Full Report
“In six months, you’ll go home, having received a pardon. (…) Those who come with us and on the first day say, ‘I ended up somewhere I shouldn’t have’, we’ll mark a deserter and execute. (…) You have five minutes to decide.” So said Yevgeny Prigozhin, self-confessed founder of the Russian private military company Wagner, […] The post How Wagner Gave Three Russian Crime Bosses from the 90s a New Lease of Death appeared first on bellingcat.
Analysis Summary
# Threat Actor: Wagner Group (PMC Wagner)
## Attribution & Identity
* **Identification:** Russian private military company (PMC).
* **Leader/Founder:** Yevgeny Prigozhin (self-confessed founder, reportedly an ex-convict).
* **Known Aliases/Associations:** Closely coordinated with Russian state structures, specifically the GRU and FSB (Russian security services). Labeled a "[transnational criminal group](https://home.treasury.gov/news/press-releases/jy1220)" by the US Treasury in January.
## Activity Summary
Wagner originated in Ukraine in 2014. It has risen to prominence following Russia’s full-scale invasion of Ukraine in February 2022, notably involved in the fierce battle for Bakhmut. Wagner operations have also been extensively reported in Syria, the Central African Republic, Libya, and Madagascar. In 2022, Wagner openly recruited convicts across Russia, promising them pardons after six months of service. Prigozhin confirmed in February 2023 that Wagner had ceased hiring convicts. Wagner fighters, including pardoned convicts, are reportedly receiving medals from President Putin for "heroism" in Ukraine.
## Tactics, Techniques & Procedures
* **Recruitment:** Conducted aggressive overseas and domestic recruitment drives, notably targeting Russian prison populations with promises of a pardon for six months of service.
* **Conflict Participation:** Deployed as a proxy force for the Russian state to fill gaps in military capacity, particularly in intense combat zones like Bakhmut.
* **Immunity and Legal Maneuvering:** Operates openly despite PMCs being technically illegal under Russian criminal code (Article 359); President Putin made statements suggesting Wagner does not break Russian law.
* **Post-Service Advocacy:** Prigozhin actively campaigned for legal protection for former convict fighters, calling for a ban on "discrediting" them or revealing their prior convictions, suggesting potential imprisonment for violators.
* [No specific MITRE ATT&CK IDs were provided in the text.]
## Targeting
* **Sectors:** Primarily military/conflict zones (explicitly mentioned in the context of 2022-2023 conflict). Historically functions to provide security and training to friendly regimes.
* **Geography:** Active in Ukraine (since 2014, notably 2022 invasion), Syria, the Central African Republic, Libya, and Madagascar. Recruitment of convicts occurred across Russia (e.g., Tyumen, Chelyabinsk, Kemerovo, Khanty-Mansi Autonomous Okrug).
* **Victims:** The primary "victims" mentioned are the convicts recruited, whose service terms may not always result in promised pardons, and the entities in conflict zones where Wagner operates.
## Tools & Infrastructure
* **Malware Families Used:** Not specified in the provided text.
* **Infrastructure (C2, domains, IPs):** While specific technical infrastructure is not detailed, coordination with Russian intelligence agencies (GRU/FSB) is noted. No URLs or IPs were provided to defang.
## Implications
Wagner serves as an deniable vehicle for the Kremlin to deploy mercenaries, fill military gaps, and execute operations the formal state apparatus cannot or will not. Their high-profile recruitment of convicts highlights a desperate need for manpower, potentially leading to internal legal/social complexity regarding released prisoners. The group's operational reach across multiple continents confirms its status as a significant, state-backed geopolitical tool.
## Mitigations
* Monitor information regarding the status and legal standing of Wagner personnel, especially pardoned convicts, to understand evolving support guarantees.
* Maintain vigilance against operations attempting to mask state aggression under the guise of an ostensibly "private" entity.
* Be aware of the group's global footprint when assessing risks associated with entities operating in Syria, CAR, Libya, and Madagascar.