depicting the same incident via WhatsApp.³³ Unsure of the veracity of the video, Bouta’s family sent the video to a relative with close ties to Assad’s regime. “So, he inquired, and came back saying he [Bouta] was dead,” recalled a Syrian journalist familiar with the case. “They organized a funeral for him then, in 2018, and kept quiet. To this day they won’t file a lawsuit because they are in fear of the regime. It is already quite difficult for them to even transmit information to [us].”³⁴ Another 18 months would pass after Bouta’s family held a secret funeral for him before new details about the incident would emerge that made clear a definitive link between the Russian men in the video, the Wagner Group, EvroPolis, and the Russian and Syrian energy companies charged with managing the al-Shaer site.

Contextual analysis of the circumstances surrounding the events that led to ISIL’s takeover of the gas plant, and the Syrian government’s long-battle to retake control of the site reveals that Hamdi Bouta’s death is likely part of a much larger pattern of potential war crimes perpetrated by Russian PMSC operators affiliated with specific contingents of the Wagner Group that also fought in the Donbas region of eastern Ukraine at the height of the Euromaidan crisis in the summer of 2014.

But, to understand how those pieces of the puzzle fit together it is important to first explore in some detail the history of the al-Shaer gas facility before the start of Syria’s civil war in 2011 and how EvroPolis played a critical role in the Assad regime’s decades-long struggle to exploit the gas basin surrounding the site known as the Hayan Gas Block.

At the start of the twenty-first century, Syria ranked as one of the leading oil and gas producers in the Mediterranean littoral region, and oil and gas revenues then, as now, represented a substantial portion of Syria’s overall GDP.³⁵ It would be hard to overstate the strategic importance of the country’s energy sector for the country’s stability. Although comparatively speaking, in the wider context of Middle Eastern producers, Syria is one of the smaller oil and gas exporters, revenues generated by sites managed by the Syrian Petroleum Company represented an estimated 25 percent of the Syrian government’s overall revenue stream prior to 2011.³⁶

Syria’s government controls oil, gas, and mineral production and export, and Syria’s General Petroleum Company sets strategy for exploration and development and supervises national subsidiaries, including the Syrian Petroleum Company (SPC) and Syrian Gas Company (SGC).³⁷ But, as in many other developing countries, Syria’s nationalized energy sector is highly reliant on external backing from foreign firms for capital-intensive upstream investment in exploration and development. SPC, as a result, operates through production-sharing agreements managed through several subsidiaries, including the Hayan Petroleum Company, the Al-Furat Petroleum Company, and the Deir Ezzor Petroleum Company.³⁸

During the decade leading up to the start of the Arab Spring uprisings in Syria in 2011, the Assad regime worked assiduously to attract foreign investment in its energy production industry, and over time Russian state-backed firms came to dominate in Syria’s energy sector. Despite the death of the country’s long-time ruler Hafez Assad in 2000 and uncertainty about the political strength of his son and successor Bashar, Syria was able to maintain relatively stable levels of foreign investment.

Syria’s energy production prospects looked especially promising at that time because of the reopening of the Iraq-Syria pipeline through the terminal port at Baniyas. In 2000, Syrian oil production during the early post-Soviet phase of heavy Russian investment in Syria’s energy sector, Syrian companies affiliated with SPC exported about 581,000 barrels per day (bpd) in heavy sour crude oil.³⁹ The bulk of exports from these facilities were to European markets.⁴⁰ At the time the Baniyas pipeline carried an estimated 150,000 to 250,000 bpd, much of which reportedly came from oil fields in Kirkuk that were then still managed under the UN oil for food program.⁴¹ While U.S. and European oil majors such as ConocoPhillips, Shell, and Total sold oil pumped from the pipeline on the open market likely in violation of sanctions, Russian state-backed firms created an alternate gray market and also benefited considerably from sales of oils from the Baniyas pipeline.⁴²

Yet, years of government mismanagement and political isolation stemming in large part from its enmity with Israel, backing of Hamas and Hezbollah, and development of chemical weapons, complicated long-term foreign investment prospects for Syria’s energy sector. The situation only grew worse, after the United States imposed sanctions on the Assad regime for its role in the assassination of Lebanon’s Prime Minister Rafik Hariri in 2005. Syria’s increasing economic isolation coincided with the start of a major global oil boom that lifted Russia’s highly leveraged economy out of its long post-Soviet recession that in turn transformed Moscow’s relationships with a number of Arab regimes.

After a prolonged period of fits and starts in the early 2000s, foreign investment in Syria’s energy sector began to pick up with a noticeable uptick in Russian investment in the gas sector that coincided with the maturation of earlier upstream investments in Syria’s oil and gas sector. Majority-owned Russian-state energy enterprises such as Gazprom, Soyuzneftgaz, and Stroytransgaz were among the leading foreign firms to benefit from this shift and each gained a greater market share as the Assad regime became more isolated.⁴³ The Russian state is a majority stakeholder in all three energy conglomerates, which were headed by close associates of Vladimir Putin and had at various points served alongside him either during his stint in the KGB, the government of St. Petersburg, or later, as part of his presidential retinue.⁴⁴

Syria’s growing dependency on foreign investment in the energy sector during these years entrenched structural flaws common to many petro-states. The country’s nationalized industry and dependency on foreign firms ultimately resulted in anemic earnings as net income from oil exports was offset by royalties paid to international producing companies.⁴⁵ As noted by scholar David Butter, petroleum product subsidies for the Syrian domestic market damped earnings potential even further and fed the growth of gray market export sales of subsidized fuel at much higher prices in neighboring Lebanon, Turkey, and Jordan.⁴⁶ Since security agencies, and the army and air force in particular, were among the largest bulk buyers of subsidized fuel, high-ranking officials in the security sector naturally emerged as key brokers in the country’s energy export sector. This also meant that Syrian officials with strong connections to the country’s security agencies would emerge as key nodes in brokering energy sector deals with Russian state-backed firms.

In the two decades leading up to the Arab spring, family members of the Assad regime and close allies of the government’s predominantly Allawite elites ran the government’s crude oil exports to Europe, which historically has been a primary market for Syria’s particular grade of heavy sour crude oil.⁴⁷ During that same time, Russian state energy firms came to dominate a hefty portion of Europe’s energy sector. By far, Stroytransgaz, a one-time subsidiary of Russia’s Gazprom now owned by Volga Group,⁴⁸ was among the most active in the development of Syria’s gas and oil production capacity during this period.

Much of the oil and gas production and development in that area falls within the range of the so-called Hayan block of hydrocarbon fields. According to energy industry journals, company records, and media reports, Hayan Petroleum Company and its operating partner, Croatia-based INA Naftpalin, have managed the Hayan Block’s Jazal, Jihar, and Mahr oil and gas fields under an arrangement for exploration that dates back to the late 1990s.⁴⁹ An oil and gas industry survey and study led by Croatian geologists indicates INA first discovered hydrocarbon reserves in April 2002 in the Jihar field area and the Palmyra and al Mahr reserves later that same year.⁵⁰ Three years after those discoveries, INA and Hayan Petroleum Company first began production at the Jihar site in late August 2005. Other fields in the same block, including Jazal, began production starting from 2007 forward.⁵¹

Linked to the Ebla gas refinery plant between the city of Homs and Palmyra, the al-Shaer gas field is also a prime source of liquefied natural gas in the Hayan Block. With reserves capable of producing an estimated 3 million cubic meters per day the al-Shaer field is also a critical node in regional energy supply and export chains, and along with the Ebla site is a key supply link in the long stalled Iran-Iraq-Syria gas pipeline project.⁵² Al-Shaer production first came on line with the launch of a joint venture in 2010 between Canada’s Suncor and Syria’s Ebla Gas Company in developing the Ebla gas field and then in 2011 with the joint development scheme for Jihar gas field between Croatia’s INA and Hayan Petroleum Company.⁵³ Combined the two ventures increased by more than half Syria’s gas production capacity. But, the onset of the civil war saw a sharp downturn in energy sector output.

In January 2012, INA reportedly invoked force majeure clauses in its arrangement for exploitation of the Hayan Block indicating that an unforeseen “act of God” prohibited further work at the site and reportedly ceased operations at al-Shaer after the outbreak of war and imposition of EU sanctions on the Assad regime.⁵⁴ INA and Suncor ultimately pulled their expatriate staff from the company and from that point production at the site dropped precipitously.⁵⁵ Interestingly, around the same time as INA found itself struggling to make up for lost revenue from the war in Syria, Russian-state energy giant Gazprom began pressing aggressively to buy out one of INA’s major shareholders, Hungary-based Magyar OLaj- és Gázipari Részvénytársaság (MOL).⁵⁶ As of late 2019, the deal had yet to go through in part because of concerted efforts by the Croatian government to create more viable alternatives to Russia’s dominance of the gas production and transfer market in southeastern Europe.⁵⁷

Nonetheless, Gazprom through the minority shares it held in MOL at the start of the Syrian war had at least an indirect stake in the successful recovery of infrastructure operated by Hayan Petroleum and Ebla Petroleum. Presumably, Gazprom’s stake in MOL—whether a minority or majority—would ultimately help Russia’s largest state owned energy company gain leverage in INA’s affairs, providing Gazprom a strong incentive to invest in the restoration and protection of INA’s holdings in Syria, including the Hayan Block field. Likewise, Stroytransgaz—as one of the major Russian state-backed firms invested in construction, development, and maintenance of infrastructure of Syria’s hydrocarbon processing, treatment, and transportation—would benefit both from Hayan Block exploitation and more specifically from the al-Shaer site as one of the principal investors in one of the most key nodes in the processing of Hayan Block reserves.

Not surprisingly, as a result, an intricate web of social and business ties has sprung up between Stroytransgaz and the three state-run Syrian energy companies responsible for oversight and management of the lucrative Hayan Block gas fields, which encompass the gas processing plant at al-Shaer—the Syrian Petroleum Company, Ebla Oil Company, and Hayan Petroleum Company. As shown below, the intersection of interests between Stroytransgaz and Syria’s state-run oil and gas firms has also sprouted new networks between individuals and entities that service Stroytransgaz contracts for the Hayan Block, including EvroPolis, Velada and Merkury, three Russian firms linked to Yevgeny Prigozhin that facilitate financing and logistics for Wagner Group PMSC operators.

At the start of Syria’s civil war, just before the imposition of major U.S. and EU sanctions against the regime in 2012, the vast majority of Syrian oil exports were sold on the European market.⁵⁸ As a result, Russian investment in Syria’s energy sector, and its trade in Syrian oil and gas to Europe in particular, came to represent a vital lifeline for the Assad regime. Syria’s oil- and gas-rich Hayan Block, where the al-Shaer gas plant is located, sits at the center of this intricate web of Russian-Syrian trade relationships that for almost a decade now have constituted the crown jewels of the Assad regime’s survival strategy.

Located about 90 miles northwest of the ancient city of Palmyra, the al-Shaer gas plant and storage facilities sit astride part of the Jabal Shaer field in the Hayan Block. With the capacity to produce an estimated 106 million cubic feet a day, the al-Shaer facility is one of the most significant energy production sites in Syria.⁵⁹ The oil and gas fields in eastern Homs that constitute the Hayan Block on which the al-Shaer facility is located have, however, changed hands a number of times over the years.

U.S.-based energy company Marathon initially discovered the site and signed a deal with the Syrian government to exploit the site in the 1980s,⁶⁰ and in 2006, Marathon signed a production sharing agreement with Petro-Canada as relations between the United States and Syria soured.⁶¹ Two years later, in 2008, Petro-Canada awarded the multinational conglomerate Petrofac a contract valued at $477 million to develop the al-Shaer and Cherrife gas fields.⁶² Up until the start of the civil war in 2011, Canadian based Suncor operated the al-Shaer facilities in cooperation with the Syrian state owned Ebla Oil Company, but U.S. and EU sanctions forced Suncor to abandon the $1.2 billion project.⁶³ Although the abandoned al-Shaer facility would soon emerge as a center of numerous skirmishes between the Syrian government, rebel groups, and ISIS, ultimately Suncor’s exit from the scene would prove a boon for Russian firms that swooped in as the fighting intensified.

Reporting by Russian news outlets such as Fontanka and Novaya Gazeta following Bouta’s killing as well as a review of Hayan Petroleum Company’s Facebook pages indicates that Russian PMSC contractors with links to Wagner operatives provided security for the al-Shaer and other Hayan Block sites going as far back as 2014.⁶⁴ A publicly available copy of the SPC contract with EvroPolis indicates that the Prigozhin-linked firm has provided oversight and security at the al-Shaer Gas Plant facility in Homs where Bouta was killed since at least 2016.⁶⁵

Contract and accounting records of EvroPolis’s revenues and expenditures in the 2017-2018 timeframe for operations in Syria that were reviewed by our team indicate that natural gas extraction from the Hayan block fields alone generated about 12,230,627,900 Russian roubles (RUB), or the equivalent of about $162 million in 2017.⁶⁶ A substantial portion of those earnings appears to have come from natural gas extracted from sub-block well sites at al-Shaer. Total revenues indicated on that same spreadsheet for 2017 for other goods and services provided by EvroPolis as part of its contract for the Hayan block, such as oil and gas storage and gas condensates, added up to 19,219,411,196 RUB or roughly the equivalent of about $301 million.

While there are no direct ties indicated between EvroPolis LLC and the Ebla Petroleum Company, public records and social media accounts demonstrate existing ties between Ebla Petroleum and other Prigozhin-linked companies. In December 2019, Syria’s oil minister Ali Ghanem announced that the Syrian parliament had approved two contracts for oil exploration to two Russian firms with ties to Prigozhin—Merkury LLC and Velada LLC.⁶⁷

Cross-posts on Facebook pages for Hayan Petroleum Company and EvroPolis employees who traveled regularly in the Middle East such as Ildar Zaripov, who lists Hayan Petroleum Company and Elba Petroleum Company employees among his Facebook friends, appear to corroborate a high degree of capacity for close coordination between management at EvroPolis and Hayan Petroleum facility operations on issues such as security.⁶⁸ Zaripov is one of several Russian citizens whose names appeared in email exchanges between EvroPolis employees shared with our team by the Dossier Center.⁶⁹ As recently as May 2020, Zaripov’s Syria-based Facebook friend Adel Ahmad indicated, for instance, that he works for the Hayan Petroleum Company and at one time also worked for other Syrian state enterprises, such as the SPC. Another Facebook friend of Zaripov’s, Bassem Saad, listed the Syrian state-owned Ebla Petroleum Company as an employer, and posted updates on repairs to the al-Shaer facility as recently as April 2020.⁷⁰ Zaripov has also posted a number of photos on Facebook from his recent travels in the Middle East, and a review EvroPolis travel booking records and flight data analysis shared with our team indicate Zaripov took more than two dozen flights to and from key Middle East hubs including Beirut, Lebanon in 2018 and Istanbul, Turkey in 2019, all paid for by EvroPolis.⁷¹

The fact that one of the Wagner Group’s most well-known operators, Dmitry Utkin, a veteran Vozdushno-desantnye voyska (VDV) airborne forces spetsnaz operator, was also known to have operated a PMSC detachment in the Palmyra area would appear to further suggest a central role for EvroPolis as a middle manager for Russian state firms such as Stroygtransgaz, and likely Gazprom or one of its many lesser known affiliates. Utkin, at one point after fighting in Donbas under the call sign “Wagner,” was one of the first to be exposed in press reports for a security detail in Syria for a subunit of the Moran Security Group known as Slavonic Corps.⁷² The Moran Security Group was known to operate in the Palmyra area dating as far back as 2013, and it is well known that another former spetsnaz veteran business partner of Utkin’s, Andrey Troshev, fought there in the spring of 2016,⁷³

The Moran Security Group is a long-time service provider for Russian energy industry majors and energy insurers, such as the SOGAZ Insurance Group, and its operations in Syria would additionally seem to point to overlapping ties between both individuals and entities affiliated with Wagner, Hayan, and EvroPolis operators in Syria.⁷⁴ Indeed, if media reports documenting the treatment of combat wounded Russian private military contractors at St. Petersburg clinics owned by SOGAZ are to be believed, Wagner Group operators have received a significant amount of support from majority Russian state-owned enterprises.⁷⁵

While tracing the intricacies of all of the overlapping interests between Russian and Syrian entities and the tightly latticed networks of individuals that support Syria’s energy sector is a daunting task, doing so is the key to understanding Prigozhin’s business model. Although Prigozhin’s connections to the Kremlin are clearly key to the success of EvroPolis and its ostensible parent company Concord, it is equally obvious on closer inspection that in many respects, Prigozhin is little more than a middleman for bigger players in Russia’s managed economy. According to investigative news reports, Prigozhin’s firm Concord has secured more than 5,300 contracts since 2011 valued at about 209 billion Russian rubles or roughly $2.76 billion from Russia’s military supply agency, Voentorg.⁷⁶ Most of those contracts are held by shell company subsidiaries, such as Merkury and Velada, which curiously, according to our review of account documents shared by the Dossier Center, appear to have received payments from revenues generated by oil and gas field contracts held by EvroPolis in Syria.⁷⁷

Network analysis of these relationships is also critical for dissecting the organizational structures that constitute the principal elements of the so-called Wagner Group, which exists more in the realm of the virtual and the imaginations of the contract recruits who work for hire under arrangements with Prigozhin-linked firms than it does on paper. The Wagner Group is neither a legally constituted entity under Russian or international law nor is it a shadow army; it is a conveniently deceptive short-hand for the contingents of contract Russian warfighters who are paid through Voentorg procurement deals to execute on security risk management plans in conflict zones where Russian state enterprises have an abiding interest in the energy and arms sector.

In fact, close examination of the social ties that bind these contingents reveal much more about the distinctive recruitment patterns and organizational structures of EvroPolis-linked contingents that form the basis of effective Russian state control over the paramilitary group’s operations. Deeper analysis of the social media accounts of those who purport to have fought with these contracted Russian contingents also shows how organized armed violence creates its own distinct forms of social cohesion, and a fusion of interests between Russian ultranationalists and those interested in the mercenary lifestyle. In this regard, the battle for al-Shaer and the case of Hamdi Bouta’s brutal execution at the al-Shaer gas fields is quite instructive.

Almost from the outset of the civil war in Syria, control over the country’s major oil and gas facilities emerged as one of the most critical strategic objectives for forces on all sides. While Syria is not a major exporter of energy resources the oil, gas, and mineral reserves near the ancient city of Palmyra are an important source of revenue for Assad’s regime and a crucial source of energy for the military and electricity for the country writ large.⁷⁸ According to at least one report, about 80 percent of Syria’s gas production capacity is located in the Homs-Palmyra region.⁷⁹

Part of a larger energy production project area known as the South Middle Area Exploitation project, the al-Shaer facility is not only an important source of revenue for the regime in terms of attracting foreign investment but a crucial source of electricity and refined oil and gas for the military.⁸⁰ For these and other reasons, capture and control of al-Shaer has been a primary military objective of ISIL, rebel forces, and the Assad regime and its backers, including Russia.

The site has been a major point of contestation since at least 2013 when fighters affiliated with the aforementiond Wagner Group progenitor known as the Slavonic Corps were captured and forced to retreat from the area.⁸¹ Staffed by armed operators who for a time held management positions in the Moran Security Group, a Russian PMSC, Slavonic Corps is one of several Moran related contingents whose employees have a long history of providing security for Russian energy projects in the Middle East.⁸²

For Russian state-backed firms with a vested interest in the production, refinement, and export of Syrian gas, such as Stroytransgaz, Sovfracht, a Crimea-based shipping conglomerate, and SOGAZ, one of Russia’s leading reinsurance providers, the strategic logic of deploying a dedicated contingent of military professionals is fairly straightforward. Seizing control of the Hayan Block and its critical infrastructure from ISIL had multiple benefits. Firstly, it ensured critical revenues for the Syrian state as well as stability for a cooperative regime. Secondly, control of the block insured the profitability of the investment for upstream investors looking to bring Syrian gas to market, such as Stroytransgaz.

Thirdly, flows of energy exports from Syria to world markets by ship through ports secured with the help of Russian military advisers would presumably boost revenues for major shipping firms such as Sovfrachtthat was sanctioned by the U.S. Treasury Department in 2019 for allegedly shipping jet fuel to Russian forces in Syria.⁸³ And, lastly and perhaps most importantly, control and protection of this most critical part of Syria’s energy infrastructure benefited the insurers of the site, creating a sort of crude virtuous cycle of dividends that likely would have accrued from the management of reinsurance policies for energy and shipping sector risk by firms such as SOGAZ, which, not coincidentally, counts as shareholders relatives and close friends of Putin.⁸⁴

In effect, U.S. and EU sanctions imposed on the Assad regime from 2012 forward serve to reinforce this interdependence between Syria’s nationalized energy production industry and Russian state-backed firms. When the U.S. and EU also imposed sanctions on Russia in response to the Ukraine crisis in 2014, Russia developed a new business model for operating in a sanctions gray zone in order to service existing contracts in Syria. Russian state firms effectively owned much of Syria’s energy production infrastructure and at the same time likely underwrote the risk insurance that protected that infrastructure. That would seem to explain why when rebel forces began attacking production infrastructure in Homs in 2013 reports of Russian PMSC operators in the area began to increase.

Early in the Syrian civil war ISIL fighters seized Palmyra, along with much of the Homs governate, locking down control over the al-Shaer gas basin.⁸⁵ After 2014, Syrian Arab Army forces waged three major campaigns with the support of Russian PMSCs and Russian-trained Syrian militias for control of the swath of territory running from Palmyra to the al-Shaer gas plant. The most significant of these were the Palmyra offensives in the summer of 2015, spring of 2016, and spring of 2017. It was during these battles that the mythos surrounding the Wagner Group and their Syrian regime-backed counterparts in 5th Corps contingents, such as the ISIS Hunters, took on a viral quality.⁸⁶

Reports of secret burials of Wagner Group fighters killed while trying to recapture Palmyra and other energy production sites in Homs began to proliferate in the Russian and Ukrainian language press.⁸⁷ It was around this time also that the number of reported Wagner Group battlefield fatalities began to mount. According to data assembled by open source investigators and the international press and verified by our team, more than a dozen Wagner Group operators were reported killed in Syria in 2016.

In 2017, the number of battlefield deaths recorded specifically for the Wagner Group by open source researchers and verified by our team, increased to at least 52—although interviews conducted for this report indicate casualties for that year could be significantly higher.⁸⁸ Where places of death were indicated in the data, the majority of 2017 casualties appear to have occurred in Homs, Aleppo, and Deir Ezzor.⁸⁹ A cross-check of reported Wagner Group battlefield deaths and data our team gathered in the course of interviews with Syrian energy industry contractors in 2019 indicated a large number of reported fatalities appeared to have occurred at or near oil and gas sites for which Stroytransgaz is listed as a contracting party.⁹⁰

While each wave of battlefield casualties stemming from these battles precipitated press reports about the Wagner Group and its ostensible parent company EvroPolis, the trend also spurred a major reorganization of affiliated Syrian regime forces. In late 2016, the Syrian army announced the formation of the 5th Assault Corps.⁹¹ Also known locally as the “Storming Corps,” the 5th Corps was composed of a mix of local volunteers and gang-pressed conscript detainees trained almost exclusively by Russian PMSC contingents at the al-Draij military base.

In January 2017, elements of the Syrian Arab Army (SAA) along with the Russian-backed 5th Assault Corps group of militias, initiated a major effort to recapture Palmyra and nearby energy production infrastructure from ISIS forces.⁹² Fifth Corps militia units trained and supported by the Wagner Group, including the ISIS Hunters and Katibat Dir Watan, a Syrian-Lebanese fighting group, reportedly fought alongside Russians during the months-long assault.⁹³ The Syrian regime assault marked another in a long series of battles for control of Syria’s gas and mineral fields since ISIL first seized the territory in the fall of 2014.

By early March 2017, pro-Assad forces regained full control over Palmyra with the support of Russian PMSC contractors.⁹⁴ The SAA continued its push beyond the ancient city, recapturing key infrastructure north of Palmyra, including crossroads, granaries, electrical stations, and gas fields. According to news media reports, al-Shaer gas fields were successfully taken by April 28, 2017.⁹⁵ This is likely where Hamdi Bouta’s journey from Lebanon back into Syria in the spring of 2017 ends and the mystery surrounding the video documenting his torture, killing, and dismemberment in the early summer of 2017 begins to unfold.

In May 2018, a little more than a year after Hamdi Bouta’s family held a funeral for him in secret in the summer of 2017, the victim’s family members reported receiving a copy of the video (Video A) depicting Russian speaking men beating Hamdi Bouta with a sledgehammer via WhatsApp. Syrian reporters with al-Jessr Press at that stage begin investigating the story. By this time, in the spring of 2018, the first video had already been circulating on the internet for at least a year, and the connection between the incident at al-Shaer and the Wagner Group convinced Syrian and French human rights activist groups to try to pursue a legal case in Moscow.⁹⁶ Still, at the time, little was apparently known about the incident location or identities of the men in the video other than their presumed affiliation with the Wagner Group.

Although the Kremlin has repeatedly denied any direct links between the Russian government and Russian PMSC operators on mission in Syria a preponderance of evidence suggests otherwise.⁹⁷ In the spring of 2019 the identities of dozens of men who reportedly were killed in a U.S. strike on a Wagner Group contingent on February 7, 2018 during a battle near another SPC operated gas plant near the town of Khasham in Deir Ezzor were beginning to surface in the international press.⁹⁸ Impromptu virtual memorials to those killed in the battle also began to proliferate widely on Vkontakte, the Russian social media platform.⁹⁹

There is significant circumstantial evidence indicating that at least two of the Russian men depicted torturing Hamdi Bouta at the al-Shaer plant in the video may have been wounded or killed in the U.S. airstrike on the Wagner Group column on February 7, 2018. The dots that connect these two incidents—the atrocity at al-Shaer and the Battle of Khasham in Deir Ezzor—do not run in a straight line, but they are readily apparent in the tightly latticed network of Russian firms, businessmen, and PMSC operators who fought together in Donbas before deploying to Syria.

Perhaps not surprisingly, social network analysis of the digital profiles of individual Russian PMSC operators whose paths crossed during the fighting at al-Shaer in the spring of 2017 and later in Deir Ezzor in winter 2018 shows close friendship ties via Vkontakte with Russian citizens who stand accused of committing war crimes in the eastern Ukrainian region of Donbas in the fall of 2015. Again, while these links between social media users are not necessarily dispositive of culpability in any specific wrongdoing open source analysis of the networks that knit together the virtual lives of individuals in each of these groups reveals quite a lot about their military experience as well as the capabilities and skills that Russian companies like EvroPolis have sought to cultivate.

Media reporting about the first two-minute clip surfaced on the evening of June 30, 2017. The video (Video A) shows several Russian-speaking men torturing a man by striking him in the extremities with a sledgehammer.¹⁰⁰ The faces of the assailants are masked and only partially visible in the video. At the time, the involvement of Wagner employees was alleged by internet commentators but never confirmed. The victim’s identity and fate also remained unknown. Family members told journalists with al-Jessr Press that they last heard from Bouta when they received a recorded message from him on May 5, 2017. According to Arabic language news accounts, Bouta’s relatives only learned of his death a year later after a video surfaced online in May 2018.¹⁰¹

It is unclear whether the alleged posting of the torture video that circulated in June 2017 was the first time the video publicly surfaced. However, in early November 2019, Twitter users in the open-source intelligence (OSINT) research community began circulating segments of a new set of videos that appear to show a continuation of Hamdi Bouta’s torture and killing.¹⁰² Investigative reporters at Novaya Gazeta were among the first to pick up the thread and run with an expose about the second tranche of three video segments from the scene of Bouta’s killing (Videos B, C, D) on November 20, 2019.¹⁰³

In November 2019, extended videos and images from the incident appeared on Vkontakte user profiles and were collected and archived by our team. These extended videos show complete or partial faces of many of the assailants and reveal a fuller sequence of events. The victim’s face was visible throughout the videos until the point at which his body was dismembered. However, there are no obvious signs as to where the video may have been recorded and other than the victim, little is known about those who appear in the video. This section outlines what our investigations revealed about the location and timing of the incident as well as what we were able to discern about the identities of the victim’s assailants. We first begin by describing what is depicted in the video and what we learned from our attempts to verify the accuracy of media reports suggesting the incident took place near al-Shaer. ¹⁰⁴

Summary Description of Video Content

Video A (Beating) is 1 minute, 41 seconds long and it depicts four men beating Bouta with a sledgehammer. In this first video, the victim appears to be conscious and alive. Russian rock music can be heard in the background. In Video B (Decapitation) is 3 minutes, 16 seconds long and in it the assailants appear to use knives and entrenching tools (spades) to sever the victim’s head from his body. Video C (Dismemberment) is 1 minute, 33 seconds long and it appears to show the assailants using an entrenching tool to sever the victim’s arms. Video D is 2 minutes, 50 seconds long and it depicts the victim’s dismembered body suspended from a tall metal structure. In the same video, two of the assailants appear to douse the body with an accelerant and use an improvised torch to set it aflame. Someone off camera speaking in Russian says, “Come on. The wind is blowing hard.” About a minute and a half in, the body is aflame and one of the men who set the victim’s body on fire poses for the camera, and gestures with a crude bullhorn sign. A voice in close proximity to the camera microphone, possibly the man gesturing, says, “Jambo. Yeah, this will be the sign for mercenaries.”

Observations about the Assailants

There are at least five men who appear in the series of videos we reviewed other than the victim and the cameraman. At least two appear to film the incident on their own phones and one of the men appears to be documenting the incident on a small handheld camera. For the purposes of our analysis we have assigned an identifier to each of the assailants who appears in the videos, e.g. Persons 1-5.

Person #1

At various points throughout the videos, Person #1 steps into the frame, but he features most prominently in the fourth video segment, Video D (Immolation), in which the assailants burn the victim’s dismembered torso. He is wearing olive green cargo combat pants and a blue and white striped undershirt known as a telnyashka (тельня́шка), which is typically worn by servicemen in the Russian navy and by spetsnaz operators who serve in VDV airborne units.¹⁰⁵ For much of the time his face is covered, but at one point in the final video, Video D (Immolation), he poses alongside the victim’s dismembered body before it is set alight. About midway through Video D (Immolation), he appears in frame with his face half covered. He gestures with an impromptu bullhorn sign, jokes and declares, “This will be the sign for mercenaries.”

Person #2

In several of the video segments, Person #2 appears to be filming with a small digital camera. He wears a green outfit that appears to be a flight suit and a black and white “Arafat” kefiyah around his face and neck. Using open source techniques, Novaya Gazeta Reporter Denis Korotkov and his team established the link between Person #2 and the social media accounts of a man referred to in the article as “Stanislav D.” Korotkov indicates that Stanislav D. hails from the Russian municipal district of Stavropol and is known by the call sign “Volk.” Novaya Gazeta reporters indicate that they first identified him by using a publicly available facial recognition application called FindClone.¹⁰⁶ Novaya Gazeta reporters further verified this initial finding by reviewing a passport photo, a security questionnaire, and a non-disclosure agreement obtained by the paper in other related investigations. According to Novaya Gazeta, Stanislav D. began his service for state security organs as a private in a police unit in Stavropol, Russia. Sometime before February 2016, he began working for the Wagner group as a “reconnaissance shooter,”¹⁰⁷ and he has allegedly made several trips to Syria.¹⁰⁸

The Guardian, a U.K.-based newspaper, and the investigative research group Bellingcat claim to have independently verified Novaya Gazeta’s initial November 2019 findings.¹⁰⁹ A subsequent separate report published under the name Romanova Mari on Narodnaya Pravada, a pro-Ukrainian blog, goes a step further, identifying S. Dychko as “Stanislav Dychko,” a 30-year-old Russian citizen.¹¹⁰ The Narodnaya Pravda article also indicates that Facebook users in a community group called “Gruz 200” (Cargo 200), which tracks information about combatants operating in the embattled eastern Ukrainian region of Donbas, identified Dychko by matching his photo with information published on the Myrotvorets, a website known for its links to current and former officials with Ukraine’s SBU intelligence service.¹¹¹

While the Myrotvorets site indicates Dychko is a member of the Wagner Group who fought in Donbas it is important to bear in mind that the website’s operators have a specific agenda and anti-separatist bias that raises questions about the veracity of information posted on the site. More research is required to verify whether Stanislav Dychko described on the site is the same one reportedly depicted in the video. Yet, as will be shown later, a deeper dive into the social media networks of Dychko and others implicated in media reports about the incident at al-Shaer appears to at least partially corroborate the existence of links between individuals depicted in the videos and contingents of Russian-backed PMSC’s who fought in Syria in 2016-2017 and in Donbas in the 2014-2015 timeframe.

Person #3

Person #3 is most prominently featured in Video A (Beating), Video C (Dismemberment) and Video D (Immolation). He is wearing multi-cam green cargo combat pants, a black balaclava, goggles with a white band, and at various points his blue and white telnyaskha undershirt is visible. At one point in the video as it is showing the victim’s body being burned, Person #3 steps into the frame to douse the body with accelerant fluid and shouts something in what sounds as if it could be a Turkic or Persian language dialect.

Person #4

Person #4 is an active participant throughout all four video segments. He wears a short-sleeved tan shirt, combat cargo pants, ski goggles with a white band, and his face is partially covered with a black and tan kafiyah. In Video A (Beating), he wields a sledgehammer and uses it to torment the victim. He is addressed using the call sign “Volk,” or “Wolf.” In Video C (Dismemberment), Person #4 also appears to stand in the background while his associates mutilate the victim’s remains. He is shown along with Person #1 and Person #3 dousing the victim’s dismembered body with a liquid accelerant before it is set alight.

In early November 2019, as the second tranche of videos documenting the victim’s torture, killing, and mutilation begin to circulate online via WhatsApp and other social media platforms, OSINT researchers who track news about the Wagner Group began to tweet news reports that identified Person #4 as a man named Vladislav Apostol, a dual citizen of Russia and Moldova. In a December 2019 article, Meduza, an online news blog about Russia, specifically references articles published by Fontanka alleging that Person #4 is Apostol, and that Mikhail Kuznetsov, a volunteer with the InformNapalm project, had previously reported Apostol’s military activities in Syria on Facebook.¹¹² The Meduza article additionally confirms that the person believed to be Apostol is referred to in the video as Volk. The article also referenced Fontanka as having identified a Vladimir B., a spetsnaz veteran of the 76th VDV Airborne division, the same division as Wagner’s titular head Dmitry Utkin, as a participant in the killing.¹¹³ When Fontanka reporters tried to verify these details by contacting the person referred to as Volk directly, they were told there was no connection. But, since details about the interview are vague at best, the denial of a connection in a news report does not preclude the possibility that there is some overlap between subunits of the 76th VDV. ¹¹⁴ Indeed, a bevy of social media data analyzed by our team and research and reporting by others who follow Russian military affairs closely indicates a high level of overlap between VDV spetsnaz veterans and the Wagner Group.¹¹⁵

Around the same time that news of Apostol’s alleged link to Hamdi Bouta’s killing begins to circulate, Vkontakte groups that track news and developments in the Russian soldier fortune community also began to post lists of the names of Wagner Group operators allegedly killed in a U.S. airstrike in the now famous Battle of Khasham near the Conoco gas site in Deir Ezzor in February 2018. Apostol’s name appears in several of those mostly anonymous posts but it is unclear whether the posts regarding Apostol are merely referencing information made public by Ukrainian law enforcement authorities or other sources.

Several of the Vkontakte posts reference a September 2018 InformNapalm story suggesting possible links between Apostol and Alexey Milchakov, commander of a “volunteer” Russian unit that fought along separatists in eastern Ukraine.¹¹⁶ Links to that same article also cropped up again on Twitter accounts of OSINT researchers who track news about Wagner’s operations in Syria and elsewhere.¹¹⁷ These posts appear to corroborate Arabic language press reports indicating the video of Hamdi Bouta’s killing was likely shot at the al-Shaer gas facility in Syria.

The posts also hint at the web of social networks that link Apostol and others implicated in the incident to Russian separatist units who fought in Donbas before going to work for EvroPolis in Syria. This elevated Apostol as a person of interest connected to Bouta’s killing, and prompted our team to take a closer look at Apostol’s digital footprint and virtual friendships—an investigation that, as detailed below, revealed quite a lot about the organizational recruitment patterns of Russian PMSCs. ¹¹⁸

Person #5

Person #5 remains off camera for nearly all of the videos, stepping into the frame only occasionally. When he does step into the frame it is clear that he is wearing long-sleeves and that the left sleeve bears a white patch with Cyrillic writing and a smiling joker’s face. It appears that he is functioning as a cameraman. His face is mostly covered with a kafiyah during the brief moment that the lens in trained on him.

A reverse image search of the patch leads to the website of a Krasnodar, Russia company called MidFort that sells gear for Russian Airsoft games enthusiasts and military apparel and accessories. The MidFort company website indicates the firm became an official dealer of tactical gear and uniforms for the Russian state in May 2016.¹¹⁹ A review of MidFort’s Instagram account turns up a photo of the same joker patch worn by Person #5 in the video alongside several others, including an insignia patch for the ISIS Hunters group, a Syrian tactical group trained and equipped by Wagner Group operators that is part of the 5th Assault Corps.

At first glance, this detail would appear to offer—at best—circumstantial evidence of links between the assailants and Wagner Group operators. But, as will be seen further below, the fact that quite a few members of an Instagram account that purports to be the official account of Rusich also liked and posted commentary about the same types of patches opened up fresh lines of inquiry that ultimately reinforce publicly available reporting that placed the assailants, the victim and the cameraman at the al-Shaer site in the late spring of 2017. It also suggests that there are likely overlapping links between members of Rusich and those implicated in the incident. Social network analysis of social media data for individuals who subscribe to Rusich social media accounts also underscores the link between Russian ultranationalists who fought in Ukraine and units affiliated with Russian PMSC contractors who worked for EvroPolis in Syria, corroborating early reporting by Fontanka.¹²⁰

Observations about Implements & Weapons in the Video

The perpetrators utilize model MPL-50 entrenching tools (spade) to sever the arms of the victim. This model has been used by the Russian Empire and its successor states, nearly unchanged, since the late nineteenth century. Spetsnaz operators are typically trained to use their entrenching tools as weapons in hand to hand combat, and several authoritative accounts by Russian observes indicate that spetsnaz soldiers are taught in training to use entrenching tools for interrogations.¹²¹ The presence of this tool supports, but does not necessarily confirm reports that the assailants are current or former members of the Russian military.

Two firearms are clearly visible in the videos. The first is a RPK-74 light machine gun. The furniture of the RPK-74 has been constructed from black polymer (as opposed to wood) since the model was introduced in 1974 as a primary squad automatic weapon for VDV spetsnaz paratroopers.¹²² Therefore, the weapon pictured here appears to be an older model.

The next weapon is the AK-74M assault rifle. The age and quality of these weapons is difficult to assess due to poor camera angle and manual paint coating.

All weapons observed are in common use among various parties to the Syrian conflict. Painting weapons manually is uncommon among line infantry units. As a result, the weapon on the right may suggest that the user has a background in special operations. No specific information is implied about the identities of the perpetrators, however, by the presence of these weapons at the scene.

Observations about the Incident Location

Three months after initial reports by Novaya Gazeta and Fontanka about the videos on February 21, 2019, a Vkontakte war blog claimed in a post that the Hayan Petroleum Company posted an image on its page showing a memorial to “Russian volunteers in the Syrian Arab Republic” and indicating that there were unconfirmed reports that the site was a “permanent location for the Wagner Group PMC fighters” (Figure 14).¹²³ Comparison to satellite imagery (Figures 15 and 16) strongly suggests that the location of the monument is in a courtyard area near the entry way to Jihar gas facility, likely placing at least one of the Wagner Group contingents in the Hayan gas block area. 

The comparison of a Rusich Instagram account post (Figure 17) of the Wagner Group memorial statue with those posted elsewhere on Vkontakte (Figure 14) and satellite imagery of the Jihar site on the Hayan Block (Figures 15 and 16) appears to support the assertion that Russian PMSC employees affiliated with both the Wagner Group and Rusich were stationed at Jihar in the Hayan block and not far from the al-Shaer gas field at some point after Syrian and Russian operators retook control of the site in the spring of 2017. It also would appear to corroborate prior reporting that Wagner Group operators and Russian-trained ISIS Hunters assisted in the recapture of the facilities in the Hayan Block area from ISIL in April 2017.¹²⁴ A Facebook post on the Hayan Petroleum Company account that clearly shows before and after pictures of the Jihar gas plant, which also circulated among Vkontakte soldier of fortune accounts in 2017 and again in 2019.

Zooming in on the Al-Shaer Compound

In late April 2020, Novaya Gazeta reporter Denis Korotkov published a story placing the scene of Bouta’s killing at the al-Shaer gas facility.¹²⁵ According to widespread media reports, ISIS fighters destroyed most of the main facility of al-Shaer in mid-May 2016.¹²⁶ This destruction preceded a series of battles in the vicinity of the site in late 2016. As a result of the destruction, and the ongoing threat of enemy attack or vehicle borne improvised explosive devices (IEDs), it is likely that any semi-permanent base of operations would be set up outside the main compound. Analysis of satellite imagery of the site reveals a number of places that would potentially be suitable for perimeter defense. We analyzed image stills from the video of Bouta’s murder (Video D) and determined that an outer perimeter fence appears to be visible from at least three angles.

Since it would appear that a considerable portion of the structures in the center of the site remained relatively intact, the shots showing the perimeter fence suggest that part of the videotaped incident occurred in a corner of the al-Shaer site with a relatively unobstructed view of the outer area of the site. This would seem to corroborate Novaya Gazeta’s claim in its April 2019 report that the men involved in the incident likely spiked the victim’s head on a fence in the northwest quadrant of the al-Shaer area.¹²⁷

On a November 21, 2019, the same day Novaya Gazeta published its second expose on the al-Shaer incident, naming Stanislav D. as one of Bouta’s killers, a Vkontakte user who uses the profile name “Dmitry ‘Crow’ Bobrov” reposted an excerpt of a discussion thread that appeared to give a fuller accounting of the incident.¹²⁸ As can be seen in the screenshot below from Bobrov’s account (Figure 22), the post seemed to imply that its author had been present during the incident and indicated that Russian forces first encountered Bouta during a skirmish in Syria in the spring of 2017. The anonymous post indicated that the video was shot in April 2017 after Bouta was captured and held prisoner during clashes with ISIL fighters and then later freed during a raid on a Russian position.

“We picked up this fuck in late February or early March with his bare ass hanging out in the desert when we were sweeping the territory that had just been retaken from the enemy,” the anonymous poster wrote. “During the interrogation, he said that his unit had retreated from his position when the enemy began to attack and he fought back. They took him with him and for a couple of weeks he was shadowing our positions.” According to the account given in the repost, Bouta apparently was soon recaptured again when Russian and pro-regime Syrian forces finally retook control of al-Shaer near the end of April.¹²⁹ The post seems to imply that the video was taken on a cell phone and that the phone’s owner later somehow lost his phone during a battle.

Since many of Bobrov’s other posts appeared to show an abiding interest in military affairs, spetsnaz forces, and the war in Donbas, the November post about the al-Shaer incident raised questions about whether he might know someone involved in Bouta’s killing or if he himself might be a member of the Wagner Group. A closer examination of Vkontakte user Dmitry Bobrov’s account revealed that at one point he listed the Russian resort town of Sochi as his place of residence in September 2015.¹³⁰ Further analysis also indicated significant overlap between Bobrov’s social circles and several other Vkontakte users who appear to have fought in either Syria or Donbas or both. This does not indicate Bobrov’s involvement in the incident, and there is no evidence on his Vkontakte pages pointing to any direct knowledge of the facts of the case.¹³¹

What Bobrov’s repost does suggest, however, is a certain affinity with the narrative of the incident as recounted by a Vkontakte user who purports to have been an eye witness to Bouta’s killing. While these virtual connections are not dispositive of direct involvement of those in Bobrov’s social media networks, an exploration of Bobrov’s profile reveals significant overlaps between his online social circles and those in his immediate network of Vkontakte friends who reportedly served with Russian separatist contingents who fought in Ukraine and later fought to secure the al-Shaer plant and other oil and gas facilities in Syria.

A review of Bobrov’s account in November 2019, indicated that, at one point, Bobrov listed Sochi¹³² as his place of residence at the time and that he served with a Russian airborne VDV assault unit and who fought in eastern Ukraine. As explained in further detail below, the VDV connection—though tenuous—is curious because images from the video clearly indicated the perpetrators carved the words “VDV 31-Razvedka” on the dismembered torso of the victim, Hamdi Bouta.

Presumably, VDV 31 is a reference to the 31st Separate Guards Order of Kutuzov 2nd class Air Assault Brigade, a Russian an airborne infantry brigade based in Ulyanovsk. One of several airborne units that was reorganized during Russian efforts to reform its military after the Soviet collapse, the VDV 31st Brigade fought in the Second Chechen War and the Russo-Georgian War. During the start of the Ukraine crisis in 2014, elements of the brigade were located in Crimea and in the summer of 2014 the brigade's units began washing up on the frontlines in Donbas.¹³³

An analysis of Vkontakte users who posted images with geocoded tagging indicating close proximity to the al-Shaer site in the January to September 2017 timeframe revealed links to at least two users who claim to have served in a VDV unit. Those two Vkontakte users also appeared in Bobrov’s list of Vkontakte friends. While Bobrov’s claims on social media about his military service with the VDV may or may not be accurate, an analysis our team conducted indicates that it is not uncommon for Vkontakte users to openly identify their past or current service in the Russian military and to identify their military unit affiliations.

In fact, a separate analysis of 9,500 Vkontakte users connected to the Vkontakte user who posted the original November 2019 account of Bouta’s killing that we conducted in September 2019 turned up large numbers of individuals who are part of a burgeoning online movement of Russian ultranationalists with an abiding interest in mercenary culture who claimed to have served in Russian military units. Further analysis and verification is required to assess users’ claims about their time in service. But in an analysis conducted from November to April 2020, we identified a subset of a little over 380 users out of that 9,500 who indicated their professed interest in the Wagner Group and claimed past or present service in a variety of Russian military units.¹³⁴ The vast majority of users in that subset indicated that they had served in spetsnaz units with headquarters located in the southern and western military districts of Russia.

In a separate assessment of a subset of users connected to that same network, we found 74 users who directly identified themselves as members of specific Russian military units in a Vkontakte discussion thread. Like those in the larger dataset, all 74 indicated a strong interest in news about the Wagner Group and developments about the Russian mercenary lifestyle. A preliminary assessment of users in this second group of self-identified fans of the Wagner Group who indicated their military affiliations also showed that the vast majority also indicated having served in spetsnaz units based in Russia’s Southern and Western military districts with district headquarters located in Rostov-on Don and St. Petersburg, respectively.¹³⁵ Many appear to have served in VDV airborne divisions, motor-rifle brigades, and artillery units. More analysis and verification needs to be done to assess what, if any, patterns of affiliation are indicated in the data but at minimum this initial exploration suggests strong overlapping social ties between the growing number of right-wing ultra nationalist militarist communities on Vkontakte and Bobrov’s social circles.

Figure 23: Analysis of a spring 2018 Vkontakte discussion thread post 74 users self-identified as contractors who served in the Russian military. The majority served in units located in Russia’s southern and western military districts.

Indeed, exploration of Dmitry Bobrov’s Vkontakte account and friends network seems to suggest a possible tie to several VDV veterans who may have, at one time, served as contractors and fought in Ukraine with Rusich, (ДШРГ «Русич») a Russian-backed separatist fighting contingent that fought in Donbas and is closely tied to the Russian Imperial Movement and other offshoot branches of white supremacist groups based in St. Petersburg.¹³⁶ Dmitry Bobrov’s friend Denis Mokrinsky, for instance, appears to have several friends who have served in VDV units, fought in Donbas, and are within the friend network of Alexey Milchakov, the self-proclaimed commander of Rusich who, by his own published account, traveled from St. Petersburg to Donbas in June 2014.¹³⁷

In a photo posted by both Bobrov and Mokrinsky on his Vkontakte account on May 10, 2019, Bobrov appears alongside Mokrinsky in an unknown location. Both men are sporting Novorossiya flag patches and orange and black St. George’s ribbons, indicating a possible link to separatist fighting units in Donbas. Both Bobrov and Mokrinsky posted the same photo on their individual Vkontakte accounts. A closer examination of both Bobrov and Mokrinsky’s user accounts suggest overlapping ties with several other Vkontakte users who are members of Rusich’s official Vkontakte group page and with other Vkontakte users who posted photos from apparent battle sites in Syria.

Bobrov and Morkrinsky seem to have quite a few friends in their network who have, at one time or another, been affiliated with VDV airborne paratrooper units, including several friends who posted pictures of themselves posing with Rusich leader Alexey Milchakov in front of VDV memorials in Russia. These connections are curious and would seem to provide additional insights into published reports in 2018 about Milchakov’s presence at the al-Shaer plant site as well as others with apparent social ties to Russian PMSC contingents that operated in Syria and Ukraine.¹³⁸

Whether Milchakov was present in Syria at the time at the time of Bouta’s death in 2017 remains unclear but several clues suggest that friends linked to his social media circles and Milchakov’s Rusich compatriots likely were in the Palmyra area and not far from the al-Shaer site in the spring of 2017. One of the early clues of a possible link first publicly surfaced on social media six months after the bloody February 2018 battle of Khasham that killed scores of Wagner Group operators. On September 12, 2018 a YouTube user with the profile name “Ilya Moskovchenko,” posted a five-minute long video memorializing and listing the names of Wagner Group fighters killed near the Conoco gas plant.¹³⁹

The video features a press conference with Russian foreign ministry spokeswoman Marina Zakharova and lists the names of about 50 individuals allegedly killed in the U.S. military strike on the Conoco gas plant, including one Vladislav Apostol, the dual Russian-Moldovan citizen reportedly born on January 13, 1988 who was also reportedly identified as one of Bouta’s assailants. In the short five-minute long video, Zakharova denies any Russian citizens were killed in the February 2018 battle. Yet, media reports and other evidence suggest otherwise.

Historical flight data authenticated by C4ADS and shared with our team, however, indicate that Apostol booked a Grozny-Avia flight from Belgorod International Airport to Simferopol International Airport in Crimea on September 23, 2014 for a man named Vladislav Apostol bearing the same birthdate.¹⁴⁰ Apostol’s cross-border flight from Russia on the now defunct airline established by Ramzan Kadyrov arrived in Russian-occupied Crimea two months after the downing of Malaysia Airlines flight MH17 and the same month that NATO confirmed the presence of Russian military forces in Donbas.¹⁴¹ While not dispositive of Apostol’s involvement in the battle of Khasham or his direct involvement in fighting in Donbas, the flight billing records do appear to place Apostol in Donbas at the peak of Russian-sponsored operations in the eastern Ukraine region in 2014.

Four years later, after EvroPolis apparently booked Apostol’s flight into Crimea, images of Apostol posing near a Christmas tree in Syria with a gas plant in the backdrop were shown in the video memorial to the fallen at Khasham on YouTube.¹⁴² Then on Oct. 9, 2018, the Ukrainian Russian language blog InformNapalm reported that its investigators had geolocated the site of a picture taken of Apostol at the al-Shaer site of Conoco gas plant in Deir Ezzor.¹⁴³ The story cited Ukraine’s SBU intelligence service as one of its sources, and suggested Rusich commander Milchakov was also pictured at the same area in a courtyard pool area on the Jihar facility site in the Hayan Block.

A further review of Bobrov’s account and others linked to him turned up links to posts from the Rusich Instagram account, which in turn led to an interesting series of posts by the apparent owner of Rusich’s Instagram account (see Figures 28, 29) from the summer of 2019. This July 1, 2019 post, which depicts a memorial statue dedicated to Russian volunteers who fought in Syria, appears to corroborate reporting by InformNapalm and others that Rusich members like Milchakov may at one time have been based at the al-Shaer site on the Hayan Block where the statue is reportedly located. Another photo posted of a soldier with a kolovrat symbol on his uniform standing near the ruins of Palmyra posted on the Rusich Instagram account in April 2019 also would seem to indicate that Rusich members were in the area at some point during the Syrian civil war. But, to understand how Rusich, Milchakov, and Apostol fit into the picture, it is important to start at the beginning in Russia and Ukraine.

One of the strongest hints that there is that there may be a link between Rusich social circles and those involved in Hamdi Bouta’s killing at al-Shaer comes from clues left by the killers themselves. After the victim’s body is dismembered and hung from its feet from a metal structure at the site, four of the men at the scene pose near the body with their faces forward. On closer inspection, the number 31 and the Russian letters for VDV and the word “razvedka” appear to be seared into the corpse’s torso.

When our team at Frontline Forensics conducted a search for geotagged photos posted on Vkontakte in the January to September 2017 timeframe that bore geotagged markers for locations within a 50km radius of the al-Shaer gas plant facility, we found photos posted by two individuals who apparently served in the Russian military at one point in their careers. Among the results, was a photo posted on Sept. 4, 2017 (See Figure 30) on a Vkontakte account for an individual who uses the profile name Vadim Isaeev.

The artillery piece pictured in the background of the photo is a 2A65 “MSTA-B” 152mm howitzer. This Russian towed-artillery piece has seen extensive service in the Second Chechen War and the Syrian civil war, especially by units of the Syrian Arab Army and supporting Russian units.¹⁴⁴ The flat terrain and chalky-white rocks are consistent with the Hamad Desert. Also referred to alternately as the Syrian, Eastern, or Western Desert, this region extends east and south from Palmyra to the Euphrates River Valley and the Tri-Border region. The al-Shaer gas fields fall within Hamad Desert boundaries.

Another interesting detail included in Vadim Isaev’s photo in the Syrian Desert is the inclusion in the comments section of an excerpt from the song “We Need Another Victory (Our 10th Airborne Battalion)”, which is featured in the well-known 1970 Russian feature film about frontline camaraderie between a group of paratroopers, Belarus Train Station.¹⁴⁵ Relatedly, and likely not coincidentally, one of the individuals who liked the photo of Vadim Isaev was another Vkontakte user named Vadim Sergeev who also posted a separate photo in the vicinity of Palmyra not far from al-Shaer in 2016.

Like Isaev, Sergeev shows a clear proclivity for ultra-right Russian nationalist ideology and an abiding interest in memes and folklore about Russian airborne paratroopers. A check of the Twitter handle Sergeev posted on his Vkontakte profile page—@DedMoroZural—reveals another June 12, 2017 post of a picture of a young woman fleeing ISIS somewhere in Syria. Further exploration of a Facebook account linked to a YouTube account of the same handle reveals that a person using the same handle, DedMoroZural, lists Chelyabinsk, Russia as a place of residence. The Facebook account¹⁴⁶ for the person using the same handle as Sergeev indicates that the owner of the account also attended the now defunct Chelyabinsk Higher Military Aviation School for Navigators. Before the Russian air force academy was disbanded in 2011 it was well known for training an elite cadre of forward air controllers.¹⁴⁷

The appearance of geo-tagged photos in the vicinity of Palmyra and al-Shaer during two significant battles in 2016 and 2017 for control of the al-Shaer complex and Palmyra is interesting because there is little chance that anyone would be capable of traveling—or have a desire to travel—to the region without a military purpose. It is also equally unlikely that two Russian speaking individuals with a clear history of military service in Russia’s airborne special forces who cross-post likes of photos taken in such a remote part of Syria would do so coincidentally. This set of observations about the potential connections between Vadim Sergeev and Vadim Isaev’s photo posts during the same timeframe when two critical battles for control of the al-Shaer site and nearby facilities in Palmyra took place indicated to our team that a more thorough analysis of Isaev and Sergev’s social networks on Vkontakte might yield additional insights.

While collecting evidence on VKontakte connected to the video in October 2019, we cross-checked Sergeev and Isaev’s account links against a dataset of members of a VKontakte community that track soldier of fortune news, culture, and developments. In addition to confirming that both Isaev and Sergeev were members of that group, we found on closer inspection that other individuals who posted photos on Vkontakte geotagged in the Palmyra area in the spring 2016 timeframe at the height of a key battle for control of the area belonged to the same friends network as Isaev and Sergeev. Included in that group is a Vkontakte user named “Ali Syria.”

We located and verified the geocoordinates for photos posted to Vkontakte during the spring 2016 and spring 2017 time frame when the two battles for al Shaer occurred. That search turned up Sergeev’s May 2016 photo post and a photo posted by Ali Syria in the same area in March 2016. In fact, it turns out both Ali Syria and Sergeev have mutually posted on each other’s Vkontakte pages and they list several mutual friends in common. Ali Syria indicates he is a member of spetsnaz and he has posted an audio file of the “Wagner Group” rap song on his page. He appears to have traveled extensively with militias affiliated with the 5th Corps and ISIS Hunters, a Syrian militia believed to have been trained and supplied by the Wagner Group.

Ali Syria’s profile contains multiple references to Syria and Assad as well as a post addressing the death of Wagner PMSCs in Deir Ezzor in February 2018. As can be seen below, a map of his geotagged photos on Vkontakte indicates he posted from several hotspots in Syria.

Based on the content collected in our initial review, a deeper analysis was conducted on Ali Syria’s social networks to see which members shared friendships, likes, and cross-posts that overlapped with posts by Vkontakte users in his circle who indicated having fought in Syria or Donbas or both. The review of data from Ali Syria’s account indicated that he is friends with a man named Andrey Spekhov. Spekhov appears in at least one photo posted on his own VK account in September 2019 alongside Rusich commander Milchakov and confirms in commentary with the photo that Milchakov is with Rusich and that the photo of them together was taken in Moscow

According to a report prepared by the Eastern Ukrainian Center for Public Initiatives, a Ukrainian civil society organization, Spekhov is one of several Russian citizens suspected of having fought on the side of Russian-backed separatists in the Donbas town of Shirokhine during the 2014-2016 period.¹⁴⁸ The report includes a photo of Spekhov posted on his Vkontakte account in 2017 showing a tattoo on his shoulder of the insignia for the elite 45th Special Purpose Airborne Brigade (45th opSn) on Vkontakte.¹⁴⁹ Several photos posted on Spekhov’s Vkontakte account during the summer of 2015 at the height of a second wave of fighting in Donbas indicate he likely served as s sniper scout, including one posted on June 2, 2015 showing Spekhov near a Donetsk windfarm dressed in a forest camouflage uniform typically worn by members of the scout reconnaissance 45th opSn and cradling a sniper rifle in his arms.

Curiously,¹⁵⁰ but probably not coincidentally, the report makes reference to several other Russian nationals who fought in the same area of Donbas during the same period and later traveled to Syria to fight, including Konstantin Zadoroshzny, who was reportedly killed in Syria in 2017 along with another Russian Donbas veteran Ivan Slyshkin,¹⁵¹ one of several of Spekhov’s Vkontakte friends who appears to have overlapping friendship ties with Rusich leaders, according to our analysis of publicly available Vkontakte data.

Further analysis of Isaev, Sergeev, Spekhov and Ali Syria’s Vkontakte accounts and digital trails revealed tight overlap between close-knit networks of about 100 Vkontakte users who subscribe to the official Vkontakte account for Rusich, and more specifically, overlap with Rusich’s co-commanders Milchakov and his compatriot Jan Petrovsky. We noted with interest that at least three of Ali Syria’s friends also have multiple friends in common who indicate that they are members of or have an abiding affinity for related Donbas separatist tactical groups, such as the Sparta Battalion, Batman Battalion, and Prizrak Battalion.

Again, while none of these links are dispositive of any specific connection to the incident and events at the center of the inquiry into Hamdi Bouta’s death, the tightly meshed relations between Isaev, Sergeev, Spekhov, Milchakov, and Petrovsky—all of whom appear to have spent time supporting Russian separatist operations in Donbas—raises questions about whether, when, how, and why their paths may have connected. To understand those connections, a brief exploration of Rusich’s origin story is in order.

There are different dates given for the start of the paramilitary unit now known as Diversionary Guerilla Reconnaissance Group Rusich (ДРШГ Русич/DrShG Rusich), but its genesis is rooted in the rise of ultra-right nationalism in Russia in the 1990s after the collapse of the Soviet Union. During the two decades leading up to the start of the Russian-separatist putsch in eastern Ukraine, the former imperial capital of St. Petersburg figured prominently in this respect, playing host to several of the earliest progenitors of the paramilitary contingents that would later turn up on the frontlines in Donbas and eventually Palmyra.¹⁵² At that time, in the 1990s, Russia’s gilded, artsy second city also was at the bleeding edge of leftist intellectualism, a heady punk scene, and, because of its many universities, it boasted a relatively diverse population.

But it wasn’t long after the start of the First Chechen War in 1994 that St. Petersburg then emerged as a central node in the highly fused networks of organized crime gangs, security agencies, and ultranationalists that today dominate the Russian government. Not incidentally, this all took place just as Vladimir Putin was transitioning from longtime service in the KGB to a career in politics in the St. Petersburg mayor’s office. At the time, Putin was deputy mayor under Anatoly Sobchak and charged with overseeing the city’s import-export business.¹⁵³

Among the most lucrative deals overseen by Putin was a contract signed for the foreign trade of petroleum products processed by the Kirishinefteogsintez oil refinery petroleum products processed by the Kirishinefteogsintez oil refinery trade branch with Gennady Timchenko.¹⁵⁴ Timchenko, who would eventually go on to become head of Stroytransgaz and the energy trading behemoth Gunvor, was a critical player in a deal with Putin that led to a three-way trade deal in which oil revenues sold on the open market were used to pay for food that was in short supply in the city. Not coincidentally, it was about this time that Yevgeny Prigozhin also began to make his way up the ranks of St. Petersburg’s emergent new money business class as a local restauranteur and caterer.¹⁵⁵

It was against this backdrop that neo-fascist groups such as Pamyat (Memory) got their start and Alexander Dugin, a St. Petersburg-based political philosopher today known widely as “Putin’s brain,” began to stoke the fires of ultranationalism. Dugin has spent a lifetime reinvigorating a peculiar brand of religiously-tinged white supremacy that has deep roots in Russia’s conservative-monarchist traditions and has long found a ready home in St. Petersburg, the one-time imperial capital of Tsarist Russia. Born into the family of a former Soviet intelligence officer, Dugin, like Putin, came of age during the prelude to the Soviet collapse and has since risen to prominence as an adviser to Sergey Naryshkin, the director of Russia’s Foreign Intelligence Service.¹⁵⁶

Dugin’s philosophy is immensely influential among the ultranationalist neo-fascist gangs that became feeders for St. Petersburg paramilitary contingents such as the Russian Imperial Movement (RIM) and related RIM offshoot branches, such as the Russian Imperial Legion of volunteers headed by former Donetsk People’s Republic Igor “Strelkov” Girkin and Alexey Milchakov’s Rusich. While the number of Russian volunteers, from St. Petersburg’s Duginist cadres are thought to be quite small—with perhaps the core numbering 200 at any given time during the 2014-2015 period—their contributions to major battles during the early part of the Donbas war were significant and few were more significant than Rusich and its affiliated paramilitary group E.N.O.T.¹⁵⁷

According to Milchakov’s own account, he first formed Rusich with Yan Peterovsky in St. Petersburg by volunteering with the Aid Coordination Center of Novorossiya (KTsPN), an Imperial Legion offshoot in June 2014.¹⁵⁸ The aid coordination center facilitated “humanitarian” convoys to support fighters in the Batman Battalion and Prizrak (Ghost) Brigade.¹⁵⁹ But, Milchakov’s involvement in neo-fascist activities in St. Petersburg reportedly predated Rusich’s entry on the scene in Donbas in the summer of 2014, first under the leadership of Alexander Bednov, the late head of the Batman Battalion tactical group.¹⁶⁰ Born in 1991, Milchakov reportedly became active in the St. Petersburg neo-fascist scene in 2007 and one of his well-known early exploits involved the videotaped beheading of a dog, an act that quickly earned him a fearsome reputation among the St. Petersburg neo-fascist set.¹⁶¹

Not long after that, Milchakov reportedly joined up with the elite 76th Air Assault Guards (VDV) Division.¹⁶² Legendary for its leading role in WWII battles, the Chechen wars, and the 2008 Russian military assault on Georgia, the division was also the military alma mater of Dmitry Utkin, the Wagner Group’s titular commander.¹⁶³ Whether Milchakov first encountered Utkin at the 76th VDV’s headquarters in Pskov is unclear, but the division’s 104th Guards Regiment is well-known for being one of the first to be reorganized into a contract reserve service in 2006, so it is likely that both Milchakov and Utkin have more than just their time in the trenches in eastern Ukraine in common.

When Milchakov and Petrovsky, a dual citizen of Russia and Norway, formed Rusich in the summer of 2014 as a subunit under the command of Alexander Bednov’s Batman Battalion, there were already signs of trouble on the separatist front. A lack of discipline within the ranks of the Donbas militias led to the reorganization of a number of subunits including the Batman group. Rusich, first under Bednov’s command and later under the command Prizrak’s leader Alexey Mozgovoy, fought in some of the war’s most pivotal battles including the fight for control of the Donetsk airport and later, most notoriously, Milchakov and his crew led a brutal assault on the Ukrainian-backed militia known as the Aidar Battalion near the town of Metallist.¹⁶⁴ The latter operation landed Milchakov on the Ukrainian government’s list of most wanted for war crimes in Donbas.¹⁶⁵

But, as several scholars have pointed out, Rusich’s role was likely primarily propagandistic in nature.¹⁶⁶ The ambush on Aidar battalion became the stuff of legend after videotaped segments from the grizzly battle scene appeared in a video posted by Colonel Cassad, a LiveJournal account known for its pro-Russian propagandistic commentary on the conflicts in Ukraine and Syria. Shortly before Milchakov reportedly pulled Rusich out of Donbas in the late summer of 2015, his participation in the International Russian Conservative Forum was widely publicized and as scholars of the Russian right have noted, he has emerged as an important influencer among neo-fascist youth in Russia.¹⁶⁷

Upon his return to St. Petersburg from the Donbas in 2015, Milchakov formed the private paramilitary group known as E.N.O.T. and he maintains an active Vkontakte account for Rusich, which as of April 2019 boasted more than 3,700 followers and claimed a support branch in Poland.¹⁶⁸

What is interesting about Milchakov’s post-Donbas chapter is that, despite widespread documentation about his participation in human rights abuses on the frontlines, he appears to enjoy at least passive support from authorities in St. Petersburg who apparently have chosen to overlook his highly public involvement in neo-fascist causes. Videos of Milchakov training Rusich volunteers in combat tactics in the forests at the outer edge of St. Petersburg appeared on YouTube as recently as the fall of 2019.¹⁶⁹ Interestingly, Milchakov is one of the few identified as fighting for the Wagner Group in Syria to be untouched by scandal or arrest upon his return to Russia. This raises questions about the special status afforded to Rusich veterans and others in Milchakov’s group who fought in Syria and Donbas and their true role in Russia’s overall strategy.¹⁷⁰

Although the virtual sinews that connect the web of individuals and entities that have supported the Wagner Group’s activities in Syria and Ukraine may at times seem tenuous, the digital ties that bind them may also hint at another important dimension of Hamdi Bouta’s brutal killing in the summer of 2017. Videotaped for all the world to see and circulated widely on the internet, the incident at al-Shaer has emerged as one of the most emblematic of the Wagner Group’s dark mythos, and, not surprisingly, the men pictured in the video have become icons of Vkontakte’s militarist neo-fascist set.

In fact, not long after the second tranche of videos of Russian operatives decapitating and dismembering Bouta began making the rounds on Vkontakte, Instagram, and other social media platforms in late 2019, our team detected a disturbing trend in which dozens of users began swapping out their own selfie photos in favor of still images of Bouta’s assailants as their user profiles. The entire incident has taken on a macabre viral quality and in online forums that track Russian military affairs and developments in Russia’s private military security sector, the incident at al-Shaer has emerged as a sort of touch stone for the social movement that has begun to coalesce around the Russian mercenary lifestyle online. How this movement will evolve over time is anyone’s guess, but if the growth of the online networks that bind Russian paramilitary groups together are any indication, it seems highly unlikely that the killing of Hamdi Bouta will mark the last time so-called Wagner Group operatives are implicated in war crimes in the Middle East, Africa, or other places where Russia is keen to gain a strategic foothold in the local energy sector.

The first challenge in conducting research on the individuals affiliated with Russian PMSC’s is to identify a starting point. While open source researchers and journalists have anecdotally identified dozens of individuals suspected of fighting in Ukraine and Syria on behalf of the Russian state the Kremlin has consistently maintained that many of the Russian citizens identified in media and research reports are merely patriotic volunteers. Beyond a few well-known commanders of Russian operatives who have fought in Donbas and elsewhere little is known about how military orders are issued and executed on. The information published to date about one-off cases where Russian operatives reportedly affiliated with the Wagner Group, therefore, only delivers a partial, pixelated picture of how Russian PMSC’s operate.

It is next to impossible under these circumstances to evaluate how much influence the Russian state exerts over Russian PMSCs much less establish whether through direct or indirect third-party means the Kremlin maintains effective control over Russian PMSC operatives. The opacity is intentional. The more confusion over whether the “Wagner Group” consists of a few hundred ragtag volunteers who elected without any enticement from Russian state organs, or indeed, whether the so-called Wagner Group is an organized private enterprise comparable to Western PMSC’s such as Blackwater or its successor the Frontier Services Group the more difficult it is to attribute actions to actors and assign responsibility for misdeeds on the battlefield.

If we don’t know for sure who is fighting for whom and we only know where Russian PMSC operatives are suspected to have fought then the only real clues available are publicly available images, videos and text that places PMSC fighters somewhere in time and space on the battlefield. In this respect, the case of Hamdi Bouta’s videotaped killing at the al-Shaer gas plant in Syria in the late spring of 2017 presented our team with a unique opportunity to begin publicly asking and answering questions about the types of training, tools and equipment deployed by Russian PMSC’s in the field.

Our collaboration with the Dossier Center and C4ADS in examining EvroPolis account and contract information also allowed us to connect the dots between Russian field operatives and the administrative architecture that supports them. In this way we were able to pursue two mutually revealing lines of inquiry: how to Russian PMSC’s do what they do when they are in the field and how are they paid to do what they do? To answer these questions, we set out to triangulate open source data about the business activities EvroPolis and other firms linked to Yevgeny Prigozhin, the titular chief executive of an array of Russian firms that support PMSC operations, against unstructured information contained in thousands of publicly available social media accounts of individual Russian PMSC operatives.

The data collected and analyzed for this report was drawn from a variety of open sources, including leaked data documenting the activities of EvroPolis LLC and related Russian companies in Syria acquired by the Dossier Center and shared with our team. A key document in this dataset detailed revenues and expenditures for EvroPolis LLC in 2017 and May-August 2018, which indicated revenue flows during those periods for the Jihar, Jazal, Mahr, and Shaer oil and gas fields, facilities, and proximate storage sites. International reporting about military operations involving Russian PMSC contingents at each of those sites in the Hayan Block has been extensive. Wherever possible we also cross-checked information contained in the Dossier dataset through a review of publicly available corporate registries, company filings, and corporate reports publicly released by EvroPolis LLC’s contractual partners Hayan Petroleum Company, Syrian Petroleum Company, and Ebla Petroleum Company and the foreign corporations who have participated in production sharing agreements and jointly won tenders from the Syrian government for energy sector exploration, development, and production.

We compared imagery from the Homs area captured by traditional media coverage of battles near Hayan Block energy infrastructure and social media from the Hayan Petroleum Company, Syrian Petroleum Company, Ebla Petroleum Company, and the social media accounts of EvroPolis employees and consultants indicated in Dossier Center data. An additional cross review of well-known Russian personalities who frequently cover and travel with Russian PMSC’s in Syria, including the pseudonymous “Ivan Siderenko” and Oleg Blokhin, a Russian war correspondent, and numerous Vkontakte community groups dedicated to coverage of the war also helped to support findings that Russian PMSC operators engaged in battle at Hayan Block sites managed under a partnership agreement between EvroPolis, Hayan Petroleum, Ebla Petroleum and the Syrian Petroleum Company, all of which are Syrian state backed entities.¹⁷¹

As noted in this report, Russian news outlets were among to identify Stanislav Dychko as one of the men pictured in the video of Bouta’s killing. Since information divined from Dychko’s Vkontakte social media account was used to identify him we reasoned that it was possible that other Vkontakte users in Dychko’s friends circle might provide clues about the identity of others in the video. But, because Dychko’s Vkontakte account was taken down soon after the media reports in November 2019 that suggested that was a dead trail. However, prior research for the first report in this series, Decoding the Wagner Group, allowed us to tap into a much larger dataset of Vkontakte accounts associated with verified Russian PMSC fighters that we had collected. We reasoned that it was possible that some of Dychko’s battlefield compatriots might have links to individuals in this dataset. In other words, we had to work our way backwards to Dychko’s likely friends circle by looking first for the haystack rather than the needle.

For this first step, our team relied heavily upon the work of the Conflict Intelligence Team and an OSINT researcher who uses the Twitter handle “NecroMancer” (@666_mancer). @666_mancer collected a data set of alleged employees of Russian military companies (especially the so-called Wagner Group) killed-in-action in eastern Ukraine and Syria. Heavily represented on his list were employees killed at the Battle of Khasham in the Euphrates River Valley south of Deir Ezzor. While the dataset contained a significant trove of useful information, the data entered was far from uniform and the dataset required significant cleaning.

On October 8, 2018, @666_mancer on Twitter posted two separate Excel spreadsheets titled “Gruz 200-Ukraine” (Cargo 200) and “Gruz 200-Syria” (Cargo 200). The “Gruz 200-Syria” dataset posting appeared nearly eight months to the day after news reports surfaced about a deadly clash between forces affiliated with the Wagner Group and U.S. Special Forces in early February 2018 near Deir Ezzor, Syria.¹⁷² The “Gruz 200-Syria” dataset purported to document the reported deaths of military operatives who were killed in action while fighting in Syria during the 2015-2018 period. While the data entered was not always consistently formatted or input, a six-month long manual review of each of the associated Vkontakte and Odnoklassniki accounts for the 300 plus individuals listed conducted by Russian linguists on our team corroborated much of the information indicated in the “Gruz 200-Syria” dataset (Dataset A).

After our manual review, we narrowed our focus to entries where an individual Vkontakte account was associated with a person reported as killed in action (KIA) in Syria, then cleaned and updated that dataset (Dataset B-Wagner KIA Syria), eliminating duplicate entries and entries where the information could not be verified. While this dataset is not necessarily representative of all Russian PMSC operators or military contractors reported or actually killed in Syria in the 2015-2018 timeframe, we found that there were sufficient visual and textual indicators in the social media data that we could be reasonably confident that many of the individuals listed had served in the Russian armed forces and likely fought and died in Syria.

This finding raised our curiosity about whether and to what extent there were existing social ties between the individuals whose names and Vkontakte accounts appeared in the KIA Syria dataset. As can be seen below in Figures A-1 and A-2, a crude analysis using Neo4J, a popular Java language graph database management system, indicated that there is a great deal of connectivity between many of the individuals in the dataset. Common profile data such as membership in thematic community groups known on VK as “clubs,” place of residence, school provided a sort of crude sorting mechanism for more precise segmentation of demographic data that allowed us to begin to estimate the median age of PMSC operators

This initial finding led us to theorize that it might be possible to focus in closer on the constellation of Vkontakte friends and followers linked to those in this dataset who—like those in the KIA data—openly displayed attributes and affiliations consistent with service in the Russian military and time spent in either Donbas, Ukraine or Syria or both, where Russian PMSC operators have been known to operate. After refining our methodology further through a series of reviews data contained in a set of several thousand Vkontakte user accounts associated with a Vkontakte microblog that tracks Russian mercenary affairs, we determined that it is indeed possible to identify smaller subsets of individuals who claimed to have fought in Donbas or Syria or both and who openly advertised their friendship ties.

The graph below (Figure A-3) represents data culled from that review that indicated a network of close first-degree friendship ties between Rusich commander Alexey Milchakov and several individuals who appeared to have posted photos with geocoordinates indicating their presence in the vicinity of the Hayan Block in Homs, Syria during the spring of 2016 and spring/summer of 2017 when forces loyal to Bashar al-Assad conducted major offensives to retake critical energy infrastructure.

Figure A-3 Graph visualization of Vkontakte friendship network between Russian operatives who expressed interest in Wagner Group operations and whose location, image, text and/or video data indicated they fought in Donbas, Ukraine and/or Homs, Syria during the 2014-2017 timeframe. Lines between nodes indicate VK users listed each other as friends. Key individuals identified in the report as having fought in Ukraine and Syria such as Vadim Isaeev (green node, middle right) have many mutual friends in common listed on Vkontakte.

The chart below (Table A) provides a basic overview of the areas of operation where so-called Wagner Group operatives provided security services in Syria. As indicated in widespread reporting by international press, the primary mission of many of the Russian PMSC contingents posted in Syria during Syria’s civil war was twofold: first, to protect energy industry infrastructure; and second, to train local militia and military units to fulfill offensive and defensive military missions that primarily covered areas in Homs, Aleppo, and Deir Ezzor governorates. Information about the placement of Wagner operativaves and Syrian militia counterparts was provided during Skype interviews conducted in the summer of 2019 with several Syrian energy and construction industry contractors based in the country. Additional details about specific project sites, parent company investors, and parent company executive leadership were cross-verified through a review of press reports as well as sanctions notices issued by the U.S. Department of Treasury’s Office of Foreign Asset Control and reported on by the Congressional Research Service as of January 17, 2020.

Table A- Russian PMSC Operations in Syria Company, Project, Local Militia Affiliation¹⁷³