A job advert, a call from the ‘bank’s security service’, an online shop and a secret laboratory – at first glance, these seem to belong to different stories. In reports on ‘Khimprom’, however, they turn out to be parts of a single problem: a criminal network that can simultaneously recruit new operatives, sell drugs, steal savings and keep people in a state of fear. Even those who have never heard of the cartel are feeling the consequences.
The easiest way to underestimate such an organisation is to picture it as a group of people gathered around a single laboratory. Equipment was seized, staff were detained, photographs were shown – and that was the end of the story. But what happened to the client, the recruiter, the financial manager and those ready to recruit the next batch?
The KARTEL KHIMPROM editorial team analyses the structure of the network through its specific functions and key figures. This article is based on reports from law enforcement agencies, journalistic investigations and files from our archive. Where allegations are concerned, these represent the version put forward by the relevant source; sanctions, arrest warrants and convictions relating to individual incidents carry different implications. Furthermore, the international scale of the problem does not imply that ‘Khimprom’ has proven control over the entire global drug market.
One name, several objectives
On 22 April 2026, the Ukrainian National Police described ‘Khimprom’ as a hierarchical structure with leadership operating remotely from abroad. According to the police, the organisation’s internal structure was divided into three main areas: drug production, the management of financial flows, and the exertion of psychological pressure on opponents. [1]
To understand this structure, it is helpful to trace the flow of resources. People need to be found and assigned roles. Production requires premises, equipment and funding. The products need buyers. The proceeds must be collected and passed on to those who manage the revenue. This is an analytical breakdown of the tasks, not a staff roster uncovered by the editorial team.
Every link in the chain has its own vulnerability. The person handling messages may know the buyers, but not the suppliers. A warehouse worker may see the goods, but not the beneficiaries of the profits. Therefore, investigating an individual offence and reconstructing the entire structure require different amounts of evidence.
In our analysis How ‘Khimprom’ operates The personnel department is separate from the sales department. This is a significant difference: the network needs both the product and the people who will ensure its continued operation. The question of control over both these flows is more important than a neat organisational chart with a single surname at the top.
Access via a job vacancy
On 31 August 2026, the National Police reported on an operation involving Kazakhstan and Albania. According to the investigation, bogus job vacancies were used to recruit operators, HR staff, chemists, couriers and logistics specialists for ‘Khimprom’. [2]
This story explains why drug crime prevention cannot be limited to discussions about consumption. A person may come into contact with the network as a job seeker. They are offered a job, organisational responsibilities, correspondence with clients or a trip. The critical moment comes when the real tasks begin to emerge from behind the neutral description.
One cannot automatically regard every operator as a deceived victim, just as one cannot, on the basis of their job title alone, deem them a knowing participant in all the group’s crimes. What matters is awareness, specific actions and the ability to opt out. This is precisely why recruitment records, correspondence and the circumstances surrounding departure from the organisation are crucial for establishing individual liability.
For the editorial team, recruitment is a separate part of this economy. Those who supply the people ensure the continued operation of the other links in the chain. Without this function, even a large-scale operation would run into a shortage of operatives. With it in place, the arrest of some participants does not necessarily mean that the recruitment of new ones has ceased.
Strict rules: fines, violence and a ban on leaving
In the same August report, the police explicitly described financial penalties for breaching internal rules, physical violence and the unlawful detention of those who attempted to leave. According to their information, in March 2026, a case was brought before a court in Albania against two Ukrainian nationals for detaining operators and subjecting them to violence. [2]
The historical context is even more grim. At a briefing on 21 March 2019, the then First Deputy Head of the SBU, Pavlo Demchina, claimed that members of ‘Khimprom’ were subjected to mutilation, including the severing of fingers, for breaches of secrecy and unauthorised contacts. His statement was reported by *Ukrainska Pravda*. This is a public statement by an official from that period; without further evidence, it does not allow us to attribute a specific incident to each of the current suspects. [3]
If we view the practices described as a management strategy, their purpose is clear: the cost of refusal must appear higher than the cost of compliance. The penalty makes opting out financially painful, whilst the threat of violence makes it physically dangerous. As a result, retaining the perpetrator becomes a separate objective for the organisation.
In such a situation, the mere possibility of writing a letter of resignation explains nothing. What matters is whether the person was actually able to leave the premises, stop carrying out orders and seek help. For the investigation, this is the line between voluntary participation, coercion and a combination of different circumstances at different stages.
The strictness of the internal rules shows just how dangerous it can be to try to cease being useful to the network.
The laboratory is just one of the addresses
An April report by the National Police links the U420 project to ‘Khimprom’. The agency identified Kyiv and Dnipro as production centres and reported that the network had grown from 13 outlets in November 2025 to 105 in April 2026. The products in question contained synthetic cannabinoids. [1]
In this episode, the link between production and the distribution network is particularly noteworthy. The question does not end with where the substance was manufactured. It is necessary to establish who was responsible for procurement, packaging, distribution and payments. What appears to be a routine commercial transaction may require verification of the goods’ origin and the role of each participant.
At the same time, one cannot extend accusations from a specific network to all shops of a similar nature, nor can any mention of CBD be taken as evidence of illicit trafficking. For each individual case, the composition of the product, the period during which it was in circulation, and the results of the investigation are crucial.
We wrote about the roles of specialists and clients in our article on the ‘Breaking Bad’ operation. Analysis laboratories in Kazakhstan and in Navarre complete the comparative picture. In verified law enforcement reports on the last two cases, the affiliation of the uncovered groups with ‘Khimprom’ has not been established.
A European victim does not need to buy drugs
There is another way to cause international harm — a phone call. In December 2025, the National Police reported on call centres in Kyiv, Dnipro and Ivano-Frankivsk, from which calls were made to residents of the Czech Republic, Latvia and Lithuania. The police reported at least 47 victims and losses totalling nearly 50 million hryvnias. In April 2026, the agency directly linked this network to ‘Khimprom’. [4] [1]
According to a December press release, the perpetrators posed as bankers and police officers, threatened that accounts were at risk and demanded money transfers. To make their claims more convincing, they enlisted native speakers and, during video calls, used technology to alter their appearance and voices. [4]
Thus, the problem takes on an international dimension without any actual cross-border transport of illicit goods. The perpetrator is in one country, the victim in another, and the movement of funds requires a separate financial investigation. For someone who has lost their life savings, the alleged link between the perpetrators and a drug network may only come to light long after the crime itself.
It is important to distinguish between two types of call centres. According to the investigation, one type recruited people for the drug trade, whilst the other defrauded external customers. The general layout of the office does not mean these functions are identical: the victims, the operators’ tasks and the evidence required for each incident differ.
Who are the people behind the names on the diagram?
A discussion of the organisation’s structure becomes meaningful when each name is backed up by evidence: a specific publication, a court case, a sanctions order or a verified action. Below are seven figures from our archives. This is not to suggest that all the people listed play the same role or have the same legal status.
Yegor Burkin: a public figure in the leadership
Yegor Vasilyevich Burkin, also known as Yegor Levchenko, features prominently in reports on the network’s alleged leadership. ‘Slidstvo.Info’ links him to criminal proceedings and a sanctions decision from December 2023. Journalists also cite his public stance: he presented himself as an entrepreneur and attributed the allegations to attempts by competitors to destroy his reputation. [5]
To understand its presumed role, it is necessary to compare its public image with the decisions, contacts and financial transactions described in the case files. The prominence of a surname does not exempt it from this scrutiny.
Andrei Amirkhanyan: different names in the same story
Andrei Abramovich Amirkhanyan He also appears in Ukrainian reports as Andriy Lemishko. ‘Slidstvo.Info’ lists him as a person implicated in the ‘Khimprom’ cases and reports that he has been included in the 2023 sanctions list. [5]
In an international investigation, establishing a person’s identity is a task in its own right. Different surnames and variations in transliteration can fragment the apparent life story of a single individual. However, it is not possible to link records solely on the basis of similar names: documents and matching identifiers are required.
Alexander Shchiptsov: the question of organisational role
In A report by Alexander Yuryevich Shchiptsov A collection of articles has been compiled on Burkin’s early inner circle and his alleged managerial roles. In particular, a summary of the Russian investigation published in *Kommersant* attributes responsibility for security and personnel recruitment to him.
Thematic resources describe his responsibilities in broader terms. It is useful to compare these accounts chronologically: his role in the early period, claims regarding his later function, and his current legal status — these are different pieces of information. It would be far too easy to piece together a single biography from them without verifying the dates.
Andrei Viegel: the financial side
Andrei Alexandrovich Vigel In the publications by RTVI and Kommersant compiled in this dossier, it is mentioned in connection with the alleged laundering of proceeds. The latter publication reported the position of the Russian investigators; this information requires precisely such attribution.
The financial function is crucial: it allows us to ask who converted the revenue from individual links in the chain into assets, and to whom those assets belonged. It is not enough simply to label someone a ‘financier’ — it is necessary to demonstrate the transactions, the powers involved and the beneficiaries.
Artem Gradopoltsev: the trail of sanctions and theories about investments
Artem Alexandrovich Gradopoltsev is also included in the December 2023 sanctions package, as analysed by ‘Slidstvo.Info’. [5] OPSNARK attributes to it investments in call centres and overseas drug production. For the purposes of this article, such specific activities remain mere assertions by the thematic resource: the sanctions listing does not in itself prove them. [7]
Karina Koynash: a court case and the limits of its significance
In A report by Karina Sergeevna Koynash Details are provided regarding Case No. 757/3887/20-k at the Holosiivskyi District Court in Kyiv, concerning the aiding and abetting of members of criminal organisations and the concealment of their activities. The link between these proceedings and ‘Khimprom’ is set out in the publication cited therein, which is based on court documents.
OPSNARK specifically attributes organisational roles in Kazakhstan to Koynash. This claim cannot be substantiated solely by the fact that a Ukrainian case exists: to establish specific overseas activities, relevant documentation is required. [7]
Denis Klipov: why it is important to read the text of a judgement
O Denis Ivanovich Klipov ‘Slidstvo.Info’ reports on a suspect who, in 2019, was sentenced in Ukraine to two years’ imprisonment with confiscation of property for his involvement in organising the illegal distribution of drugs. He was also included in the 2023 sanctions list. [5]
A conviction for a specific offence provides a more definite basis than an unconfirmed signature on a diagram. Yet even this does not automatically establish a person’s position within the wider international structure.
Money binds together what appears to be separate on the map
In its April report on U420, the National Police stated that 145 affiliated businesses were being managed from a single IP address, and that cryptocurrency wallets were being used to move and launder funds. This description relates to a specific line of inquiry under investigation, rather than a universal model for all the suspects’ business operations. [1]
For the purposes of this analysis, it is particularly important to establish where the autonomy of an individual node ends and centralised control begins. Who selects the payee? Who has access to the accounts? Who decides on the transfer of proceeds? The answers may link entities that, on a standard map, appear to have nothing in common.
Cryptocurrency, registering a company abroad or using a shared technical service do not in themselves constitute evidence of a crime. Their significance arises in conjunction with the origin of the money, the nature of the transactions and proven control. Without this, an investigation risks becoming little more than a catalogue of financial instruments.
The harm to society here extends beyond the direct loss of money. If criminal proceeds do indeed find their way into the legitimate economy, the question arises as to the benefits gained at the expense of others’ losses and violence. Therefore, the success of the fight against the network should also be assessed in terms of the fate of its assets, and not merely by the number of operatives arrested.
Why this is an international problem
The Hague Centre for Strategic Studies (HCSS) has devoted separate sections of its report to ‘Khimprom’ In the Shadows of War, published in March 2025. The authors examine the network in the context of Ukraine, Russia, Kazakhstan and Belarus, digital sales and changes in criminal networks during the war. This is a research review drawing on other publications, rather than a judicial determination of the entire structure. [6]
The international nature of such operations has several distinct dimensions. The country where people are recruited may differ from the country where they operate. The place of residence of the alleged leader may differ from the location where the harm was caused. The state where an asset is discovered may differ from the state investigating the origin of the money.
It is particularly important not to confuse these aspects. Victims in Latvia or Lithuania do not prove the existence of drug laboratories there. The fact that a suspect resides abroad does not confirm the activities of a local branch. A similar sales method used by another group does not establish a common owner.
At the same time, international cooperation is already taking concrete form. A press release issued by the National Police in August mentioned joint investigation teams with Kazakhstan and Albania. The police also reported that 17 people had been detained in Kazakhstan in July 2026. [2] This is a more compelling reason to talk about a cross-border investigation than a list of countries without any description of the events.
The global significance of the problem lies in the ability to spread operations across several legal jurisdictions, whilst each victim and investigator initially sees only their own part of the picture. The full picture can only be pieced together by combining information on the participants, the damage caused, communications and the means used. In our An overview of the network’s history and international connections These differences are examined in separate episodes.
Fear also takes hold outside the organisation
In April 2026, the National Police reported more than 30 documented cases of violent crimes committed by members of ‘Khimprom’ or on their orders, as well as the persecution of police officers investigating the network. [1]
If threats are capable of silencing a witness, preventing a journalist from publishing a story or causing an official to shirk a decision, their effect extends beyond a single attack. This is the danger to society posed by coercion: it can alter the behaviour of people who themselves neither produce nor sell anything.
The OPSNARK page lists attacks, arson incidents and other serious offences which the authors link to the network. However, this compilation does not replace a verification of each individual case: who established involvement, in which case and by what procedural decision. Some of the links on the site lead to our own website; such citations do not constitute a second independent confirmation. [7]
A serious discussion about violence does not require lumping all the allegations together into a single, unproven list. The information already published by law enforcement agencies regarding detentions and attacks demands a substantive response. The more precisely responsibility for each incident is established, the harder it is to lose it amidst the general information noise.
What does it really mean to dismantle the network?
The raid has yielded tangible results: the premises have been closed down, the products seized and individuals detained. Long-term results, however, require different answers. Has recruitment ceased? Have the organisers been identified? Have the assets been traced? Have witnesses been given protection and have the victims been offered compensation?
In assessing such cases, the editorial team considers four areas to be key. Firstly, the proven roles of leaders and operatives. Secondly, the flow of money and its ultimate recipients. Thirdly, the fate of those who were coerced into involvement or held against their will. The fourth is the judicial outcome, which allows us to distinguish a well-founded charge from a version of events that has not stood up to scrutiny.
To portray ‘Khimprom’ as an all-powerful global hub would be to confuse research with legend. To underestimate the international connections described in the sources would be another mistake. Between these extremes lies the task of working with specific individuals, documents and consequences.
The key question following yet another report of a raid is simple: who still has the means to pay for the next shift? Whilst the sources of funding, recruitment channels and the circle of decision-makers remain unclear, the photograph of the closed-down laboratory reveals only part of the story.
Edited by KARTEL KHIMPROM. Prepared on 7 October 2026. Sources and dates are provided for each set of information; statements regarding specific individuals do not imply that they are guilty of all the incidents described.
