The Brazilian Candidate: The Studious Cover Identity of an Alleged Russian Spy

Translations:

On 16 June, Dutch intelligence (AIVD) published a press release detailing how it had disrupted an attempt by what it said was a Russian military intelligence (GRU) asset to gain “access as an intern to the International Criminal Court (ICC) in the Hague”. The man was denied entrance to the Netherlands and was sent back to Brazil.

This press release provided a wide array of information about this individual, including his real identity and his “legend” identity – a fake persona created by the GRU.

The real name of the GRU asset, according to AIVD, is Sergey Vladimirovich Cherkasov (born 11 September 1985). His false persona is Victor Muller Ferreira (born 4 April 1989). The AIVD also provided a four-page legend letter used by Cherkasov/Ferreira, providing a bizarre biography for a fake Brazilian man.

The information contained in the press release and the legend letter provide further clues about “Victor Muller Ferreira” that has allowed Bellingcat to unravel his digital and real-world footprint, including stints at two prestigious programs at Dublin’s Trinity College and Johns Hopkins University’s School of Advanced International Studies (SAIS).

The available open source information shows that for several years, Cherkasov played a role as an ambitious political science student, running an analytical website with pro-Western talking points.

In its statement, the AIVD drew attention to the fact that at the time of Cherkasov’s application the ICC was investigating possible war crimes committed by Russian soldiers in Ukraine this year and in Georgia in 2008.

“For those reasons, covert access to International Criminal Court information would be highly valuable to the Russian intelligence services”, noted the AIVD statement.

From Dublin to the US

A profile at myvisajobs.com provides a biography for Cherkasov’s cover identity: he worked as a travel agent in Brazil before attending Trinity College Dublin as an undergraduate studying political science (2014-18), then getting his Master’s at Johns Hopkins’ SAIS programme (2018-20).

Screenshot of the MyVisaJobs profile for “Victor Muller” – the cover identity of Russian GRU asset Sergey Cherkasov.

In 2017, when starting his last year at Trinity College Dublin, “Victor” started a blog focused on geopolitics called “Politics of Us”.

While at first glance the blog seems incredibly popular with thousands of comments on each article, in fact the vast majority of interactions appear to be spam with very little organic engagement. The ideology expressed in the blog would appear milquetoast for a Western political science student without any pro-Russian leanings – discussing methods of increasing democracy in developing nations, calling Putin a “cancer”, and focusing on the importance of grassroots organisations fostering peace in Africa.

Biographical information on Cherkasov’s “Politics of Us” blog, run by his cover identity while a student in international relations.

“Victor’’s blog links to two of his social media pages on Facebook and Twitter. His Facebook page has fairly limited information, but is filled with hundreds of friends from Brazil (his alleged homeland) and his two alma maters of Trinity College Dublin and Johns Hopkins. It is worth noting that the biographical information on his Facebook page matches that of his “legend letter”, which details his childhood and being from “Brazil, Rio De Janeiro, in Niteroi”.

Screenshot from the “legend letter” written by Cherkasov/Ferreira, provided by Dutch intelligence.

Screenshot from Cherkasov’s Facebook page ran under his cover identity, with biographical details that match his “legend letter”.

The Facebook profile picture for “Victor” reflects his 2020 graduation from Johns Hopkins University, which can be further verified by the university itself. A 2020 commencement program shows that “Victor Muller Ferreira” was a 2020 graduate with a Master’s degree. Bellingcat spoke with a recent graduate from the SAIS who said that this “Victor” was indeed a student at the program. One of his professors has also tweeted about how he took a class with him and wrote him a recommendation letter for the ICC internship.

The “Politics of Us” blog also points to a Twitter account run by “Victor”.

Twitter profile for Cherkasov’s fake persona.

Much of the Twitter account is focused on pro-Trump content, including a now-deleted (but still archived) blog post about President Donald Trump. In an interesting twist, the account also shared a 2017 Bellingcat article on the digital personas of GRU officers.

Sergey Vladimirovich Cherkasov

Information about the true identity of the recent Johns Hopkins graduate is harder to find, but does exist in some leaked databases. It is worth noting that some of the data that was found in offline databases – such as a passport number and travel history – appears to have been manually removed from other Russian databases and data services, as is typical with security service officers.

We can observe that the data was specially removed because Cherkasov’s information is preserved in offline leaked ‘Probiv’ databases downloaded by Bellingcat several years ago, while the same data does not appear in “live” databases and services – even though data from non-security officers from the same databases is identical between the offline and “live” databases.

We have chosen not to show a screenshot comparison of these two databases as they both include the personal information of individuals who are not in any way implicated in wrongdoing.

Cherkasov is from Kaliningrad and frequently travelled between the European exclave and Moscow by train between 2005 and 2008. The fact that these train trips are in Cherkasov’s name when he was only 20 years old points to this being his actual identity, rather than yet another cover persona.

While it is possible that Cherkasov was already working under a false persona at only 20 years old, it is more likely that he was assigned one later in life, as most GRU officers that Bellingcat has studied over the years did not start working under false cover until their mid-twenties at the earliest.

Travel records of Cherkasov’s trips between Kaliningrad and mainland Russia, crossing Lithuania. Source: Belarusian Cyber Partisans.

There are also records of three flights that Cherkasov took in the summer of 2015, apparently during the summer break after his first year at Trinity College Dublin. These trips were between Moscow – Kaliningrad (29 June 2015), Moscow – Belgorod (7 August 2015), and Belgorod – Moscow (9 August 2015).

Flight data for Sergey Cherkasov from Moscow to Kaliningrad during the summer of 2015, from a leaked Russian travel database.

Flight data for Sergey Cherkasov from Belgorod to Moscow during the summer of 2015, from a leaked Russian travel database.

Flight data for Sergey Cherkasov from Moscow to Belgorod during the summer of 2015, from a leaked Russian travel database.

The Russian Telegram channel “Danger, news” published a photograph that they claim shows Cherkasov in a military uniform, and that he graduated from the Kaliningrad-based Baltic State Academy in 2007. Bellingcat has not been able to independently verify this photograph at the time of publication. When the Telegram channel’s journalist reached out to a classmate of Cherkasov about the allegations that he was a GRU asset working in America, the classmate replied “Cool”.

Screenshot from a Telegram post about Cherkasov, with the photograph on the left supposedly showing Cherkasov in a military uniform.

Spy Fallout

More information will doubtless surface regarding Cherkasov in the weeks to come, as the GRU asset was not terribly secretive in his digital footprint. One of his lecturers at Johns Hopkins has already spoken out saying “I feel angry, I feel stupid, I feel naive, I feel tired. I got played.”

Bellingcat will continue to investigate Cherkasov’s history and look for additional connections between his real identity and his work with the GRU.

Research by Aric Toler, Foeke Postma, and Christo Grozev

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here.

Related articles