Why the "Red-Arrow" OSINT Crowd Is Losing to the Industrial Conveyor: From Dolphin{anty} Cloud Farms and MTProto doc_id Hashes to Russian Defense Clone Entities
An engineering post-mortem of four systemic blind spots in contemporary open-source intelligence: why hunting physical SIM boxes and running keyword dashboards misses dual-use cloud botnets, 27-minute binary MTProto file transfers to TASS, numeric UID beacons across renamed accounts, SendAsPeer proxy masks, and 2024–2026 Russian defense plant clones in the Federal Tax Service registry.
1. The Red-Arrow Illustrators vs. the High-Frequency Conveyor
In popular imagination — and across much of the social-media OSINT circuit — open-source intelligence still looks like the craft of a courtroom illustrator: wait until the Ukrainian Defense Forces strike a Russian depot, download yesterday’s commercial satellite image, draw a thick red arrow in MS Paint pointing at a patch of scorched asphalt, and publish a twenty-tweet thread. Or export a CSV from a commercial media-monitoring dashboard (Brand24, YouScan, SemanticForce), plot a pastel pie chart of keyword frequency, and call it counter-disinformation.
The problem is that in 2026, both cognitive warfare and defense-industrial sanctions evasion operate as high-frequency automated conveyors. While red-arrow illustrators polish graphics about last month’s strikes, the adversary rotates domains in three minutes, scrubs display handles, pipes binary media objects through sanction-proof relays, and spins up clean corporate clones for strategic missile plants.
When readers ask why legacy monitoring centers and Western sanctions bureaucracies "know the macro picture" yet consistently miss live enemy infrastructure, the answer lies in four technical blind spots.
2. Blind Spot #1: The Physical "SIM-Box Cabinet" Fallacy vs. Dolphin{anty} Cloud Profiles and Dual-Use SaaS Brokers
Traditional law-enforcement counter-bot operations are engineered around physical raids modeled on 2022 precedents (such as the August 2022 takedown of Viktor Maistrenko’s 1-million-account farm): locate a rented apartment humming with hardware GSM gateways (GoIP) and 10,000 plastic SIM cards, seize the racks, and photograph the wiring.
However, the modern industrial botnet web (100033..., .XXXXXX, .2025, 6158...) has no physical cabinet in Ukraine:
- Cloud Anti-Detect Architecture: Accounts are purchased in bulk on darknet markets (
AccsMarket,DarkStore,Deer.io) as ready-to-importJSON-cookies+ auth token bundles harvested or auto-registered in India, Palestine, Bangladesh, the Philippines, and Russia. Thousands of personas are operated from a single laptop via cloud anti-detect browsers (Dolphin{anty},AdsPower,Multilogin,Octo Browser) routed through residential mobile proxies. There is no warehouse of SIM racks to kick down. - Dual-Use Commercial SaaS Mercenaries: Grey-market SMM infrastructure operates as a multi-tenant mercenary exchange. At 10:00 AM, a
Dolphin{anty}panel accepts domestic political PR money to whitewash municipal failures in Kyiv (where CSV botUID 100011388163548carrying the raw spreadsheet column header *"Higher Education Kyiv"* is laundered through Latin homoglyph obfuscatorludmila.bondarenko.45557). At 03:00 PM, in the adjacent browser tab, the exact same account pool executes contracts for the GRU’s 72nd Main Intelligence Info-Center (Military Unit 54777) pushing mobilization sabotage, AWOL panic, and Pension Fund insolvency myths. - Parser Blindness and the MLAT Bottleneck: Commercial keyword parsers are blind to strings split by Latin homoglyphs and never crawl
Followinggraphs. Meanwhile, when a6158...pseudo-business page (such asid=61585982231409, registered with fabricated postal code219293fromFakeAddressGenerator.com) runs zero paid ads in the Meta Ad Library (leaving no bank card on file), a formal MLAT legal request to Meta Platforms, Inc. via the US Department of Justice takes 6 to 18 months. You cannot beat a real-time cloud conveyor with an 18-month paper trail; you beat it by X-raying follower graphs and CSV ingestion defects in real time.
3. Blind Spot #2: Byte-Level MTProto (doc_id) Forensics and the GRU’s "Video Freezer" 27 Minutes Before TASS
Conventional analysts read the text of a Telegram post with their eyes. Engineering OSINT reads binary MTProto protocol headers and ffprobe container metadata.
Consider our live interception from 04.11.2026 during a localized 15-hour power-phase outage in Kyiv:
- At
18:21:58 UTC, the sanctioned outlet *Strana.ua* packages media album@stranaua/253840..253842pushing a fabricated claim that residents had been without electricity for "nearly five days." - Exactly 27 minutes and 03 seconds later (
18:49:01 UTC), Russian military propaganda hub *RVvoenkor* (@RVvoenkor/126470..126472) publishes a blast announcing an "energy uprising in Kyiv." How do we prove this was a direct technical relay rather than organic media coverage? By inspecting the raw MTProtoMessageMediaDocumentpayloads: the Russian military channel attached the exact same server-side Telegram binary objects byte-for-byte without re-encoding —doc_id=5429119394091411064(664,658bytes) anddoc_id=5429119394091411065(4,854,348bytes). Two hours later (20:49:01 UTC), Russian state wire TASS (@tass_agency/404001) formally legalized the narrative on the federal wire, completing a 58-minute Battle Damage Assessment (BDA) loop for the Russian General Staff. - Earlier that same morning (
08:41:33 UTC), officers of the GRU’s 85th Main Special Service Center (Military Unit 26165, operating the@rezident_ua/@legitimniynetwork) pulled an old local video filmed in Kryvyi Rih on02.11.2026(doc_id=5424673918256460497,73,211,137bytes) that had been sitting in their "video freezer" for 41 hours and 30 minutes. Container forensics viaffprobecaught their workstation pipeline to the second: the GRU operator ran the stale file throughffmpeg(compressing it to39,767,082bytes, generating a newdoc_id=5429401745241450945) and uploaded it 18 seconds later to@rezident_ua/30983as "fresh street resistance" to prime their main PSYOP campaign deterring AWOL soldiers from returning to combat brigades.
No keyword dashboard on earth sees doc_id object inheritance or ffmpeg re-encoding timestamps. To an MTProto packet tracer, they are smoking-gun fingerprints.
4. Blind Spot #3: Immutable Numeric UID Beacons and SendAsPeer Proxy Masks
When a provocateur or arsonist account in a municipal chat is exposed, the operator executes a standard evasion drill: delete the @username handle, wipe the avatar, and replace the display name with a single letter or period.
To a human moderator or text scraper, the account vanishes. In Telegram’s MTProto architecture, however, the 64-bit integer user_id or channel_id is immutable:
- When a Kyiv provocateur channel panicked after exposure and scrubbed its handle ex-
@kyivskiydvish, renaming itself to a single lowercase letter, our tracker kept following the exact same permanent integer:channel_id=3913826799. - The same principle strips away
SendAsPeer(PeerChannel) masks — a tactic where GRU/FSB operators hide their personaluser_idby posting comments in municipal threads on behalf of an empty proxy channel bearing a civic-sounding title. While casual readers see a "local community initiative," our MTProto dumper extracts the underlyingchannel_id, maps its cross-thread velocity alongside disposable zero-account swarms (UID 66... / 7... / 8..., such asuid=8895205236), and exposes the entire cluster topology.
5. Blind Spot #4: 2024–2026 Russian Defense Plant Clones in the EGRUL Corporate Registry
The most expensive blind spot in Western sanctions enforcement is fighting yesterday’s signboards. Sanctions committees compile a list of historical Russian defense enterprise names from 2021 Wikipedia entries, issue a triumphant press release, and declare victory.
Meanwhile, between 2024 and 2026, Russia’s defense-industrial complex systematically deployed a simple corporate registry maneuver: registering brand-new clone legal entities in Russia’s Federal Tax Service registry (EGRUL) — often bearing the exact same name or operating on the exact same industrial site, but assigned a fresh Tax ID (INN) and State Registration Number (OGRN) completely absent from OFAC, EU, and UK sanctions lists:
JSC Anozit(AO Anozit, Kuibyshev, Novosibirsk Region): Russia’s strategic monopolist producing ammonium perchlorate — the critical solid-propellant oxidizer for *Iskander-M* tactical ballistic missiles, *Yars* ICBMs, and *S-400* interceptors. While Western compliance databases tracked the legacy federal enterprise, on03.08.2026Moscow quietly incorporated a clean corporate clone under INN5402092000/ OGRN1265400018432— operating with zero Western sanctions.JSC Zavod Elastik(Ryazan Region, military high explosives and artillery charge assembly): Clean corporate clone registered on23.08.2024under INN6200007300— zero Western sanctions.- **
JSC Zala Aero(Moscow, manufacturer of *Lancet* loitering munitions and reconnaissance UAVs): Fresh legal entity registered in 2024 under INN9715478507— zero Western sanctions**.
The takeaway is blunt: in 2026, real OSINT begins where MS Paint red arrows end — inside automated cross-registry pipelines (EGRUL, Companies House, customs ledgers, power-grid substation schematics) and raw binary protocol dumps.
