CheckFirst

This report demonstrates that the methodology we used in our previous investigation into the infrastructure of the FSB’s 16th Center is efficient and can be easily replicated in further research. We will continue our research into decorations linked to the GRU’s VIO, and will extend our investigations to other Russian security and intelligence services in the months ahead. Read the full report: https://checkfirst.network/ Contact us: info@checkfirst.network

Read our full #investigation 🔗 checkfirst.network/unveiling-g...
Subscribe to our monthly newsletter 🔗 checkfirst.network/newsletter/

Thanks for reading!

Navy-blue shield patch with orange border showing crossed sword, sealed scroll, three-flame grenade and psi-shaped arrowhead symbol, annotated explanations.

Blue infographic describing the Computer Network Operations department, insignia with diamond, lightning bolt and crossed swords, and Unit 74455 based in Khimki.

Blue report slide detailing the Encryption & Cryptanalysis Department, badge with crossed keys and three-flame grenade, and Unit 78430 location in Ekaterinburg.

Blue slide explaining the Psychological Operations Department insignia and Unit 54777 emblems, showing badges, an owl clutching a snake, and the Greek letter psi (which the central stem ends with an arrowhead).

Our visuals below provide you with a first glance at our findings, with examples of units featuring a comprehensive description of the VIO.

In 2025, we published a report delving into the infrastructure of the FSB’s 16th Centre, combining a one-year exploration of websites and forums specialised in insignia collecting and traditional OSINT techniques. Building on this initial study, and once again relying on the analysis of military decorations — known as phaleristics — we are now publishing a report focused on the Information Operations Troops (VIO) of Russia’s military intelligence service, better known by the acronym GRU.

Key findings graphic: 118 photos collected, at least 15 units identified, and 3 departments noted, set on a blue wave-patterned background.

🏅 We have gathered 118 photos from specialised websites and forums.
🗺️ We have concluded that the VIO is composed of at least 15 units across Russia.
🔎 These units are divided into three specialities: encryption/cryptoanalysis, computer network operations (CNO), and psychological operations.

Report cover showing a dark blue patch with crossed sword, arrow and scroll emblem, titled "Unveiling GRU's Information Operations Troops (VIO)"

🔴 𝗡𝗘𝗪 𝗥𝗘𝗣𝗢𝗥𝗧
Last year, we've been able to unearth the infrastructure of the FSB's 16th Centre, combining #OSINT techniques and photos of old medals. We replicated this method to explore the Information Operations Troops (#VIO) of #Russia’s military intelligence service (#GRU).

Rencontres de l'innovation éditoriale 2026 - 5 février 2026 à 08:30 - Paris - Yurplan

𝗜𝗡𝗙𝗢𝗥𝗠𝗔𝗧𝗜𝗢𝗡
📍 Pan Piper, Paris
📆 Feb 5th, 11:35 (panel discussion) and 15:00 (podcast recording) CET

Registration link 🔗 video-mobile.org/RIE2026/pro...
Programme 🔗 yp.events/fe97b31e-0b...

Hervé has also been invited to speak on the 'Propagations' podcast (hosted by @guillaumeled.it) for a second time! His interview will be recorded in public at the same event.

We invite you to attend @samsafr.bsky.social's 'Meetings of Editorial Innovation' and meet our CEO @herve.checkfirst.network. He will be taking part in a panel discussion on new security protocols alongside @cforissier.bsky.social (@contexte.com), Elodie Vialle and Carole Caumont (Samsa).

🛠️ Killing the supply chain: applying the IMS framework to Russian FIMI.

Any doubt on how?

🗓️ Thursday 22 January | 14:30 CET
Join our private webinar on building a common operational picture of FIMI.

🔗 Registration with a professional email address is required us06web.zoom.us/webinar/regi...

De l’Ukraine à l’Europe: la dimension cybersécurité de la guerre en Ukraine L’objectif de cet événement est d’échanger sur les enseignements stratégiques du conflit en Ukraine .

𝐈𝐍𝐅𝐎𝐑𝐌𝐀𝐓𝐈𝐎𝐍

📍 @maisoneuropeparis.bsky.social, Paris

📆 01/21, 6:00 PM - 9:00 PM (Paris time)

🔗 www.eventbrite.fr/e/billets-de...

The discussion will explore the following topics:

➡️ How #cybersecurity goes beyond its technical role in #cyberdefence to become its 'main battlement' ;

➡️ France's role in the construction of the EU's Democracy Shield ;

➡️ How EU regulations and norms help to reinforce EU digital sovereignty. ⤵️

𝑺𝒂𝒗𝒆 𝒕𝒉𝒆 𝒅𝒂𝒕𝒆!

Tomorrow, our CEO @herve.checkfirst.network will take part in a French-language panel discussion entitled '𝘍𝘳𝘰𝘮 𝘜𝘬𝘳𝘢𝘪𝘯𝘦 𝘵𝘰 𝘌𝘶𝘳𝘰𝘱𝘦: 𝘵𝘩𝘦 𝘤𝘺𝘣𝘦𝘳𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘥𝘪𝘮𝘦𝘯𝘴𝘪𝘰𝘯 𝘰𝘧 𝘵𝘩𝘦 𝘸𝘢𝘳 𝘪𝘯 𝘜𝘬𝘳𝘢𝘪𝘯𝘦'. ⤵️

👀 Read our blogpost to find out more about the role we played in that research: checkfirst.network/a-collective...

What if we adopted a common approach to documenting, attributing and responding to #disinformation campaigns?

Let's find out!

🔗https://www.disinfo.eu/building-a-common-operational-picture-of-fimi

Check First and IWF join forces to tackle illegal content - CheckFirst We believe that this partnership will only strengthen our shared commitment towards a safer internet, given IWF’s technology-led mission to prevent online child sexual abuse material.

This new partnership helps us to preserve the dignity of child sexual abuse victims and ensure our staff's safety during sensitive research.

Read our full statement 🔗 checkfirst.network/check-first...

Check First's logo on the left, Internet Watch Foundation membership's badge on the right.

🔍 As a company dedicated to analysing online harms, we strive to adopt the highest safety standards and abide by industry norms, especially when dealing with illegal and sensitive material pertaining to children. This is why we are proud to announce that we've joined @iwf.org.uk's membership!

Indeed! The official Check First newsletter - CheckFirst Subscribe to our newsletter and get a monthly recap of the latest news from CheckFirst straight in your inbox

We are already preparing for what’s coming next year and can’t wait to share it with the community. See you in 2026!

Make sure you don't miss our latest updates by subscribing 🔗 checkfirst.network/newsletter/

📫 The December issue of our monthly newsletter "Indeed" is out! We're looking back at 2025, a year full of new projects and investigations, fulfilling our objective to tackle #disinformation at its core.

Read this edition 🔗 r.crossover.social/3gr1lvvxzlx...

@herve.checkfirst.network, formerly COO, will be appointed CEO, ensuring continuity in our work to analyse digital ecosystems and counter information manipulation across Europe and beyond.

👀 More to come as we look ahead to 2026!"

Making the internet fairer, safer, and more transparent: same mission, new leadership.
After 5 years of growth, Check First enters a new phase of development: Guillaume Kuster is leaving to take on new responsibilities, after playing a central role in building CF & shaping its mission and approach.

👀 Join @sciencefeedback.bsky.social and @disinfo.eu on Thursday, 11 December to find out more about the first results of the #SIMODS consortium!

More about the SIMODS project 🔗 checkfirst.network/project/simo...

𝐈𝐍𝐅𝐎𝐑𝐌𝐀𝐓𝐈𝐎𝐍:
📍 Room 3E2, European Parliament, Brussels
📆 December 9th (13:00-15:00)

This panel (moderated by @aa.disinfo.eu from @disinfo.eu) is part of the European Parliament conference "Election Integrity and Foreign Interference in Romania, Moldova, and Poland: Is There A Better Way to Shield Our Democracy?". ⤵️

Tomorrow at 14:15 (Brussels time), Shivika Sharma, our senior manager specialising in digital threats and policy, will join a panel exploring policy, regulation and institutional response regarding disinformation in electoral context. ⤵️

Check First helps Armenian CSOs and journalists to protect election integrity - CheckFirst In partnership with the Folke Bernadotte Academy (FBA), the Swedish agency for peace, security and development, we spent a week in Yerevan, Armenia, helping Armenian civil society organisations and journalists strengthen their defences against foreign manipulation.

We thank again the FBA for this opportunity, and we will continue supporting CSOs and journalists as they pursue investigations into attempts to disrupt the elections!

checkfirst.network/check-first...

Oppi - Professional OSINT Training Platform Train journalists and analysts to identify disinformation campaigns with interactive scenarios and advanced OSINT tools.

During our workshops, participants were introduced to a range of #OSINT techniques and took part in a simulated investigation exercise using our oppi.tech platform.

A group of trainees huddled at a table with laptops and water bottles, discussing and reviewing material during a workshop with Hervé Letoqueux, Check First's COO.

🇦🇲 In partnership with the @fbafolke.bsky.social, the Swedish agency for peace, security and development, we spent a week in Yerevan, #Armenia, helping Armenian civil society organisations and journalists strengthen their defences against #foreignmanipulation.

Check the #SofiaIIF2025 programme to add this session to your calendar: sofia-info-integrity.eu/siif-2025/

Oppi - Professional OSINT Training Platform Train journalists and analysts to identify disinformation campaigns with interactive scenarios and advanced OSINT tools.

👋 We are pleased to announce that our COO @herve.checkfirst.network will be attending @sofiainfoforum.bsky.social this week. Don't miss his demonstration tomorrow at 6 PM (EET), when he will present our @radar.checkfirst.network framework and Oppi.tech, our FIMI training platform!

➡️ "Les Dessous de l'infox" by @rfi.bsky.social. Speaking to Sophie Malibeaux, Guillaume presented our framework @RADAR.checkfirst.network and explained how it can help to implement the #DSA.
🔈 www.rfi.fr/fr/podcasts...

À la rencontre de l'écosystème anti-désinfo Un épisode du podcast Propagations. Écouter, partager, s'abonner gratuitement depuis Podmust.

➡️ "Propagations" by @opsci.bsky.social. In this episode, @guillaumeled.it asked Hervé about his experience as a pioneer of the French #OSINT community.
🔈 podmu.st/5ytsq