Track a Nazi Merc: Inside Russia’s Shadowy Network of Digital Informers
By Matthew Parish
Monday 2 November 2026
There is a peculiar corner of the internet in which the foreign volunteers who have travelled to Ukraine to resist the Russian invasion are hunted, photographed, catalogued and publicly denounced as Nazis and mercenaries. Their personal histories are reconstructed, their social media accounts are scrutinised and their deaths, whether real or imagined, are occasionally celebrated with a degree of enthusiasm that would be disturbing even by the standards of contemporary Russian wartime propaganda. This is the world of TrackANaziMerc, an English-language Telegram channel whose activities raise serious questions about the relationship between amateur internet investigators, Russian intelligence agencies and the Kremlin's wider machinery of psychological warfare.
At the end of October 2026, the channel had approximately 81,400 subscribers, rather than the 100,000 sometimes attributed to it, while its associated discussion group had around 11,000 members. These are nevertheless substantial figures for an organisation dedicated to monitoring individual foreigners serving in the Ukrainian Armed Forces and other people supporting Ukraine's resistance to Russian aggression. The channel has become an international clearing house for hostile information about Ukraine's foreign supporters, and its activities demonstrate how the boundaries between propaganda, intelligence gathering and personal intimidation have become increasingly blurred.
The organisation describes itself as being administered by something called the Dirty Rats Team, an informal association of online investigators whose members have sought, with varying degrees of success, to conceal their identities. Its stated purpose is to track Nazis and mercenaries in Ukraine, although the definition of these terms appears sufficiently elastic to encompass virtually any foreigner who has expressed support for the Ukrainian cause. The central question is whether this group represents a collection of obsessive pro-Russian internet enthusiasts or whether there is a more substantial organisation behind its activities, potentially connected to the Russian security services.
The distinction matters because there is an enormous difference between an unpleasant Telegram channel populated by political extremists and an intelligence operation designed to identify, intimidate and potentially facilitate attacks against foreign citizens. Yet the Russian approach to modern warfare frequently involves cultivating precisely this ambiguity, relying upon networks of sympathetic individuals who may act independently while nevertheless advancing the strategic objectives of the Russian state.
The origins of TrackANaziMerc appear to date from the autumn of 2022, when the channel began publishing photographs and biographical sketches of foreigners fighting in Ukraine. Initially these were comparatively modest exercises in what internet investigators call open-source intelligence, or OSINT, involving the collection and analysis of information already available on social media and other public websites. The operation subsequently expanded into something more systematic, with participants encouraged to contribute identifying information and administrators coordinating their activities in private discussions.
A July 2025 investigation by the Central European investigative journalism consortium VSquare, working alongside FRONTSTORY and researchers associated with the International Centre for Counter-Terrorism in The Hague, described the operation as a coordinated exercise in doxing. This is the practice of assembling and publishing identifiable personal information about individuals, generally with the intention of exposing them to harassment, intimidation or other forms of harm. The investigators found that the Telegram operation was connected to a broader network of websites and information repositories devoted to identifying individuals regarded as enemies of Russia.
The importance of this activity should not be underestimated. A foreign soldier serving in a Ukrainian infantry brigade may be relatively anonymous on the battlefield, where he is known principally by his callsign and military function, but the publication of his name, photographs, nationality and personal history creates opportunities for hostile actors to connect his military identity with his civilian existence. This may place not only the individual concerned but also his family and associates at risk, particularly where the published information is accompanied by threatening language.
There is a further distinction between collecting information and manufacturing accusations. TrackANaziMerc routinely employs the language of Nazism to describe individuals whose principal offence appears to be their opposition to Russia's invasion of Ukraine. This mirrors the Kremlin's longstanding assertion that its war is an exercise in denazification, an argument whose extraordinary breadth has allowed Russian propagandists to redefine virtually every form of resistance to Russian imperial ambitions as an expression of fascism.
The term mercenary is similarly abused. Under Article 47 of Additional Protocol I to the Geneva Conventions, the definition of a mercenary involves several cumulative requirements, including participation principally for private financial gain, promises of compensation substantially exceeding that paid to comparable regular soldiers and exclusion from membership of a party's armed forces. Foreign nationals who enlist in the Ukrainian Armed Forces and serve as ordinary members of those forces are not mercenaries merely because they hold foreign passports or receive military salaries. To describe them indiscriminately as mercenaries is therefore not simply an exercise in political invective but a distortion of international humanitarian law.
The systematic misuse of these descriptions serves a psychological purpose. A foreign soldier identified as a Nazi mercenary is presented not as a person participating in the defence of a sovereign state but as an illegitimate combatant whose suffering or death deserves celebration. This rhetorical manoeuvre makes it easier to encourage hostility towards individuals who might otherwise attract public sympathy, and it creates a moral pretext for the exposure of their private information.
The question of who operates TrackANaziMerc has been the subject of substantial investigative efforts. In June 2025, the Ukrainian media organisation UNITED24 published the findings of an OSINT collective called the Unintelligence Agency, which claimed to have identified several of the channel's principal administrators. The most significant allegation concerned Daria Khaltourina, a Russian public health and demography specialist whom the investigators identified as the channel's owner and principal organiser, operating under the pseudonym Ekaterina II.
According to the published investigation, Khaltourina had professional connections to Russian public health institutions and described herself as holding a senior position at an institute associated with the Russian Ministry of Health. The investigators attributed to her a series of statements advancing familiar Kremlin narratives about the war, including the denial or distortion of well-documented Russian atrocities and historical crimes. VSquare subsequently repeated the identification in its investigation of Russian doxing networks. These findings are important, although they should properly be understood as reported OSINT attributions rather than identities independently established by the Lviv Herald.
The reported identification of a Russian public health professional as an organiser of a campaign against foreign soldiers is striking because it illustrates the breadth of civilian participation in Russia's information war. There is no particular reason to imagine that every person engaged in such activities is a trained intelligence officer. A state engaged in a prolonged conflict can derive considerable advantage from politically committed civilians who volunteer their time to identifying and discrediting its enemies.
Other individuals identified in the investigation were even more geographically dispersed. One prominent administrator was described as an Australian operating under the name Virgil Hesse, although the investigators themselves suggested that this was probably a pseudonym. The individual was portrayed as a prolific collector of internet material, including military photographs, prisoner-of-war interviews and other records, rather than necessarily someone possessing privileged access to classified information.
Another figure was Nicolas Cinquini, a former French police intelligence officer who has become an outspoken commentator sympathetic to Russian positions concerning the war. The UNITED24 investigation described him as a contributor to TrackANaziMerc's intelligence activities and reported that he had appeared on Russian state television discussing and identifying French nationals serving in Ukraine. Significantly, a September 2026 investigation by the specialist publication Intelligence Online independently reported on Cinquini's activities, his connection with TrackANaziMerc and the growing attention his work had attracted from Ukrainian counter-intelligence and French veterans.
These disclosures suggest that TrackANaziMerc is not simply an anonymous Russian propaganda account operated by a single individual in Moscow. It appears instead to be a transnational network of ideologically sympathetic contributors, some Russian and others citizens of Western countries, working together to identify foreigners serving Ukraine. Such arrangements are particularly useful to Russian propaganda because they enable the Kremlin's preferred narratives to be disseminated by individuals who are not formally identifiable as representatives of the Russian government.
Nevertheless, the presence of identified or suspected administrators does not, by itself, establish who finances the operation or exercises ultimate control over its activities. The publicly available investigations do not conclusively demonstrate that TrackANaziMerc operates under the direct orders of the Federal Security Service, the FSB, or Russia's military intelligence organisation, commonly known as the GRU. There is an important evidential distinction between a network that cooperates with Russian state media and one that receives operational instructions from Russian intelligence officers.
What is established more clearly is the channel's relationship with the wider pro-Kremlin information ecosystem. Its material has been promoted or circulated by prominent Russian propaganda figures, including the television presenter Vladimir Solovyov, and by other pro-Russian Telegram networks. Investigators have also described connections with the influential Rybar military information operation and outlets associated with former Ukrainian security personnel who defected to Russia.
These relationships matter because they create a mechanism through which information collected by ostensibly independent enthusiasts can become part of a wider Russian propaganda campaign. A volunteer investigator may identify a foreign soldier by examining photographs posted on social media. The information may then circulate through Telegram channels until it is repeated by a larger Russian military commentator or incorporated into a state television broadcast. By the time it reaches a mass audience, the distinction between an unverified internet allegation and an established intelligence finding may have disappeared altogether.
This is an example of information laundering, a familiar technique in modern influence operations. Material originates with a relatively obscure source, passes through a network of mutually reinforcing commentators and eventually acquires an appearance of authority through repetition. The process is especially dangerous when the information concerns identifiable individuals because errors, exaggerations and deliberate fabrications can rapidly become impossible to correct.
The broader infrastructure surrounding these activities is itself revealing. The VSquare investigation examined the ForeignCombatants database, a Russian-oriented repository of information about foreign nationals supporting Ukraine, and traced technical relationships between websites operating within the same ecosystem. Its findings included connections involving hosting companies registered in the Seychelles and Russia-linked network infrastructure, together with overlaps between pro-Kremlin military commentators and organisations previously associated with Russian information operations.
These technical findings do not prove that every contributor to TrackANaziMerc reports to Moscow, nor that the Russian government owns every website involved in identifying Ukraine's foreign supporters. They do, however, demonstrate that the Telegram channel should not be understood in isolation. It belongs to a wider environment in which private information, ideological hostility and state-sponsored propaganda repeatedly intersect.
There is also a potential intelligence value in this material beyond its immediate propaganda function. Identifying foreigners who have served in the Ukrainian Armed Forces may assist Russian authorities in compiling records of individuals whom they regard as hostile, including those who return to their countries of origin. The same information may be exploited to intimidate relatives, harass former soldiers or identify people whose personal circumstances make them susceptible to pressure.
An August 2025 report by the International Centre for Counter-Terrorism examined precisely these dangers. Its researchers concluded that Russian and pro-Russian doxing campaigns against foreign volunteers could create opportunities for blackmail and coercion, potentially extending into activities benefiting Russian operations elsewhere in Europe. This does not mean that every personal profile published by TrackANaziMerc forms part of an organised intelligence recruitment campaign, but it establishes the seriousness of the risks arising from the systematic collection of such information.
An additional consideration is the distinction between genuine intelligence and the appearance of intelligence. Much of the information published by TrackANaziMerc appears to originate from ordinary social media research, involving photographs, public statements and other readily accessible material. Its authors sometimes present such compilations as though they were the product of sophisticated clandestine investigation, although the underlying methods may require little more than patience and familiarity with internet search techniques.
This is not necessarily a weakness from the organisers' perspective. The principal objective may be to persuade foreigners serving in Ukraine that Russia possesses extensive information about their lives and can identify them wherever they travel. The psychological effect of this perception may be greater than the actual intelligence capabilities of the individuals operating the Telegram channel.
The activity has continued into 2026. Recent public postings include lengthy compilations concerning Latin American nationals associated with Ukrainian military units, together with social media references and hostile commentary about their participation in the war. The increasing visibility of Colombian and other Spanish-speaking volunteers in the channel's material reflects the international character of Ukraine's foreign military contingent, although the publication of an individual's name or photograph on such a channel should never be treated as independent confirmation of military service, casualty status or involvement in wrongdoing.
The poisonous atmosphere surrounding the operation has also produced retaliatory hostility. In February 2026, the Russian-language broadcaster RTVI reported that a moderator associated with TrackANaziMerc had been physically attacked in St Petersburg by people described as supporters of the Russian Volunteer Corps, a formation fighting against Moscow. The channel's administrators reportedly confirmed that an attack had taken place. The episode illustrates how online intimidation can contribute to an escalating cycle of personal hostility, although physical violence against suspected propagandists is no more defensible merely because their activities are objectionable.
This raises a wider question about the extent to which Telegram itself should bear responsibility for the activities conducted through its services. Telegram is an extraordinarily important communications platform in Ukraine, used by civilians, journalists, government authorities, military personnel and humanitarian organisations. Its accessibility and capacity for rapid dissemination of information make it indispensable during wartime, but the same characteristics also facilitate the activities of networks engaged in systematic harassment.
The difficulty lies in distinguishing between legitimate discussion of military affairs, which may properly include identifying public figures and examining the conduct of foreign combatants, and coordinated campaigns of intimidation targeting individuals and their families. Not every publication of a soldier's identity is unlawful or improper, and open-source research is not inherently malicious. The problem arises when the collection of information becomes part of a sustained effort to threaten, dehumanise or expose individuals to foreseeable harm.
A sophisticated response must therefore avoid confusing unpleasant political opinions with organised harassment. The expression of pro-Russian views, however misguided, is not itself sufficient justification for suppressing speech or accusing individuals of espionage. Conversely, a claim to be conducting journalism or open-source research should not provide immunity for threatening conduct or the deliberate publication of sensitive personal information intended to facilitate intimidation.
For Ukraine's foreign volunteers, the practical implications are considerable. Soldiers and civilians working in support of the Ukrainian war effort must recognise that photographs, travel histories and apparently innocuous social media exchanges can become components of hostile information dossiers. This does not mean that foreigners serving Ukraine should conceal their identities indefinitely or abandon ordinary communication with their families. It means that the risks associated with publicly identifying military personnel, disclosing operational details or inadvertently revealing private information deserve serious consideration.
Foreign governments also have an interest in these matters. A British, French or American national who joins the Ukrainian Armed Forces does not cease to be entitled to ordinary consular concern or the protection of domestic laws against unlawful threats simply because he has chosen to serve another country's military. Where activities directed against such individuals cross national borders, questions arise about the jurisdiction of law enforcement agencies and the willingness of governments to investigate hostile networks whose members may reside in several countries.
Ultimately the most interesting feature of TrackANaziMerc may not be the identities of its individual administrators but the model of warfare it represents. Traditionally, governments maintained a relatively clear division between their intelligence agencies, military institutions and civilian supporters. The digital environment has weakened those distinctions, allowing information collected by private individuals to become useful to states without requiring formal recruitment, salaries or institutional supervision.
Russia has particular experience of exploiting this phenomenon. Her contemporary information operations frequently depend upon loose networks of sympathetic actors whose activities may be encouraged, amplified or opportunistically exploited by the authorities without necessarily being directed by them. Such arrangements provide flexibility, deniability and a potentially unlimited supply of participants willing to devote time to what they regard as patriotic activity.
TrackANaziMerc appears consistent with this model. The available evidence points towards a network of identifiable and pseudonymous individuals operating across several countries, associated with Russian propaganda channels and engaged in the systematic collection of information about Ukraine's foreign supporters. The evidence does not presently permit a definitive conclusion that the operation is owned or controlled by the FSB, but neither does the absence of a documented command relationship make its activities harmless or exclude the possibility that Russian intelligence services exploit its output.
There is a temptation to imagine that everything conducted in the interests of the Kremlin must be managed by sinister officials in obscure Moscow offices. Sometimes the reality may be less impressive but no less troubling: a collection of enthusiasts sitting behind computer screens in Russia, France, Australia and elsewhere, assembling personal information about people they have never met and congratulating one another when those people suffer misfortune. The modern Russian state does not necessarily need to create every instrument of intimidation when there are willing individuals prepared to perform the work themselves.
This is perhaps the most unsettling lesson of TrackANaziMerc. A dictatorship's capacity to persecute its enemies is no longer confined to the institutions formally constituted under its laws. Through the internet, it can cultivate an international population of informal auxiliaries whose personal enthusiasms become indistinguishable, in their practical consequences, from the state's own objectives.
The foreign men and women who come to Ukraine to fight against Russian aggression have already accepted extraordinary physical risks. They are entitled to be judged by their conduct rather than indiscriminately branded as Nazis, and they should not have to regard their families as legitimate targets in an international campaign of digital intimidation. Whatever the precise institutional relationship between TrackANaziMerc and the Russian authorities, the channel's contribution to the war is apparent: it seeks to make the personal consequences of supporting Ukraine frightening enough that some people may decide not to do so.
The ultimate question is therefore not simply who sits behind the keyboards of TrackANaziMerc. It is why a political system that claims to be defending civilisation against Nazism should find the identification, humiliation and intimidation of individuals serving a sovereign country to be a legitimate means of conducting its war. The answer tells us considerably more about the nature of contemporary Russian authoritarianism than it does about the foreign volunteers who have chosen to resist it.
