Tracking the Faceless Killers who Mutilated and Executed a Ukrainian POW

Editor’s note: this article contains descriptions of sexual violence and murder which readers may find disturbing. 

On July 28, a series of horrifying videos circulated on pro-Russian social media which depicted an act of sexual violence and execution of what appeared to be a Ukrainian prisoner of war. Bellingcat has not linked to these videos due to their extremely graphic nature.

The three videos (hereafter ‘the violent videos’) were initially posted on a Russian telegram channel whose name translates as ‘Cargo 200, death to Ukrainians’, which extolls casualties among Ukrainian armed forces. The videos were subsequently reposted on the popular Rosich Telegram channel run by a nationalist Russian mercenary group.

The videos were initially celebrated by the channel administrators and most of the commenting users, until several hours later they were suddenly disowned by the same as “likely forgeries”, allegedly planted in the pro-Russian channels by agents of Ukraine aiming to discredit the Russian army.

A description of the act in the videos, which each show a part of the same sequence of events, follows in the closed drop-down box below.

Description of the Three Videos (Caution: disturbing content)

The footage shows a soldier approaching a figure wearing Ukrainian military fatigues and the blue and yellow patches worn by Ukrainian servicemen. The identity of the victim, whose face cannot be seen clearly in the videos, remains unknown.

In the first video, two accomplices were seen restraining the man while the cameraman and a man in a cowboy hat looked on.

In the second video, the presumed Russian soldier in the cowboy hat then castrates the captive, who is mocked by the group of soldiers watching.

In a third video, the captive is executed with a gunshot to the head, presumably by the soldier in the cowboy hat.

In recent days, journalists and open source researchers have sought to identify the culprits of this apparent war crime, with mixed success. Several incorrect identifications of the man who committed the act – a soldier wearing a cowboy-style hat – were made by various media outlets and individuals online. 

Bellingcat researchers have reviewed the footage, which does not contain visible signs of editing or tampering. However, the authenticity of the videos cannot be validated with purely technical means due to the low resolution of the video and the absence of metadata.

Bellingcat’s investigation into visual clues in the videos using the available open source evidence corroborates the authenticity of the three violent videos and indicates that fighters from ‘Akhmat’, a Chechen paramilitary formation serving with the Russian armed forces in Ukraine, were present at the scene of the murder.

The link to ‘Akhmat’ was uncovered while investigating a man who appeared in multiple news broadcasts about the group who wore the same distinctive hat, bracelet and military fatigues as seen worn by one individual in the mutilation video. Several visual clues in these news broadcasts also suggested that they could have been filmed near, and in the same time frame, as the murder videos, including one filmed at the same location in July of this year.

The identity of the individual who wears the cowboy hat in the videos of the ‘Akhmat’ fighters is known to Bellingcat. However, Bellingcat has obscured his image and name as while there are numerous commonalities, the face of the alleged perpetrator cannot be clearly seen in the videos of the act itself.

Bellingcat contacted this individual to offer him a right of reply. In a conversation with reporters, he acknowledged that he had been deployed to Ukraine as a member of the ‘Akhmat’ group, and that he was “the man in the cowboy hat” seen in the news broadcasts. While he denied that he appeared in the mutilation and execution videos, he did confirm that he had been detained and questioned by the Russian security services over the footage, who had told him that it actually depicted Ukrainian soldiers mutilating one of their own comrades.

Geolocation of the Footage

Using evidence from the three violent videos and additional footage of the ‘Akhmat’ fighters, Bellingcat was able to geolocate the footage to the Pryvillya Sanatorium in the Luhansk region of eastern Ukraine. A key clue was provided by the ‘Akhmat’ fighter in the cowboy hat contacted by Bellingcat, who stated that the FSB had told him that the violent videos had been filmed in Pryvillia, a town near Lysychansk in Ukraine’s Luhansk Region. The general area came under Russian control in early July.

YouTube footage of an October 2021 motorcycle ride through the sanatorium grounds showed specific details which were distinctly visible in the violent videos.

Composite of the features visible in the violent videos matched with the same details in various reference materials.

Firstly, a tree which split into two main branches was another important detail to confirm the location. This tree, as well as its position relative to a nearby manhole, matched with the background of the violent videos.

Comparison of reference video (left) scenery with background in violent videos (right).

Furthermore, both the violent videos and the reference footage showed the same elevated structure with a manhole cover, distinctive rocks and uniquely shaped and damaged curbs. One curb was particularly noticeable due to its triangular shape.

Comparison of curbs in the violent videos (left) and reference video (right).

Although blurry in the violent videos, the building in the background matched reference images of the section of the sanatorium with its grey base, pinkish hue, and window type. A stitched image made up of frames from the execution video showed that the building could be seen down the pathway in the wooded area which separates the two roads running behind the sanatorium complex.

Comparison between scenes visible in the violent videos (left) and satellite imagery (right), denoting camera direction facing the north building of the sanatorium.

The ‘Akhmat’ group and a man with a cowboy hat were previously filmed at the sanatorium in a video uploaded to “Investigations and Portraits”, a YouTube channel run by the Russian journalist Andrey Guselnikov on July 11. In this video, the man wearing a cowboy hat posed in front of the sign at the entrance to the facility.

Screenshot from “Investigations and Portraits”, showing the person of interest at the entrance of the Pryvillya Sanatorium. (source)

At one point in the video, the camera displays a location that is approximately just 90 metres from the site of the execution.

Location of the ‘Akhmat’ group in the “Investigations and Portraits” video along a northern building of the Pryvillya Sanitorium, approximately 90 metres east of the execution site filmed in the three violent videos.

The Man in the Cowboy Hat

The alleged perpetrator’s face can be partially seen for a few frames in the execution video – however, given the poor quality, this image cannot be used for identification.

But these frames do contain a number of other crucial clues, from vehicles in the background to items of clothing. Some of these details can be seen here, as collected and sanitised by the Conflict Intelligence Team (CIT), an independent collective of researchers focusing on the Russian military.

For example, this man wears a cowboy hat decorated with strings and seashells. Bellingcat was able to find the same model of hat, albeit in different colours, available for sale by a Russian online vendor.

Two screenshots showing the cowboy hat with seashells and rope circling near the brim, taken from the violent videos.

 

Screenshot taken from the violent videos showing the person who carried out the mutilation with the same cowboy hat and black bracelet on his left hand.

As he mutilates the prisoner while wearing surgical gloves, a bracelet can be seen wrapped twice around his left wrist connected with a metal lock.

Two screenshots showing the person carrying out the act with blue surgical gloves and a bracelet on his left hand.

In the subsequent video showing the execution of the prisoner, a shot is fired from the right of the camera’s perspective. Shortly after, a man holding a gun in his right hand and wearing the same shoes as the alleged perpetrator is visible to the right of the camera for a brief moment. When he reappears in the frame with his cowboy hat and partially-visible face, the alleged perpetrator is not holding the gun.

Three frames from the video showing the execution of the prisoner. A gun can be seen in the right hand of the executioner – wearing the same shoes as the man from the previous videos wearing the blue surgical gloves.

A white car with a hand-drawn black ‘Z’ – the ubiquitous symbol of Russia’s military aggression against Ukraine – spray painted on its passenger door can also be seen in the background of the video. The car model appears to be a Peugeot 405 or an IKCO Samand, an Iranian-made derivative of the Peugeot 405 design.

Screenshot taken from the execution video showing a white car with a hand-drawn black ‘Z’ across the passenger side of the vehicle. (Source: CIT)

Of the alleged perpetrators visible in the three violent videos, there is only one man who wears this hat and distinctive bracelet.

Six ‘Akhmat’ Videos

Users on Twitter were quick to point out that a man had appeared in two videos from Russian state media in June (RT, RIA Novosti) wearing a hat identical to that worn by the man who mutilated the Ukrainian prisoner.

These two videos, released on June 27, were taken at the Azot chemical plant in the Ukrainian city of Severodonetsk. The facility, which housed hundreds of civilians fleeing the attack, had come under the control of the Russian-backed ‘Luhansk People’s Republic’ (LNR) on June 25.

Two screenshots from a video report published by RT of ‘Akhmat’ fighters at the Azot plant in Severodonetsk. (source)

This fact was announced by pro-Kremlin Chechen ruler Ramzan Kadyrov on his Telegram channel. Indeed, a Chechen armed group known as ‘Akhmat’ – named for Kadyrov’s father, the former ruler of the North Caucasus republic – had played a role in conquering the city.

As an ‘Akhmat’ fighter wearing a Chechen flag shoulder patch speaks to the camera, a man in a dark cowboy hat can be seen in the background picking munitions out of the rubble.

A comparison with the violent videos shows that the hat is identical.

Screenshots comparing the same hat with seashells from the violent videos (top) and a video published by RIA Novosti in June (bottom). The rope that circles the hat is easily adjustable over and under the seashells, as seen in customer photos of the same cowboy hat.

Moreover, this man in the hat wears what appears to be the same black bracelet as the man in the mutilation videos — this time, with a black digital watch.

Screenshots comparing the black bracelet(s) on the left hand of the man wearing the cowboy hat in the RIA Novosti video (left) and mutilation video (right)

Researchers then discovered this man’s presence – wearing the same cowboy hat and bracelet – in four further videos (Patrick Lancaster, Investigations and Portraits, Kadyrov 95, Zhdanov) which also show Russian soldiers and paramilitaries in eastern Ukraine.

A video filmed in Severodonetsk and published on June 28 by pro-Russian US blogger Patrick Lancaster showed the same group of ‘Akhmat’ fighters filmed in the aforementioned RT and RIA Novosti videos escorting him around Severodonetsk.

In this footage, the group used a white car with darkened tail lights and spray painted black Zs painted on – seemingly the same one captured in the execution video. The man with the cowboy hat can be seen standing next to this car.

Screenshot from Patrick Lancaster’s dispatch from Severodonetsk showing the man with the hat next to the same white car filmed in the execution video.

While it has no licence plate, the car is of the same colour, make, and model. An identical spraypainted ‘Z’ is visible in the same location on the rear passenger door, which in this video is closed.

The series of screenshots below compare the same white car as seen in the violent videos (left) and a video filmed by Patrick Lancaster (right). The same hand-drawn letter ‘Z’ can be seen drawn across the passenger side in both videos. Note that the bottom horizontal line of the letter ‘Z’ curves at the same angle in both videos.



A video published on the Kadyrov95 Telegram channel from June 29th shows the same scene as the RIA Novosti and RT videos – fighters from the ‘Akhmat’ group touring the Azot plant. At one point, the man with the hat is seen rummaging for munitions just as he did in the RIA Novosti clip.

Screenshot from the Kadyrov 95 video showing the man with the hat rummaging for munitions at the Azot plant.

A video published by RT correspondent Igor Zhdanov on June 26 shows the man in the hat and the ‘Akhmat’ group at the Azot plant in Severodonetsk.

Screenshot from a video published by Igor Zhdanov at the Azot plant (source)

In the half-hour long July 11 video from ‘Investigations and Portraits’, mentioned earlier in this article, the journalist accompanies the group of ‘Akhmat’ fighters across the Donets river into an area west of Lysychansk, a nearby city which was also conquered by ‘LNR’ and Russian forces at the beginning of the month.

Throughout the video, the man with the hat can be seen multiple times with the ‘Akhmat’ group. At one point, he is shown holding his rifle during an operation at the Pryvillya Sanatorium, and amongst other ‘Akhmat’ fighters while they are eating.

Two screenshots from the “Investigations and Portraits” documentary showing the man with the hat in multiple locations with other ‘Akhmat’ fighters.

This footage, as mentioned earlier, was filmed approximately 90 metres east of the execution site.

In this footage, additional details emerged about the man in the dark cowboy hat. Firstly, a clearer view of his bracelet showed a high degree of similarity to the one in the mutilation video. Secondly, he was now wearing the same type of combat shirt as he is seen wearing in the violent videos.

The same man with the cowboy hat with a Z patch and Saint George ribbon on his left arm, as seen in the first of the violent videos (left) and the “Investigations and Portraits” video (right)

The camouflage pattern also appeared to be the same when they were compared to each other. However, it is important to remember that while uncommon, camouflage patterns can remain identical across individual uniforms.

Additionally, a Saint George ribbon – long a widespread pro-Kremlin symbol – is wrapped around this man’s arm in the same location. While the camouflage pattern of the shirts in these videos appears to be Ukrainian in origin, there are cases of ‘Akhmat’ fighters to using captured Ukrainian equipment and items of uniforms, as can be seen in other open source imagery.

Image taken from the VKontakte page of an ‘Akhmat’ fighter. Note that the man on the right wears a t-shirt with the logo of the Ukrainian armed forces, while the man alongside him wears Russian and Chechen flag patches on the sleeve of his uniform. A letter ‘Z’ can be seen taped to the rear windscreen of the car.

 

Finding a Face

The aforementioned videos with the ‘Akhmat’ group offer a wealth of higher quality imagery of the face of the man wearing the cowboy hat and bracelet.

The man’s skin tone is unlike all the other soldiers in the six videos with ‘Akhmat’ fighters – indicating that he may be a member of an ethnic group from Siberia or Russia’s Far East. Judging from the many videos and photos published by the ‘Akhmat’ group from their training and operational activities, the great majority of the fighters in the ‘Akhmat’ group are ethnic Russian or from the North Caucasus.

An extensive review of open source images of ‘Akhmat’ members across dozens of videos found just three men with similar facial features out of 85 fighters. No other man could be seen wearing the same hat and bracelet.

Screenshots of the person of interest with the ‘Akhmat’ group on the outskirts of Lysychansk (left), and at the Azot plant (centre, right)

The ‘Akhmat’ footage has already allowed other open source researchers to narrow down their search for the presumed culprit in the violent videos on the same basis. However, not all of their attempts have been successful. One erroneously-identified man was widely doxxed on Twitter, but the platform has since removed tweets revealing his personal information, including his address, passport number and phone number.

Bellingcat attempted identification of the group members in the “Investigations and Portraits” half-hour video with the help of facial recognition tools.

These led researchers to the VK account of a man whose friends included self-confessed fighters with ‘Akhmat’ in Ukraine. While exploring this man’s broader network, Bellingcat came across a profile with group pictures, uploaded on 26 July 2022, of ‘Akhmat’ fighters at an excursion in Chechnya.

A man with similar facial features to the man wearing the cowboy hat in the ‘Akhmat’ videos could be seen in this group photograph.

 

Many members of the group either had locked profiles or could not be identified. Using the face of the main person of interest, the website search4faces returned a profile on Odnoklassniki, a Russian social network, which contained this individual’s name.

This, in turn, allowed researchers to discover a Facebook profile linked to this individual which contained more photographs – these were useful, given that most images of this individual on his other social media profiles were at least six years old. A search on PimEyes using a photograph from this Facebook account returned frames from the aforementioned RIA and RT videos in which the person of interest was visible.

As seen in the perils of widely-spread misidentification on Twitter, Russian-created facial recognition algorithms perform poorly with non-Caucasian faces. While the algorithms used by these tools are not openly accessible and verifiable, it is plausible that this poor performance is due to the ethnic and racial bias within the user bases of large Russian social networks such as VKontakte and Odnoklassniki. A 2020 Harvard study revealed facial recognition algorithms’ biased results when working with non-white faces, though most of these studies have focused on American examples and Black faces.

An additional data point came in the form of a public post from 2019 in a VK group for residents of this individual’s city of residence in Russia, in which he announced that he has lost an identity document and provided two phone numbers by which he could be contacted.

We then searched for these two phone numbers on Telegram bots that aggregate leaked Russian data, including from government records and a number of websites, such as VK and Avito. This search led to additional phone numbers and links to two VK profiles used by this individual, which linked back to two VK accounts which contained further images of him.

These numbers also allowed Bellingcat to contact this individual.

‘I Didn’t Even Fire a Single Shot’

Bellingcat contacted this individual on August 2 to offer a right of reply. Even after our reporter identified himself as a journalist, the man provided a detailed account of how he was indeed the man with the cowboy hat serving with ‘Akhmat’ and was in Severodonetsk in June of this year. However, he denied being the man in the violent videos where a man seen wearing a similar hat, bracelet and uniform can be seen carrying out the mutilation of an apparent Ukrainian captive.

He also recounted how he was filmed taking an inventory of Ukrainian weapons, as he was seen doing in footage from the Azot plant near Lysychansk.

The fighter told Bellingcat that he had returned to Russia “more than a month ago” after serving with ‘Akhmat’ in Ukraine. He said that Russian journalists he had met in Ukraine had sent him the violent videos shortly after they were widely published, saying “look at the crap that’s been filmed about you” urging him to make a statement at an office of Russia’s Federal Security Service (FSB).

He said that he was detained for two days at the FSB office while the security agency allegedly studied the violent videos, finding them to be inauthentic and releasing him. He also insisted that the FSB officers told him the violent incident from the videos took place in Pryvillya but involved Ukrainian and not Russian soldiers and were filmed after he had left Ukraine.

“The FSB officers told me that they found this video in vehicles of Ukrainian soldiers. When I was with them on the second day, they realised that it was not me, and explained that Ukrainian soldiers did this themselves because the person who was being mutilated raped a ten-year-old girl. They found him, punished him, and then somebody found this [spliced-together] video and led to all of this nonsense. (…) The FSB officers suddenly understood everything and let me go after two days.”

“The photos [from Azot] are 100% me, but the others are not… I’m not prepared to do that kind of nonsense, I didn’t even fire a single shot from the weapons they gave me”, he remarked. “This doesn’t smell like Akhmat’s work”, he concluded of the violent videos.

However, some inconsistencies were apparent in his responses.

Despite the fact that this man was filmed in multiple places holding a long rifle, he claimed that he was not a soldier and was merely escorting the journalists who filmed the ‘Akhmat’ videos, in five of which he claims he appears.

If it was Ukrainian soldiers in the video, as he states the FSB told him, he did not offer any explanation as to how these soldiers came to be wearing a strikingly similar hat, bracelet, ribbon and uniform as he was seen wearing in other videos. He also claimed that he never saw, and that ‘Akhmat’ did not use, a white car such as that filmed in the execution footage, despite the fact that he is standing directly next to it in Patrick Lancaster’s video.

Christo Grozev, Aric Toler, Michael Sheldon and Carlos Gonzales contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here.

Related articles