Strike on Russian hybrid network "Rybar": Mihail and Valeria Zvinčuk arrested in Montenegro

Montenegrin police and the National Security Agency (ANB) have carried out a major operation in Risno, during which five people linked to the Russian information network “Rybar” were arrested. Among those arrested are Mihail Zvinčuk, who is said to be a colonel in the Russian military intelligence service GRU, responsible for hybrid operations, and Valeria Zvinčuk. The operation constitutes an important step in confronting the networks that Western institutions link to Russian propaganda and information influence operations.

Montenegrin security services have launched an operation this morning aimed at uncovering and curbing the activities of the Russian hybrid network "Rybar". A total of five people have been arrested in Risno, including, according to available information, Mihail and Valeria Zvinčuk, who are linked to the leadership of this organization.

According to information published by Pobjeda, Mikhail Zvinchuk is a colonel in the Russian military intelligence service GRU, responsible for hybrid operations. Details of his alleged role, as well as the activities of the other detainees, are expected to be clarified during the investigation and through official information from the competent authorities.

This action takes on a broader significance due to the international reputation of the “Rybar” network, whose activity has been linked by Western institutions for years to the spread of pro-Russian narratives, propaganda activities and attempts to influence public opinion. The arrests in Montenegro raise the question of whether this network has developed an operational structure in the Western Balkans and to what extent its activities have been linked to the interests of Russian state and security structures.

At a time when security challenges increasingly arise not only through traditional military and intelligence operations, but also through digital platforms, media channels and organized disinformation campaigns, the protection of public space becomes one of the main tasks of democratic states. Precisely for this reason, the results of the Montenegrin action may have significance beyond the borders of this country.

“ Rybar”: From a military channel on Telegram to an international network

“Rybar” is a Russian media and information network, founded in 2018, which gained international recognition during the Russian invasion of Ukraine. Initially conceived as a platform for military analysis, conflict monitoring, and reporting on developments on the front, over time it transformed into a wide network of communication channels, with a significant presence on social networks.

The founder and one of the most prominent representatives of the network is Mikhail Zvinchuk, a former member of the intelligence structures of the Russian Ministry of Defense. In 2018, Zvinchuk, together with Denis Shchukin, founded “Rybar”, which later became one of the most influential Russian military channels on Telegram.

The network's influence is not limited to publishing military analyses. Western institutions point to its role in disseminating content that supports the Kremlin's political and strategic interests, as well as using digital communication channels to influence public attitudes outside of Russia.

It is precisely this combination of media activity, extensive digital reach, and alleged connections to Russian structures that makes "Rybar" an object of interest for security services and analytical centers in several countries.

EU sanctions and accusations of spreading propaganda

Mikhail Zvinchuk has been under European Union sanctions since June 2023. The justification for the EU Council's decision states that, in addition to directing the "Rybar" channel, he was a member of a working group formed by Russian President Vladimir Putin to coordinate activities related to the war in Ukraine.

The European Union has accused Zvinchuk of spreading disinformation and propaganda in favor of the Kremlin. The sanctions are part of a broader response by European institutions to Russian activities, which they consider a threat to security and democratic processes.

British authorities have also named Rybar as one of the actors in Russian operations to manipulate foreign information and interfere in democratic processes. According to them, the network's activities are partly coordinated by the Russian presidential administration, financial support is provided by the Russian state corporation Rostec, while its operatives cooperate with members of Russian intelligence services.

These assessments show that Western countries do not see “Rybar” only as a media project, but also as part of a broader system of Russian information influence. However, the specific responsibility of the individuals arrested in Montenegro must be determined on the basis of evidence and through a regular legal procedure.

Anonymous accounts, artificial intelligence and the impact on public opinion

The British government says that "Rybar", in addition to publishing military analysis, uses anonymous media accounts, purported polls and content generated by artificial intelligence to influence public opinion and promote narratives in line with the Kremlin's interests.

Such methods pose an increasing challenge for democratic states. Information can spread rapidly, while it is often difficult to determine who is behind certain accounts, who is funding specific campaigns, and whether the content published is part of a coordinated activity.

The UK imposed additional sanctions on individuals associated with the organisation in July 2026 as part of measures to counter Russian intelligence operations. These measures are part of broader efforts by Western countries to limit the use of media and digital platforms to further foreign political objectives.

The arrests in Montenegro now raise the question of whether similar activities have been organized on the territory of this country, as well as whether there is evidence of concrete attempts to influence the public or institutions.

The Western Balkans as a space of Russian information influence

The expansion of "Rybar"'s activities outside of Russia, including the Western Balkans, has attracted particular attention in Western security and analysis circles.

According to a November 2024 analysis by the American Institute for the Study of War (ISW), Zvinčuk spoke of an international network with more than 250 communication channels in 28 languages. In the same context, he also mentioned the opening of media schools in Serbia, Bosnia and Herzegovina, and Kyrgyzstan.

The expansion of such an infrastructure indicates an intention to disseminate information and political narratives to different linguistic and national communities, and not just to the Russian public. For analysts who follow Russian influence, the network's international reach is one of the reasons why its activities are evaluated in a broader geopolitical context.

The Western Balkans is particularly vulnerable to information competition due to complex political relations, open regional issues, and different foreign policy orientations of states. In such an environment, media platforms can become channels for promoting narratives that deepen existing divisions or influence the perception of international partners and security alliances.

In this sense, the investigation in Montenegro may provide additional answers as to whether "Rybar" operated in the region only as a media network or whether it also had other organizational and operational activities.

The US State Department has also identified individuals associated with "Rybar".

The US Department of State has also focused attention on the activities of this network, which through the "Rewards for Justice" program has publicly identified several people associated with "Rybar", raising suspicions of their involvement in foreign influence operations.

This program is used to collect information on activities that US authorities consider important for national security. Its involvement in cases related to this network further shows that the activity of “Rybar” is in the focus of several Western institutions.

When the European Union sanctions, the measures of the British authorities, and the activities of American institutions are seen together, it becomes clear why the possible presence of this network in Montenegro is treated as an issue that goes beyond ordinary media activity.

/The Geopost/