Report: Ukraine Hackers Trick Russian Army Wives to Expose Kremlin Pilots Accused of Bloody Civilian Bombings

Russia’s 960th Assault Aviation Regiment is suspected of carrying out the devastating Mar. 16 2022 bombing of the Mariupol theater in which hundreds of civilians died.

by Stefan Korshak |

The 960th 960th Assault Aviation Regiment Wives /Photo: Inform

Ukrainian hackers hoodwinked a group of Russian military wives into posing for a risqué spouse calendar, in the process outing their husbands’ identities by accident and exposing twelve combat pilots in an elite Kremlin air force squadron to possible war crimes charges, reports published by a pair of leading Kyiv-associated civilian activist groups said.

InformNapalm, a leading public group which has supported the Ukrainian military with supplies and funds since 2014, and Cyber Resistance, a loosely-organized team of Ukraine hackers specializing in accessing Russian networks, retrieving and publicizing confidential information, gave details of a successful “virtual” false-flag operation.

InformNapalm produced a detailed report of how the Cyber Resistance activists, posing as Russian patriots, used a combination of social engineering tactics and brute force cyber-attack to hack closed Russian army data networks. In doing so they identified a woman living in Crimea as the wife of Colonel Sergey Valeriyvich Atroshchenko, commander of Russia’s 960th Assault Aviation Regiment.

The 960th is based in occupied Crimea and operates Su-25 ground attack aircraft. According to Ukrainian officials the regiment has conducted hundreds of air strikes on Ukrainian homes and businesses including the devastating Mar. 16 2022 bombing of the Mariupol theater, in which hundreds of civilians were killed.

On Mar. 28 Mariupol mayor-in-exile Petro Andriushchenko publicly accused the 960th by name for both the theatre bombing and that of a Mariupol maternity hospital a week earlier.

Multiple open sources confirm that the 960th regiment operates from Crimea to carry out air strikes in southern Ukraine. While it is undisputed that units of the Russian air force were responsible for the Mariupol bombings, the identity of who carried out the strikes is a military secret.

Russian state media reported, on Mar.  18, that President Vladimir Putin had signed an executive order designating the 960th as a “Guards” regiment because of its excellent combat performance in strikes along the southern front, without specifying target locations.

Alexei Moskalyov, who was sentenced to two years in prison on Mar. 28, for “discrediting” the Russian army, fled house arrest the same day and escaped to neighboring Belarus.

According to the InformNapalm report, the Cyber Resistance team, used faked Russian identities to pose as activists strongly supporting the Russian military and Russia’s invasion of Ukraine. Having identified Ms. Antroshchenko, they contacted her and convinced her to organize a photo shoot for herself and eleven other squadron wives to produce a pin-up calendar to boost the morale of military families and army supporters.


It is Russian military tradition, that the wife of a unit commander has substantial sway over “lower-ranking” spouses in the unit, particularly in matters of military families and the provison of morale-boosting support for men in the ranks.

A group shot within the calendar showed the twelve spouses wearing their husbands’ dress tunics bedecked with medals, with an Su-25 strike jet in the background. Ten wore high heels and half of the women paired the air force jacket with ultra-short skirts or thigh-high exercise tights.

It was not possible to independently confirm InformNapalm’s and Cyber Resistance’s account of what amounted to a highly successful false flag operation targeting the Russian military. However, both confidential official and social Russian content published by the Ukrainian activists was fully consistent with similar material viewed by Kyiv Post.

Other sensitive Russian military materials published in the report included the names, ranks, home addresses, passport numbers and personal contact information of the husbands of the wives and other pilots, as well details of individuals found to have collected salaries after leaving air force service, manuals for Russian military air search and air traffic control procedures, and operating instructions for the Russian air force Fazenda-T air search radar.

In its Telegram channel, Cyber Resistance claimed it had also hacked Colonel Antroshchenko’s personal  archives within the Russian Ministry of Defense, gaining access to the regimental records including pilots performance evaluations, officer records, bulletins, memos, and operational planning documents, including a 16-page text and slide presentation on improving Russian air force interceptor tactics against NATO AWACS aircraft.

Personal details published included 14-digit coordinates of Atroshchenko’s home, and images of passport photographs seeming to show that Antroshchenko was born in Ukraine’s northern Ovruch region and moved to Russian-occupied Crimea in 2016, two years after the Russian illegal annexation of the peninsula.

The InformNapalm report also published two photographs of Ms. Atroshchenko posing in a bikini with the comment she “liked to send ‘photo surprises’ to her husband”. Cyber Resistance said the published material represents only a fraction of the confidential content now in Ukrainian hands.

Stefan Korshak

Stefan Korshak is the Kyiv Post Senior Defense Correspondent. He is from Houston Texas and is a Yalie. He has worked in journalism in the former Soviet space for more than twenty years, and from 2015-2019 he led patrols in the Mariupol sector for the OSCE monitoring mission in Donbass. He has filed field reports from five wars and enjoys reporting on nature, wildlife and the outdoors. You can read his blog about the Russo-Ukraine war on Facebook, or on Substack at, or on Medium at


Enter comments here: