🕵️‍♂️ Secret Russian spy unit exposed by shiny medals — Finnish OSINT team cracks FSB’s cyber ring

In a unusual discovery, a group of researchers in Finland has uncovered new information about a highly secret Russian spy unit. But they didn’t do it by hacking or spying. Instead, they studied small, shiny medals called commemorative badges that are sometimes handed out in secret military and intelligence circles.

A strange discovery reveals a top-secret spy group

These badges, also known as challenge coins, are used by government or military units to mark special events, honor services, or build team spirit. Although they seem simple, they often have hidden clues—like logos, maps, and numbers—that can reveal more than expected.

The researchers who made this discovery belong to an investigation team called CheckFirst. This group uses open-source intelligence or OSINT. This means they collect data from things anyone can see online—like photos, websites, and public records. They don’t break into systems or steal secrets. They simply observe what’s already out there, just like putting puzzle pieces together.

Earlier this month, CheckFirst released a 36-page report titled “OSINT & Phaleristics: Unveiling FSB’s 16th Center SIGINT Capabilities.” It focused on Center 16, also called Military Unit 71330, which is part of Russia’s FSB—the country’s main intelligence agency. This secretive unit is believed to be responsible for cyber spying, both in Russia and abroad.

Challenge coins tell a bigger story

Challenge coins are not new. They first became popular in the U.S. military during World War I and became common during the Vietnam War. Today, they are used in different countries for similar reasons—to honor and motivate.

Many of these coins are eventually sold on public websites like eBay. Others are shown on coin collectors’ pages or manufacturer websites. Because of this, researchers were able to track down several Center 16 challenge coins on Russian websites like GosZnak, SpetsZnak, and Breget—places that make or sell these coins.

But these coins were more than simple souvenirs. They carried signs, codes, maps, and other marks that the CheckFirst team examined closely. Through this unique approach, the researchers discovered far more than expected.

They found that Center 16 is not just one large team. It has at least 10 different smaller directorates, or sections, that each focus on different parts of cyber operations. This includes both defense and offense—meaning they protect Russian data but also try to steal or spy on information from others.

Before this research, only one part of Center 16 had been identified in the public domain. This means the world didn’t know much about how this unit operated. Now, thanks to these challenge coins, the public has a much clearer picture of what Center 16 actually does.

Clues reveal locations of secret spy centers

The coins did not just reveal how the group was organized. They also gave clues about where these secret operations take place.

Some of the coins had tiny maps, numbers, or symbols that gave away geographical hints. Using these visual indicators, the researchers could figure out where nearly a dozen interception sites or spy centers were located across Russia.

Shocking GDPR Complaint Exposes TikTok, WeChat, and AliExpress Over User Data Control

These centers are believed to play a role in gathering intelligence from other countries. They may tap into communications, track online activity, or collect digital data.

The CheckFirst team’s report was able to highlight how a small, overlooked item like a badge can lead to powerful discoveries. These shiny coins, designed to boost morale and honor service, ended up giving away details about one of the most secret groups in Russian intelligence.

Their work proves that even small things can have big meanings—and that, in the digital age, almost nothing can stay fully hidden.

Mohit Kumbhar
Mohit Kumbharhttps://www.linkedin.com/in/mohitkumar99/
Mohit Kumbhar is the editor of Newsinterpretation. He edits the site’s news coverage and writes on artificial intelligence, AI search and how publishers become visible to AI assistants such as ChatGPT, Claude, Gemini and Perplexity. He also writes about NI Geovanta, the AI visibility tool for WordPress developed by Newsinterpretation.

TOP 10 TRENDING ON NEWSINTERPRETATION

Cyber Attacks on Space Infrastructure: Satellites, GPS and the Ground Systems Behind Them

From the Viasat KA-SAT hack to GPS jamming over the Baltic, a research guide to how attackers target satellites, navigation signals and ground stations, and why it matters on Earth.

How AI Agents Are Used in Cyber Attacks: From Assisted Hacking to AI-Orchestrated Espionage

Attackers now use AI agents to scan networks, write exploits and run extortion campaigns. A research guide to documented cases, including the first reported AI-orchestrated espionage campaign, and what defenders should do.

Cyber Attacks on AI and LLMs: How Attackers Target Large Language Models

Prompt injection, data poisoning, model theft and jailbreaks: a research guide to how attackers target AI systems and large language models, with real cases and defences.

French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives

In October 2026 attackers heated refrigeration cabinets in hundreds of French supermarkets to as much as 50°C. No one was hurt, but the attack shows how hacking the cold chain can endanger lives through fire, food poisoning and spoiled medicines.

Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps

Stuxnet, the Davis-Besse worm and malware at India’s Kudankulam plant: what they show about cyber risk at nuclear facilities and the limits of air gaps.

Triton: When Hackers Target the Safety Systems That Prevent Industrial Disasters

The 2017 Triton attack targeted the safety systems that prevent industrial disasters. What happened, who was charged, and how plants protect their last line of defence.

Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails

How connecting traffic control, emergency alerts and utilities concentrates cyber risk in cities, what the Dallas and Atlanta incidents showed, and what governments recommend.

Weaponized Drones: Hijacking, GPS Spoofing and Emerging Cyber Warfare Risks

How drones can be hijacked, jammed or misled by GPS spoofing, what researchers have demonstrated, and why governments treat drone fleets as a security risk.

Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk

How ransomware against hospitals and their suppliers delays care and endangers patients, what the Düsseldorf and WannaCry cases show, and what research says about deaths.

Operational blunder exposes massive Russian cyber espionage attack on Ukrainian prosecutors

A major cyberattack has compromised the email accounts of...

Cyber Attacks on Space Infrastructure: Satellites, GPS and the Ground Systems Behind Them

From the Viasat KA-SAT hack to GPS jamming over the Baltic, a research guide to how attackers target satellites, navigation signals and ground stations, and why it matters on Earth.

French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives

In October 2026 attackers heated refrigeration cabinets in hundreds of French supermarkets to as much as 50°C. No one was hurt, but the attack shows how hacking the cold chain can endanger lives through fire, food poisoning and spoiled medicines.

Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps

Stuxnet, the Davis-Besse worm and malware at India’s Kudankulam plant: what they show about cyber risk at nuclear facilities and the limits of air gaps.

Triton: When Hackers Target the Safety Systems That Prevent Industrial Disasters

The 2017 Triton attack targeted the safety systems that prevent industrial disasters. What happened, who was charged, and how plants protect their last line of defence.

Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails

How connecting traffic control, emergency alerts and utilities concentrates cyber risk in cities, what the Dallas and Atlanta incidents showed, and what governments recommend.

Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk

How ransomware against hospitals and their suppliers delays care and endangers patients, what the Düsseldorf and WannaCry cases show, and what research says about deaths.

FBI warns of AVrecon malware targeting outdated routers linked to proxy based cybercrime

A serious cybersecurity warning has been issued regarding commonly...

Related Articles

Popular Categories