"A reluctant agent." How a programmer thwarted his own FSB recruitment

A young systems analyst deceived the intelligence service, which installed spyware on his smartphone and tried to force him to spy on his friend.

In April 2024, the FSB detained systems analyst Kirill Parubets. He was accused of transferring money to Ukraine and threatened with life imprisonment. According to the security officers, the only way to avoid punishment was to agree to cooperate, namely, the detainee’s willingness to keep an eye on his friend, against whom another case of “high treason” was being prepared. However, Parubts managed to deceive the intelligence service and leave Russia, although the foreign passports of Kirill and his wife were confiscated by the security forces. “The First Section” tells how Parubets succeeded. A video version of the material is available here .

Ukraine: love, war

According to the census, in 2020, almost 900 thousand Russian citizens called themselves ethnic Ukrainians. This is exactly how the young programmer Kirill Parubets defined himself. His ancestors were from Chernigov, but he himself visited the neighboring country for the first time in 2015. But I immediately fell in love with Kyiv, and with Ukrainian culture, and with the Ukrainian language.

In 2020, Parubets worked as a systems analyst. The position did not require being in an office; one could live anywhere in the world, so Kirill and his wife Lyubov chose Kyiv as such a point. Having moved to Ukraine, they began volunteering - helping residents of Donbass, purchasing medicine, food and other necessary goods.

In February 2022, the Parubtsy went on vacation to Georgia. Putin's announcement of a full-scale invasion found them there. The vacation dragged on for several months. The couple returned to Kyiv in the summer, but encountered problems renewing their residence permit - for Russian citizens during the war this became almost impossible.

Tired of living like a bird, and with the risk of being detained, Kirill decided to obtain citizenship of Moldova, and then Romania, where he also had roots, but in order to fulfill this, he had to return to Russia and collect documents.

“ There were no problems entering Russia ,” Parubets tells the “First Department,” “We arrived by car through Georgia, through Upper Lars along the Black Sea. And then they lived quietly in Moscow. I slowly collected papers and continued to work at the same time.”

The day when the “quiet life” ended is April 18, 2024. At 6:30 in the morning, six masked men with machine guns burst into the apartment of Kirill and his wife. They ordered me to lie down on the floor.

The security forces took Kirill and Lyubov to different rooms. They started asking questions about transferring money to Ukraine. Kirill replied that he was involved in charity work and, yes, made some transfers. “Some transfers” were enough for the security forces.

Search

Immediately after the start of the big war in February 2022, the Prosecutor General’s Office stated that any assistance to Ukraine could be regarded as treason. The department assured that they would give “a legal assessment of every fact of providing financial and other assistance to a foreign state in activities directed against the security of the Russian Federation.” This statement meant that any transfer to Ukraine is already a risk. Even charitable transfers to humanitarian foundations could be declared “treason.”

Having heard what they needed from Kirill, the masked people showed a decree to inspect the premises, signed by a judge of the Moscow City Court. They quickly found the phone, knocked out the passwords with threats, and found correspondence related to Ukraine.

“Judging by how confidently they acted in the apartment, I got the impression that they had been there before ,” Parubets recalled in a conversation with a journalist from the “First Department,” “Or there was a wiretap there. Because they knew what was where, what and where to look. Very quickly they found a phone, a laptop, and the most important documents related to Ukraine. In general, they knew where and what was.”

Computers and phones were immediately confiscated. A politically motivated search almost always ends in the seizure of equipment. Firstly, this acts as economic pressure - after all, technology is expensive; secondly, sometimes the targets of security forces are the devices themselves. People in uniform may try to extract compromising information about a person from smartphones and computers; or install malicious software, and then return the device to the owner - and quietly spy on him. In the case of Kirill Parubets, the security forces, as it later turned out, were interested in exactly the second thing: to gain physical access to the device in order to install spyware on it.

Recruitment

At the police department, the spouses were forced to sign a statement that they had “disturbed public order in a public place since the morning”—at their home. The court quickly sentenced them to 15 days of arrest. The spouses were taken to separate cells and during the first week of detention they hinted in every possible way about the “worst consequences.” Seven days later, Kirill was taken from his cell for a conversation with FSB officers.

“Two employees in black suits and black suitcases in their hands,” Kirill recalls that day, “They say: hello, Kirill Vladimirovich, let’s go and talk. They had a huge folder with a printout of my Telegram chats ."

Parubets was informed that he was suspected of high treason for transferring funds to Ukraine. The term is up to life. Having voiced this, the security officers paused and continued. As they stated, they knew that Kirill had a certain friend, and this friend interested them very much. They said that they could put both of them in jail, or they could offer cooperation - Kirill would keep an eye on his friend and report “to the authorities” about everything he learns. Because this friend allegedly communicated with “dangerous” Ukrainians.

Parubets decided that at this moment he had to agree to work for the security officers, and then he would come up with something. A few days later, the same people in black suits brought a confidential cooperation and non-disclosure agreement. The parties shook hands and agreed that when the 15 days of administrative arrest expired, Kirill would contact them and receive new instructions. Three days later, Kirill and Lyubov were indeed released.

The security officers were sure that Kirill, frightened by the search and arrest, and most importantly by the prospect of a prison term for treason, would agree to everything. And they returned all the seized equipment to him. The first thing Kirill did at home was check on her. There was a strange message in the notification panel from ARM Cortex - this is the name of a series of processors for Android smartphones. Parubets scanned the device, but no malicious modules were ours. Then he went “deeper.”

“I “picked out” the code, saw that it was some kind of spy thing ,” recalls Parubets, “I was very interested in information security and knew that there was such a spy module called “Monocle.” According to the description, it was very similar to his before.”

Special Agent "Monocle"

In December 2016, Barack Obama, saying goodbye to his chair in the White House, introduced sanctions against Russia, which included the FSB, the GRU, and also a limited liability company under the unremarkable name “Special Technology Center.” In short - STC.

The press release on the White House website said little about STC - that the company assisted the General Staff in conducting electronic intelligence. However, journalists quickly found out the details. It turned out that the company is based in St. Petersburg and is engaged in the production of radio monitoring equipment and systems: it supplies the Ministry of Defense, the Ministry of Internal Affairs, the FSB and other departments with drones, cell phone signal suppressors and other special equipment.

Forbes soon found out that the leaders of STC are graduates of the Military Academy of Communications in St. Petersburg, and the director of the company is the winner of many awards from the Ministry of Defense, Alexander Mityanin.

In 2019, cybersecurity specialists from the Lookout company published a report from which it followed that the same St. Petersburg “Special Technology Center” had developed spyware called “Monocle” - a set of tools for compromising Android-based devices.

What can this software do? Quite a classic set of nasty things. In particular, it can provide an attacker with full remote access to the device.

Spyware disguises itself as popular services such as Skype and actually turns phones into listening devices. "Monocle" is capable of recording display images on locked phones, saving passwords, viewing auto-dialer dictionaries, as well as recording calls and listening to the microphone of an infected phone.

The “First Department” analyzed the archive that contained the program and came to the conclusion that Kirill Parubets actually had an assembly of the Monocle family of cyberspyware installed on his device.

Despite its impressive capabilities, programs of this kind usually do not attract the attention of owners of infected devices. Ordinary users, even if they notice something suspicious, do not know how to check their device for malware and how to isolate it for study. But in this case, the FSB contacted the wrong person: not only was it an IT specialist—the intelligence service knew about Parubets—but also an IT specialist who is interested in computer security.

Escape

Why did the FSB need Parubets at all? He is not Edward Snowden or Julian Assange, but the FSB already knew that he helped Ukrainians affected by the war. So why spy on him?

We believe that the operatives' plan could be as follows: one person is detained on charges of treason, threatened with a life sentence and forced to cooperate. When he agreed to everything, he is sent to collect information about a second person, against whom a case is also being prepared. And so that the newly minted informant does not warn his target and does not help her escape, the same “Monocle” is installed on his phone. Thus, the FSB collects solved cases as if in a chain.

If Kirill warns his friend, he will immediately find himself under criminal charges - people from Lubyanka will immediately find out about this. Simply removing spyware won’t work either - the FSB will immediately notice that the program has stopped responding to requests and sending intercepted data.

It seems that for Kirill there were only two options for the development of events: to work for the FSB and help them imprison a friend, or to imprison himself. But Parubets refuses both, and decides to flee abroad, although the security forces took the foreign passports of both him and his wife.

The “First Department” released several materials in which they explained why a second passport is needed. The story of Kirill Parubets and his wife is a clear confirmation of the correctness of such instructions.

Kirill himself had a second passport. My wife didn’t, but, apparently, the FSB was much less interested in her, and when she applied for a new one, none of the competent authorities paid attention to it.

The couple turned off their phones and bought a special device - a Faraday Cage - that isolates gadgets and does not allow them to be tracked. They acted according to instructions from human rights activists, did not pay with cards anywhere, used someone else’s car to escape, and crossed the border in a safe place.

As a result, the young man, who was recruited by the most influential intelligence service in Russia, who was accused of treason, and who had spyware installed on his smartphone, was able to escape from the country with his wife.

In the First Department video, Kirill himself tells his story. There is a smile on his face, he outwitted the security officers and saved his freedom and family.

What is happening now with the Monocle, which was discovered by journalists from many countries? It seems that the security officers continue to use it against themselves. We assume that the FSB is using spyware to control its own employees. Moreover, the mechanics of the Monocle are perfect for this.

But the story of this software as an effective spy on dissenters is also not over yet. Perhaps we will hear this word more than once in the context of the activities of the FSB. Journalists believe that there is also an iOS version of the Monocle, and iPhone users may be attacked with it in the near future.

If you encounter something similar or have recorded strange behavior of your gadget or applications installed on it, be sure to contact the First Department. We will help you understand what is happening.