iiinova — where your digital self keeps evolving

CheckFirst @checkfirst.network · 02/07/2026

𝗡𝗘𝗪 𝗥𝗘𝗣𝗢𝗥𝗧 🌉 𝗥𝗼𝘀𝗸𝗮 𝗕𝗿𝗶𝗱𝗴𝗲: how a pro-Russian IMS exploits vulnerabilities of decentralised platforms to spread propaganda 🔗 checkfirst.network/roska-bridge...

"Roska Bridge": How a pro-Russian IMS exploits vulnerabilities of decentralised platforms to spread propaganda.

134

CheckFirst @checkfirst.network · 11/06/2026

𝗡𝗘𝗪 𝗥𝗘𝗣𝗢𝗥𝗧 🇦🇲 In the month ahead of #Armenia's June 7 parliamentary #elections, we monitored how Russian information manipulation sets were targeting the vote, and what #TikTok and #YouTube’s algorithms were actually serving to French users searching for content about it.

Cover of CheckFirst's investigation "Noise without effect: anti-Pashinyan disinformation on the rise ahead of Armenian parliamentary elections", featuring Armenian flags, a picture of the Armenian National Assembly, and a man's silhouette.

283

CheckFirst @checkfirst.network · 29/04/2026

Today, we’re releasing the CheckFirst Import Connector on Filigran’s #opensource cyber threat intelligence platform, #OpenCTI. This connector is built to help track and monitor the #Pravda network. 🔗 checkfirst.network/checkfirst-...

The CheckFirst Import Connector landing page on the OpenCTI platform, behind CheckFirst, OpenCTI and Filigran logos.

062

CheckFirst @checkfirst.network · 07/04/2026

Want to know how #disinformation campaigns work? Come and see us at the Agora for #Journalism in Tours, France, on 9 April, where we'll be showcasing tutki.tech in a 90-minute workshop with @samsafr.bsky.social. Join us 🔗 journalisme.com/programmati...

'90 minutes dans la bataille informationnelle', a French language workshop set for April 9 in Tours, France, organized by CheckFirst and Samsa.

031

CheckFirst @checkfirst.network · 09/02/2026

Read our full #investigation 🔗 checkfirst.network/unveiling-g... Subscribe to our monthly newsletter 🔗 checkfirst.network/newsletter/ Thanks for reading!

This report demonstrates that the methodology we used in our previous investigation into the infrastructure of the FSB’s 16th Center is efficient and can be easily replicated in further research. We will continue our research into decorations linked to the GRU’s VIO, and will extend our investigations to other Russian security and intelligence services in the months ahead.

Read the full report:
https://checkfirst.network/
Contact us:
info@checkfirst.network

193

CheckFirst @checkfirst.network · 09/02/2026

Our visuals below provide you with a first glance at our findings, with examples of units featuring a comprehensive description of the VIO.

Navy-blue shield patch with orange border showing crossed sword, sealed scroll, three-flame grenade and psi-shaped arrowhead symbol, annotated explanations.

Blue infographic describing the Computer Network Operations department, insignia with diamond, lightning bolt and crossed swords, and Unit 74455 based in Khimki.

Blue report slide detailing the Encryption & Cryptanalysis Department, badge with crossed keys and three-flame grenade, and Unit 78430 location in Ekaterinburg.

Blue slide explaining the Psychological Operations Department insignia and Unit 54777 emblems, showing badges, an owl clutching a snake, and the Greek letter psi (which the central stem ends with an arrowhead).

151

CheckFirst @checkfirst.network · 09/02/2026

🏅 We have gathered 118 photos from specialised websites and forums. 🗺️ We have concluded that the VIO is composed of at least 15 units across Russia. 🔎 These units are divided into three specialities: encryption/cryptoanalysis, computer network operations (CNO), and psychological operations.

In 2025, we published a report delving into the infrastructure of the FSB’s 16th Centre, combining a one-year exploration of websites and forums specialised in insignia collecting and traditional OSINT techniques.

Building on this initial study, and once again relying on the analysis of military decorations — known as phaleristics — we are now publishing a report focused on the Information Operations Troops (VIO) of Russia’s military intelligence service, better known by the acronym GRU.

Key findings graphic: 118 photos collected, at least 15 units identified, and 3 departments noted, set on a blue wave-patterned background.

161

CheckFirst @checkfirst.network · 09/02/2026

🔴 𝗡𝗘𝗪 𝗥𝗘𝗣𝗢𝗥𝗧 Last year, we've been able to unearth the infrastructure of the FSB's 16th Centre, combining #OSINT techniques and photos of old medals. We replicated this method to explore the Information Operations Troops (#VIO) of #Russia’s military intelligence service (#GRU).

Report cover showing a dark blue patch with crossed sword, arrow and scroll emblem, titled "Unveiling GRU's Information Operations Troops (VIO)"

12719

CheckFirst @checkfirst.network · 22/12/2025

🔍 As a company dedicated to analysing online harms, we strive to adopt the highest safety standards and abide by industry norms, especially when dealing with illegal and sensitive material pertaining to children. This is why we are proud to announce that we've joined @iwf.org.uk's membership!

112

CheckFirst @checkfirst.network · 14/11/2025

🇦🇲 In partnership with the @fbafolke.bsky.social, the Swedish agency for peace, security and development, we spent a week in Yerevan, #Armenia, helping Armenian civil society organisations and journalists strengthen their defences against #foreignmanipulation.

A group of trainees huddled at a table with laptops and water bottles, discussing and reviewing material during a workshop with Hervé Letoqueux, Check First's COO.

193

CheckFirst @checkfirst.network · 27/10/2025

👋 On October 15 and 16, we attended #Disinfo2025, the @disinfo.eu's annual conference. This year, over 600 participants gathered in Ljubljana, Slovenia, for two days of discussions centered around many aspects of #disinformation.

#Disinfo2025 conference, before the overture panel.

142

CheckFirst @checkfirst.network · 08/10/2025

Next week, we'll be heading to Ljubljana to attend @disinfo.eu's #Disinfo2025! Shivika Sharma, our senior manager specialising in digital threats and policy, will present @radar.checkfirst.network during the “Turning data into evidence” roundtable on 16 October.

Shivika Sharma, Senior Manager, Digital Threats and Policy at Check First. She'll be speaking at #Disinfo2025 during a panel on 16 October.

171

CheckFirst @checkfirst.network · 18/07/2025

If you have any questions about this report, please write to us at info[a]checkfirst[dot]network. Thanks for reading!

While much remains to be explored regarding 16th Center's precise operations, this study paves the way for further research on Russia's security agencies operating in Russia and abroad, including those engaged in intelligence-gathering in Ukraine and European countries. Want to know more about this story? Contact us: info@checkfirst.network

020

CheckFirst @checkfirst.network · 18/07/2025

Each interception centre also has a unique way of depicting itself through its insignia, as can be seen in these two examples from our report.

Unit 03110 (1975): The oldest insignia linked to this unit features symbols such as tropical palms and a flag that confirm that it was previously stationed in Lourdes (Cuba), before being relocated close to Sotchi (Russia) in the late 2000s. Among the ten bases we have identified, this one is the only one that equipped its antennas with radomes designed to protect the equipment from weather and hide its orientation and specifications from unwanted eyes. These domes, which may contain a radar or a dish antenna, are even depicted on one of the unit's insignia, which also portrays the facility facing the sea, with mountains in the background.

Unit 61608 (1918): The unit's insignia frequently feature symbolic representations of Moscow, including the Kremlin. The unit hosts more than a dozen parabolic antennas near the T-shaped control building, as well as pole antennas arranged in an antenna array slightly further north. It is situated south of Tsaritsyno Park, concealed within a dense forest in the heart of Moscow.

231

CheckFirst @checkfirst.network · 18/07/2025

Thanks to phaleristics, we were able to gain insight into the unit's current symbolism.

How the 16th Center depicts itself: The standard format of the shield and sword, symbols inherited from the KGB ; The Russian coat of arms (a double-headed eagle clutching a scepter and an orb surmounted by a cross, representing imperial authority and the Orthodox Church, respectively) ; A red background, a colour traditionally associated with the FSB.

The Center portrays itself in two distinct ways: A terrestrial globe featuring the Russian Cyrillic letter "i". This letter is commonly associated with the Russian word "information" in Soviet and Russian security services, and could be a reference to the information the unit is capable of acquiring ; An antenna positioned next to a key being shattered by a lightning bolt. The antenna is a fairly common symbol of radio transmissions, but is also used to represent signals intelligence (SIGINT). The lightning bolt symbolizes the interception, disruption, and manipulation of enemy communications and radar systems. The key shattered by the lightning bolt is highly likely an explicit reference to cryptanalysis, the branch of cryptography dedicated to breaking codes and cryptographic systems.

121

CheckFirst @checkfirst.network · 18/07/2025

To unveil the infrastructure of the 16th Center, we employed a combination of unusual and traditional OSINT techniques. Our primary sources were hundreds of photographs of Russian insignia available on specialised websites.

For over a year, we have collected and analyzed hundreds of photographs of military insignia linked to the 16th Center of the Federal Security Service of the Russian Federation (FSB). We combined phaleristics (i.e. the study of medals, orders, decorations, and related honors issued by states, organizations, and military bodies) and traditional OSINT techniques to get insights into the history of the 16th Center, piece together part of its internal structure, and geolocate several of its interception centers within Russia.

During our research, we identified: 40 distinct insignia corresponding to different departments ("upravleniya") within the 16th Center. 10 departments within the 16th Center with at least 560 employees. 10 SIGINT stations composing a ground-based network highly likely operated by the 16th Center. These "Special Communications Centers" (TsSS) are designated either by a five-digit identifier or a number.

110

CheckFirst @checkfirst.network · 18/07/2025

Today, we are proud to publish our latest investigation into the FSB’s 16th Center, publicly accused of operating some of Russia's most sophisticated cyber-espionage groups. 🔗 checkfirst.network/decoding-se...

Cover of our research "Decoding Secrets With Medals: How Military Insignia Revealed Russia’s Hidden SIGINT Network"

11912

CheckFirst @checkfirst.network · 26/06/2025

🔴 NEW REPORT Alongside ‪@reset.tech‬, we publish our third investigation into Operation Overload. ⤵️

Our cover depicting "Operation Overload", featuring a blurry silhouette alongside screenshots and laptops.

164

CheckFirst @checkfirst.network · 29/10/2024

🗣️ "The goal of Operation Overload is to use you, the fact-checkers, to amplify their narrative." Today our CTO Amaury was in Brussels for the inaugural #EFCSNConference. He spoke to the fact-checking community about Operation Overload ( 🔎 checkfirst.network/operation-ov...).

031

CheckFirst @checkfirst.network · 29/02/2024

🇫🇮 On Wednesday, our CEO @g.checkfirst.network st.network met with Věra Jourová, Vice-President of the European Commission, presenting key lessons from our CrossOver project in Finland with @faktabaari.bsky.social. 📷 Alessandro Rampazzo/Copyright: European Union, 2024/EC - Audiovisual Service

011

CheckFirst @checkfirst.network · 16/02/2024

🔔 Save the date: 14 March. Join our CEO @g.checkfirst.network for an insightful webinar with @aa.disinfo.eu @disinfo.eu on the Finnish far right's presence and visibility on social media platforms in the lead-up to the country's presidential elections. 🔗 Sign up here: us06web.zoom.us/webinar/regi...

020

CheckFirst @checkfirst.network · 04/01/2024

As we embrace the onset of 2024, a year that holds the destiny of many with votes in at least 64 countries (plus the EU), the imperative for transparency and accountability from major platforms has never been more crucial.

000

CheckFirst @checkfirst.network · 10/11/2023

Yesterday our CEO Guillaume Kuster gave a talk at the OIF headquarters in Paris about our project CrossOver, and @obsint.eu. CrossOver tracks and measures the impact of content recommendation algorithms on social media. @obsint.eu offers guidelines for public interest #OSINT investigations.

043

CheckFirst @checkfirst.network · 12/10/2023

Best practices for #OSINT investigations, where to find them and how to apply them. Mattia Caniglia presents ObSINT guidelines. Very proud to have helped designing these guidelines for the community. Give us your feedback obsint.eu #Disinfo2023 @dfrlab.bsky.social

021

CheckFirst @checkfirst.network · 12/10/2023

@Meta identifies phases of an online operation which all present vulnerabilities allowing actors to act against malicious actors. #Disinfo2023

100

CheckFirst @checkfirst.network · 11/10/2023

Transparency is no silver bullet - John Albert, Algorithm Watch "Companies have been backsliding on particular commitments to transparency" #Disinfo2023

000

CheckFirst @checkfirst.network · 23/09/2023

➡️ Ethical and reliable #Osint ⬅️ Main takeaway from the presentation of the ObSINT guidelines our CTO @theal.bsky.social and @ineswnarciso.bsky.social did yesterday at #osintsummit2023

032