Researchers have pierced the veil of secrecy surrounding the Federal Security Service’s (FSB) 16th Center, a unit inheriting the Soviet KGB’s primary signals intelligence (SIGINT) capabilities.
By leveraging open-source intelligence (OSINT) techniques combined with phaleristics the study of military medals and insignia the team analyzed hundreds of photographs of badges linked to this elusive entity.
Publicly accused of intercepting global communications and orchestrating cyberattacks on governments, NGOs, and corporations, the 16th Center’s operations span communications intelligence (COMINT), electronic intelligence (ELINT), cryptanalysis, and computer network operations (CNO).
The analysis revealed the unit’s historical evolution, tracing its roots to the KGB’s 16th Directorate established in 1973, which later integrated into the Federal Agency for Government Communications and Information (FAPSI) before FAPSI’s dissolution in 2003.
Today, operating under the alias “Center for Radio-Electronic Intelligence by Means of Communication” and military unit code 71330, the center employs symbols like shattered keys and lightning bolts on its insignia, emblematic of cryptanalysis and radio-electronic reconnaissance (RER).
These artifacts not only confirm the unit’s SIGINT heritage but also highlight its self-perception as a direct successor to Soviet-era capabilities, often commemorating founding dates from 1918 or 1921.
The research pieced together the 16th Center’s internal architecture, identifying at least ten departments labeled A through T, including specialized units for technical support, legal affairs, and cyber operations.
Previously, only Department B was documented in open sources, but insignia analysis uncovered entities like Department ST, symbolized by unbroken keys and winged lightning bolts indicative of secure communications protection, and Department K, featuring computer imagery suggestive of CNO roles.
Subdivisions such as Section 3, Section 7 in Novosibirsk, and Department T’s subunit No. 9 further complicate the structure, with estimates placing the center’s personnel at over 560 based on FSB organizational thresholds.
This granularity stems from iterative OSINT processes, cross-referencing insignia from manufacturers like Breget and SpetsZnak, resale platforms, and enthusiast forums, all tagged and geolocated using tools like digiKam.
Extending beyond organizational mapping, the study geolocated ten SIGINT facilities, dubbed “Special Communications Centers” (TsSS) or “Information Reception Centers,” scattered across Russia for intercepting satellite communications (SATCOM) and radio frequency (RF) signals.
These sites, equipped with circularly disposed dipole arrays (CDAA), multibeam tracking antennas (MBTA), and parabolic dishes, enable 360-degree beamforming and long-range triangulation up to 15,000 kilometers.
Notable examples include Unit 03110 near Adler, relocated from Cuba’s Lourdes base, featuring radomes for concealed SATCOM interception targeting the Caucasus and Middle East; Unit 11380 in Temryuk with MBTA for Black Sea monitoring; and Unit 70822 near Khabarovsk, boasting a 160-meter CDAA for Northeast Asian surveillance.
Many facilities, dating back to the 1920s or 1940s, show recent upgrades, potentially tapping fiber optic backbones for terrestrial signals.
This network underscores the 16th Center’s role in global espionage, including operations linked to cyber groups like Turla and Energetic Bear.
While gaps remain such as precise departmental missions and unconfirmed subunits like Unit 28735 the methodology paves the way for deeper probes into Russian intelligence, blending phaleristics with OSINT to demystify opaque structures.
Published under CC BY-SA in July 2025, the findings emphasize the value of symbolic artifacts in exposing hidden spy networks.
Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…