Thousands of leaked emails and technical documents indicate that NTC Vulkan, a Russian information-security contractor founded in 2010 by former military officers Anton Markov and Alexander Irzhavsky, worked on projects connected to Russia’s security and intelligence services. The files, dating from 2016 to 2021, describe Scan-V, commissioned in May 2018, as software for finding weaknesses in systems that could be targeted by hackers. The documents also link Vulkan to the GRU-associated Sandworm group and, according to Google researchers, to Cozy Bear.
The leak further describes Amezit, a system Vulkan initially contracted to develop in 2016 for controlling and intercepting internet, wireless, and mobile communications. In 2018, employees connected with the project visited a Radio Research Institute in Rostov-on-Don linked to the FSB, although the source says it is unknown whether Amezit was deployed in Russian-occupied areas of Ukraine. A whistleblower opposed to Russia’s invasion gave the files to Süddeutsche Zeitung shortly after February 24, 2022; an international consortium published its findings on March 30, 2023. Five Western intelligence agencies and independent cybersecurity experts authenticated the documents, but the leak does not establish every alleged system’s operational use.