Ukrainian cyber activists have uncovered a large-scale scheme enabling Russian profiteering in temporarily occupied territories, based on leaked correspondence from Russian ministries.

The findings were obtained by the 256 CyberStorm group and analyzed in collaboration with the InformNapalm investigative community.

Cyber activists gained access to internal data from around 200 Russian companies involved in a so-called Special Infrastructure Project.

Disguised as a reconstruction initiative, the project appears to serve as a mechanism for channeling Kremlin state funds to business entities closely linked to the Russian government.

Organizations and companies that are allowed to “restore and construct facilities within the framework of the Special Infrastructure Project.” Photo credits: InformNapalm

An analysis of the obtained data, conducted by InformNapalm, revealed that behind the high-profile official projects lies a complex network of contractors and shell companies used to conceal the real beneficiaries – major Russian businesses evading international sanctions.

This system allows the Kremlin to launder state funds, effectively turning war crimes and looting into a profitable enterprise.

The coordination of this process is overseen by a special department established in May 2022 under the Russian Ministry of Construction, tasked with implementing the so-called Special Infrastructure Project.

However, no genuine reconstruction is taking place – the funds are redistributed among Russian companies, workers are brought in from Russia, and the local economy sees minimal benefit.

Building company Sirius is a one-day company from R-Stroy. Photo credits: InformNapalm

The documents obtained by the hackers contain two primary lists: companies approved by the Russian Ministry of Construction to operate in the occupied territories, and contractors affiliated with the Territorial Development Fund.

Among those exposed are companies that conceal their involvement through subsidiary firms. For instance, LLC R-Stroy, linked to oligarch Alexey Repik, has appeared in several high-profile investigations. Officially, it is carrying out work in occupied Makiivka and Mariupol via a one-day subcontractor based in Crimea with a minimal staff presence.

The company’s contracts include detailed information about the scope and locations of the projects, as well as clear indicators of how the funds are being utilized. On the Russian state budget side, the client is the public-law company Unified Developer (Единый заказчик), while R-Stroy acts as a first-tier contractor.

Investigators emphasize that most of these companies have close ties to the Kremlin, making them difficult to replace within the scheme. At the same time, only a small fraction are currently under sanctions, significantly complicating efforts to counter their operations and hold their official representatives accountable.

Militarnyi previously reported that the Russian forces had begun conscripting young men from the temporarily occupied territories of Ukraine for military service.