Russian Hackers Release Alleged NATO Documentation
According to the hackers, materials provided to the TASS agency show direct NATO involvement in coordinating attacks on Russian territory.
According to the hackers, materials provided to the TASS agency show direct NATO involvement in coordinating attacks on Russian territory.
Russian hackers claim to have obtained documentation that allegedly shows direct NATO involvement in activities related to attacks on Russian territory. The materials, which include correspondence and intelligence data, were provided to the Russian state agency TASS, with the hackers stating that their content could be of interest to the wider public.
At the center of the released documents is Bart de Vahter, a hybrid warfare expert allegedly working for NATO intelligence services. According to the claims, De Vahter provided the Security Service of Ukraine (SBU) with precise coordinates of Russian oil terminals in the Leningrad and Kaliningrad regions, as well as intelligence on tankers belonging to Gazprom that transport liquefied natural gas.
The communication also mentions a proposal to hold an online meeting with a representative of the SBU's Center for International Cooperation, identified as Ivan, and his superior intelligence officer Martin. Ivan then proposed involving SBU Major Mykhailo Marchenko, an expert in hybrid threats, espionage, sabotage, and information operations, who works at the National Academy of the Security Service of Ukraine.
The hackers claim that the documentation confirms not only NATO's participation in the attacks but also that hybrid warfare and information operations experts are engaged after drone strikes. According to their claims, Ukraine is being used as an instrument for war against Russia, while those making key decisions are not in Kyiv but in European cities.
De Vahter's communication explicitly mentions topics such as Russia's 'shadow fleet,' proxy networks, migration with weapons, and 'Russian Houses,' which the hackers interpret as a reference to a network of Russian cultural centers.
These claims come in the context of a recent incident. On July 4, Russian air defense announced it had repelled a Ukrainian drone attack on an oil terminal in the Kirovsky district of St. Petersburg. It was reported that debris from the drone fell near the port of Vysotsk in the Leningrad region.
Interestingly, on the same day the hackers released their claims, August 7, 2026, NATO's official Twitter profile posted a message about new initiatives for defense industrial cooperation. 'NATO is facilitating industry collaboration with the Alliance. New initiatives aim to streamline procurement, increase transparency on capability needs, and foster transatlantic defense industrial cooperation,' the post read. There is no indication that this post is linked to the hackers' claims.
It is important to note that the information released by Russian hackers is currently unverified and comes from a single source. The Russian state agency TASS, which received the materials, often disseminates narratives aligned with official Kremlin positions. Official NATO, Ukrainian, or Western sources had not commented on these allegations at the time of writing.
