🏠 TI-2026-042N — The Rostelecom Shadow: BGP Hijacks and State Espionage

I. Rostelecom: State Telecom, State Tool

PJSC Rostelecom (AS12389) is majority-owned by the Russian government through VTB Bank and Vnesheconombank. It provides:

• Internet access to Russian government agencies
• SORM compliance (System for Operative Investigative Activities) — giving FSB direct wiretapping access
• Backbone infrastructure for Russian internet

15 IPs, 121 honeypot hits, average threat score 53 — the highest average of any state telecom in our database.

II. BGP Hijacking History

Our OSINT documents Rostelecom's BGP hijacking incidents — where Rostelecom announced routes for IP prefixes belonging to other organizations, effectively redirecting internet traffic through Russian infrastructure. BGPMon, ZDNet, and MANRS documented these incidents. BGP hijacking allows traffic interception, surveillance, and man-in-the-middle attacks at national scale.

A telecom that hijacks BGP routes can intercept ANY traffic — including traffic containing children's personal data from platforms like SchoolBridge. A telecom with SORM can provide that data directly to state intelligence services. The infrastructure for mass surveillance and the infrastructure for exploitation are the same infrastructure.

III. The domolink Connection

Hostname 109-126-203-167.domolink.elcom.ru — Rostelecom infrastructure. This IP deployed malware (SHA-256 hashes documented in TI-2026-017). "Domolink" = "домолинк" (home link). Elcom is a Rostelecom subsidiary. A state telecom's home broadband service deploys malware captured by our honeypot.

IV. SORM: When the State IS the Surveillance

Russia's SORM system requires all Russian telecoms to install FSB-accessible equipment that provides direct access to communications without a court order. Unlike Western wiretapping (which theoretically requires judicial oversight), SORM gives the FSB direct, unsupervised access to all traffic.

When Rostelecom IPs carry exploitation-coded credentials, the FSB — through SORM — has visibility into that traffic. They can see the credentials. They can see the targets. They can see the operations. And they have chosen to do nothing — or chosen to use what they see.

VII. The State That Shops for Children Online

Before we discuss BGP hijacks or SORM surveillance or Rostelecom's 18 honeypot nodes — before any of the technical analysis — we must state what Russia IS in 2025:

This is what runs on Rostelecom's infrastructure. This is what AS12389 carries. The same network that produced 18 IPs attacking our honeypot also hosts a website where stolen children are browsed like products.

VIII. The Mechanics of State Child Abduction

How Russia acquires children for its catalogue:

• Parents arrested by occupation authorities — children become "orphans" by state decree
• Parents killed in invasion — children collected from war zones
• Children separated from parents in active combat areas
• State institutions raided in occupied territories — children taken wholesale
• "Summer camps" on Russian territory — children sent for "vacation", never returned
• Forced adoption into Russian families — Russian citizenship assigned, identity erased
• Russification — language, culture, name changed (constitutes genocide if intent proven)

This program began in 2014 — the first year of the Russo-Ukrainian war. It is not a response to 2022. It is a decade-long systematic program of child acquisition. The internet catalogue is merely the digital maturation of what began as physical abduction.

IX. Rostelecom: 18 Nodes, One State Weapon

PJSC Rostelecom (AS12389) — Russia's state-owned telecommunications company — produced 18 IP addresses in our honeypot:

Rostelecom is not a private company that happens to be used for attacks. It is a state weapon that happens to also provide internet service. The same network that Putin uses to operate a child selection catalogue also probes global SSH infrastructure. One entity. No separation of functions.

X. SORM: The FSB Lives Inside Every Russian Telecom

Our OSINT Library (WikiLeaks Spy Files) documents PROTEI Ltd — a St. Petersburg company manufacturing lawful interception equipment for SORM compliance:

PROTEI equipment feeds FSB. Rostelecom carries the traffic. The state sees everything, attacks everyone, and distributes stolen children through the same infrastructure. The Spy Files document the surveillance equipment sold globally — but in Russia, it's not exported. It's deployed at home.

XI. APT28/Fancy Bear: GRU Military Intelligence on the Same Wire

Our OSINT Library contains YARA detection rules for APT28 (GRU Unit 26165):

One network. Four simultaneous functions:

1. Child exploitation — internet catalogue for selecting Ukrainian children
2. Mass surveillance — SORM/PROTEI/FSB real-time interception
3. Military espionage — APT28/GRU Unit 26165 operations
4. Global SSH attacks — 18 IPs probing our honeypot

XII. ER-Telecom and Digit One: The Supporting Cast

Beyond Rostelecom, two other Russian entities demonstrate the pattern:

Commercial ISP (ER-Telecom) and private hosting (Digit One) — both carrying coordinated attacks, both SORM-monitored, both operating in a state where the boundary between private and government does not exist.

XIII. The Eastern European Trafficking Factory: Russia as Origin

Our OSINT Library (Sex Slaves: Human Trafficking) documents:

"Since the fall of Communism, poverty, prostitution and crime have continued to thrive in Eastern Europe. With ties between organized crime and law enforcement being so strong, corruption gives way to lawlessness, and the vulnerable become victimized. Human trafficking, in particular its connection to the sex slavery industry, is an ever-increasing problem in countries such as Albania, Kosovo, Moldova, Romania and Serbia."

Russia is the ORIGIN of this post-Soviet collapse. Russian organized crime networks — which share personnel with Russian intelligence (documented extensively) — operate trafficking routes across ALL these countries. The same state apparatus that launched 18 honeypot attacks from Rostelecom also:

• Created the post-Soviet conditions that enabled Eastern European trafficking
• Operates organized crime networks that RUN the trafficking
• Provides telecoms that CARRY the trafficking communications
• Monitors victims via SORM who try to escape or seek help
• Now conducts DIRECT state child abduction (Ukraine, 19,000+ children)

XIV. The Qualitative Shift: From Weak States to the State as Predator

The 042 series has documented a pattern: exploitation thrives where states are weak or corrupt (Kosovo, Indonesia, Belgium's failures). But Russia represents something different:

XV. The Cyber Conflict Question: What the Research Actually Found

Corrected 2026-09-26. An earlier version of this section claimed, citing our OSINT Library, that Russia integrated cybercrime actors into state operations during the Ukraine invasion — DDoS up 30-fold, criminals recruited into state campaigns, no boundary between criminal and state. The cited document is Vu et al., "Getting Bored of Cyberwar" (Cambridge, Strathclyde, Edinburgh; arXiv:2208.10629), and it found the opposite:

• The invasion "briefly but notably" drew low-level cybercrime actors: defacement and DDoS attacks against both Russia and Ukraine rose significantly in the first weeks
• Their involvement was "short-lived and fleeting", with a clear loss of interest after a few weeks
• Their role in the hybrid war was "minor", and they "should be separated from persistent and motivated 'hacktivists' in state-sponsored operations"
• The paper reports no 30-fold figure and no recruitment of these actors into state-directed campaigns

What this dossier's own data shows is narrower: the same infrastructure serves both state and "private" users (Rostelecom, ER-Telecom for state; Digit One for "private"). Shared infrastructure is documented here; operational integration of criminals into state campaigns is not. The trafficking parallel (Sex Slaves) stands on its own evidence and is not proven by the cyber-conflict research.

XVI. Sources and Methodology