MOSCOW (Reuters) - One of the Russians accused by U.S. officials of conducting cyber attacks around the world is registered at an address in Moscow that has been identified by the U.S. government as a base of Russian military intelligence.
Alexei Morenets was one of seven Russians named in a U.S. indictment released on Thursday. He is accused of hacking into the networks of international sports bodies in Switzerland and a chemical weapons watchdog in the Netherlands.
Morenets is registered as living at a building on Moscow’s Komsomolsky Prospect, according to someone who had seen the address on two official Russian databases - one for vehicle registration and another for home addresses.
The specific address is the same one that, according to the U.S. indictment, is home to Military Unit 26165, a unit of the GRU military intelligence service. A publicly available database of Russian legal entities also gives the location as legal address for the unit with the same number.
Morenets was listed as a registered owner of a Russian-made VAZ car, that had Military Unit 26165 as a place of registration for several years in the mid-2000s, according to the vehicle registration database.
The name and date of birth of the Alexei Morenets registered at the Moscow address match the passport details of one of the Russians who Dutch officials on Wednesday accused of trying to hack into the Organization for the Prohibition of Chemical Weapons in the Hague.
Another of the seven Russians, Alexei Minin, also has an address related to the Russian military. He is registered as living at a building on Narodnogo Opolcheniya street in Moscow. This is the legal address of the Military Academy run by the Russian Defence Ministry.
Reuters was unable to contact either of the men by telephone.
The Dutch and U.S. authorities said publicly that Morenets and the other alleged hackers were GRU officers.
But the detail about the Moscow address gives an indication of how investigators may have tied the suspects to Russian military intelligence.
When Reuters tried to reach Military Unit 26165 by phone, someone picked up and said the unit moved out long ago. Reuters called another military unit registered at the same building and a man answered the phone.
Asked if the call had come through to military unit 06410 he said: “I can’t confirm or deny that. You won’t get any information here anyway.”
A number listed for Morenets was de-activated.
A taxi receipt which Dutch officials said was found on one of the alleged hackers offered another clue linking the hacking suspects to the GRU.
The receipt was found when the suspects were detained earlier this year before being expelled from the Netherlands. The receipt was for a journey across Moscow carried out on April 10, shortly before they arrived in the Netherlands.
It gave the destination as Moscow’s Sheremetyevo Airport, and the pick-up point as Nesvizhsky Lane. That street runs directly behind the address given in the U.S. indictment for GRU Military Unit No. 26165.
Writing by Christian Lowe and Maria Tsvetkova; Editing by Richard Balmforth