How a Russian arms maker targets unknowing Canadian companies to get around sanctions

A Russian defence contractor sought to acquire electronics from two Canadian companies in a broader plan to skirt international sanctions and make weapons for the war in Ukraine, according to a leaked intelligence cache provided to CBC News.

Activist hackers who call themselves the Cyber Resistance and are linked to secretive sections of the Ukrainian government, exfiltrated data from the email account of an employee at St. Petersburg-based arms company Special Technology Center (STC), a supplier of unmanned aerial vehicles and weapons to the Russian war effort in Ukraine.

The cache contains internal STC documents, company emails, contracts worth millions of rubles and target lists of electronics made in the U.S., United Kingdom, China, Canada, Switzerland and Sweden, among others, that are needed to make their armaments.

According to a senior officer in the Ukrainian military with direct knowledge of the hacked materials, the hackers provided them with the information from STC.

"It has a huge value because we understand the Russians still produce high technological equipment," he said. CBC News has agreed to withhold his identity to prevent against threats from Russia.

At the outset of the full-scale invasion in 2022, Canada and its allies immediately imposed extensive sanctions against the Russian military industrial complex, including STC, making blanket bans on the export of microelectronics to Russia.

But the cache provides insights into how Russian arms makers source those technologies, normally unassociated with the business of war, from unknowing Western companies.

STC did not respond to a request for comment from CBC News about its pursuit of sanctioned technologies in Canada and abroad.

Russian supply lists revealed

In a June 2023 email exchange, the hacked STC employee discusses with a colleague a target "list of manufacturers" and an attachment with a spreadsheet of specific electronic components the employee needed to acquire for what the Ukrainian military believes to be for the production of Orlan unmanned aerial vehicles.

Considered one of Russia's most important military assets, the Orlan-10 model made by STC, is capable of cellular jamming enemy troops and gathering targeting and geolocation data for artillery barrages and missile strikes.

Named at the very top of that 2023 STC supplier list is EXFO, a Montreal-based tech company that has been noted by Prime Minister Justin Trudeau's office and says it has been a contractor for the U.S. Department of Defence. The component targeted on the list is a model of the Power Blazer, an EXFO multiservice test module. A separate Excel file shows a breakdown of the STC procurement plan that says the company was seeking two other pieces of testing equipment from EXFO.

According to a company spokesperson, Russia is on a list of countries EXFO is banned from working with. But the spokesperson did say the tech firm can't control if its products end up in those countries.

"EXFO also has no visibility to any potential alternate means of supply via other entities or countries."

EXFO was also clear that the Power Blazer model could not be used as a component inside a drone or vehicle, but did not elaborate more about its potential military applications.

Another spreadsheet in the cache focusing on "foreign-made components" associated with drone technology, lists resistors, transistors and capacitors made by global heavyweights like Texas Instruments and Panasonic, as well as a DC-DC power converter made by little-known Aimtec, a Montreal-based electrical parts manufacturer.

And it isn't the only mention of that company that STC is seen pursuing in the hacked cache.

A series of 2022 emails with a sales representative at Compel, a Moscow-based semiconductor company, shows the same STC employee buying 10 Aimtec DC-DC converters, using the arms manufacturer's front company, SMT-iLogic.

"Please invoice SMT-iLogic," said the STC employee to a Compel representative, while providing a delivery address in St. Petersburg. "10 pieces."

More emails from 2023 show Compel advertising other Aimtec products to the STC employee, but the employee doesn't appear to respond to buy more components. Aimtec is also mentioned in a separate disclosure, where some of its electronics were found inside Russian equipment by a Ukrainian government agency.

In a statement to CBC News, Aimtec said their products are not meant for military or aerospace applications and that they ensure all of their buyers comply with international export standards.

"Aimtec mandates all its distributors to respect U.S.-Canada Trade Compliance Regulations," said the company in a statement, adding that it strictly follows all U.S. and Canadian national security export regimes.

Russian companies circumventing international bans is a well established problem.

How exactly STC ultimately obtains Western parts from unwitting companies like EXFO and Aimtec involves a murky supply chain that exploits the use of front companies and distributors in Russian-allied countries to shield the sale of what appears, on the surface, to be the peaceful purchase of tech products.

Late last year, two Russian operatives were caught using a Brooklyn-based front company to help STC and other Moscow-backed companies to obtain electronics for its drones. STC is also known for its connections to the GRU, Russia's military intelligence agency, after aiding it in the hack of the Democratic National Committee in 2016.

The pro-Ukrainian hackers who stole data from STC also helped expose a Cuban mercenary network that was providing Russia with fresh manpower for the war.

"The last portion of information we received is that, unfortunately, Russia still uses different proxy companies, different proxy possibilities, to overcome the sanctions from the Western countries," said the Ukrainian military officer.

WATCH | How does Russia skirt sanctions? A Ukrainian officer explains:

Ukrainian officer explains how Russia gets around sanctions

7 hours ago

Duration 1:09

Serpen, an alias for a high-ranking Ukrainian soldier, explains how Russian arms companies use proxy companies to bypass Western sanctions.

Global Affairs Canada spokesperson Jason Kung maintained that Ottawa had already imposed heavy sanctions against Russia since the full-scale invasion began in February 2022, noting that new bans were made on all microelectronics that qualify as "military and dual-use goods and technology."

Kung pointed out that contravening Canadian sanctions is illegal, and both companies say they are fully compliant. There is nothing to suggest their parts have been knowingly provided for the production of STC products.

Corporate compliance needed: expert

Olena Bilousova, a senior research analyst at the Kyiv School of Economics who co-authored a report earlier this year on Western components in Russian weapons, explained that the murky, international networks that companies like STC rely on to source electronics are not impossible to dismantle.

She says it begins with Western governments holding companies responsible if one of their distributors defies sanctions and sells to an intermediary in another country that then passes the component to Russian arms makers.

"They should make their companies more responsible for not only conscious supplies, but also unconscious supplies."

Bilousova says if governments investigate companies found to be trading with firms known to be violating sanctions, it would force those companies to build better internal compliance policies.

She told CBC News the supply chain also greatly benefits from an emboldened China aiding its Russian ally.

According to Bilousova's analysis, many of the components sent to Russia pass through China.

Bilousouva suggested Canada should expand its sanctions list to target third-party companies in other countries that are acting as middlemen for Russia.

"Chinese component entities should be sanctioned," she said. "Canada can immediately sanction every company which is already sanctioned by other [allies and] coalition countries."

There is evidence in the cache of intermediary companies acting on behalf of STC in the global marketplace.

An August 2022 contract between STC and a Saint Petersburg-based shipbuilding company, one of the alleged front companies buying parts for STC abroad, spelled out that there were buys for "foreign components" from "the countries that applied sanctions against the Russian Federation," acknowledging its role in the scheme.

From the beginning of its invasion of Ukraine, the Kremlin and its intelligence agencies were seeking out everything from microchips to tank engine parts from sanctioned countries.

Zelenskyy casts doubts on sanctions

This is not the first time that Russia was singled out for obtaining western supplies for its range of Orlan drones.

In 2023, the Royal United Services Institute published a thorough study on the black market network that STC uses to import Western goods, making it clear that the "leadership of STC is largely composed of highly accomplished Russian military scientists" heavily linked to both the FSB, Russia's foreign intelligence service, and the GRU.

In January, at the Davos World Economic Forum, Ukrainian President Volodymyr Zelenskyy cast major doubts on the effectiveness of Western sanctions.

"In every Russian missile there are critical components from Western countries," he said, noting that though he was grateful for Western sanctions, they only work if countries ensure they work 100 per cent.

"Putin loves money above all," Zelenskyy told a mixture of world leaders and business elites.

"The more billions he and his oligarchs, friends and accomplices lose, the more likely he will regret starting this war."