Telegram, a global messaging app known for its emphasis on privacy founded by Pavel Durov, is facing new scrutiny after an investigation by Organized Crime and Corruption Reporting Project (OCCRP) and its Russian partner Important Stories. It revealed that the infrastructure routing its traffic is controlled by a Russian network engineer whose companies have previously worked with Russian intelligence and defense agencies.

Critical access controlled by Russian engineer

The investigation identifies Vladimir Vedeneev, a 45-year-old Russian engineer, as the owner of Global Network Management (GNM), which maintains Telegram’s servers and controls thousands of its IP addresses. Legal documents from a Florida court show Vedeneev had exclusive access to Telegram servers, signed contracts on its behalf, and even acted as its informal CFO under a power of attorney from Telegram founder Pavel Durov.

Vedeneev’s other companies — including GlobalNet and Electrontelecom — have provided services to Russia’s FSB, the GlavNIVTS computing center, and the state-run Kurchatov nuclear institute. Electrontelecom continues to assign over 5,000 Telegram IPs and manages surveillance systems used by the FSB in the St. Petersburg area.

Telegram blocks then unblocks chatbots used by Ukraine’s security services to get info on Russian activities

Metadata vulnerability through Telegram’s protocol

Despite Telegram’s claims of security, the MTProto protocol used in its encrypted messaging system includes an unencrypted “auth_key_id” element. Security expert Michał Woźniak explains that this allows anyone monitoring network traffic to identify a user’s device, IP address, and location even if the message content is encrypted.

Other experts, including John Scott-Railton of Citizen Lab, echoed these concerns, noting that metadata exposure could place users — especially those seen as threats by the Russian state — at serious risk.

Russian FSB has the keys to Telegram and Viber messengers and uses them for espionage — Ukrainian intelligence

Man-in-the-middle risk and physical infrastructure

A Ukrainian IT specialist said Russian forces used captured telecom infrastructure to conduct man-in-the-middle surveillance.

“In such an attack, the hackers aren’t even interested so much in the user’s correspondence,” he explained, “They get metadata to analyze… really, all possible information.”

Documents show that Vedeneev’s company owns a router inside the Telegram server room in Miami, and leases over 10,000 IPs to Telegram. Woźniak notes this allows potential access to user metadata, posing a major privacy concern.

Telegram’s founder under legal pressure

Telegram founder Pavel Durov, known for creating the VKontakte platform – the Russian clone of the early Facebook – and later launching Telegram in exile, is under judicial supervision in France over charges related to illegal content. Though he has denied any infrastructure in Russia or post-2014 visits, a leak showed over 50 trips to Russia between 2015 and 2021.

Politico: French investigation into Telegram’s founders reveals broader scope

Durov did not respond to OCCRP’s requests for comment. Vedeneev declined to publish his statements publicly.

Opaque partnerships and Russian state links

Vedeneev’s long-standing links to Russian state projects extend back to his partnership with Roman Venediktov, a former space forces officer and minority co-owner of GlobalNet. Their joint company, Peering, managed traffic for VKontakte through DATAIX and was acquired by GlobalNet in 2018.

The investigation also reveals that GlobalNet implemented Russia’s Deep Packet Inspection (DPI) system after the 2022 invasion of Ukraine, aligning itself with Roskomnadzor regulations.

“If someone has access to Telegram traffic and cooperates with Russian intelligence services,” said Woźniak, “this means that the device identifier becomes a really big problem — a tool for global surveillance of messenger users.”

Russian-linked hackers targeted U.K. Defense Ministry staff in an espionage operation while posing as journalists, Sky News reported on May 29, citing the British government.

The cyber attack was detected and thwarted, the government said.

Speaking to reporters at a government facility where a team had disrupted the Russian-backed operation, U.K. Defense Minister John Healey revealed the formation of a new cyber command tasked with managing both offensive and defensive cyber efforts.

"The nature of warfare is changing," Healey said, according to Sky News. "The keyboard is now a weapon of war and we are responding to that."

Western officials have warned about surging cases of Russian-linked cyberattacks and other hybrid operations, primarily targeting countres backing Ukraine against Russian aggression.

Earlier this month, London accused Russia's military intelligence (GRU) of a cyber campaign targeting Western logistics and technology organizations involved in delivering foreign assistance to Ukraine.

Similarly, the French Foreign Ministry accused a GRU-linked hacker unit of escalating cyberattacks against French ministries.

Both Ukraine and Russia have also employed cyberwafare as part of the full-scale war, targeting state institutions and companies providing critical services. The U.K. is part of the intarnational IT Coalition supporting Ukrainian cybercapabilities.

Stavropol explosion kills Russian official who led attacks on Ukraine’s Mariupol

Stavropol Krai Governor Vladimir Vladimirov confirmed Zaur Gurtsyev’s death, describing it as a “nighttime incident on Chekhov Street” without providing further details.

The Kyiv IndependentKateryna Denisova