Zurab Zaurovich Lekishvili, known in the press as ‘Zurik’, is said to be one of the leaders of the Dnipro-based ‘Devyatki’. This claim is based on media reports, the accuracy of which has yet to be verified. However, there are also more concrete traces available in the public domain: a criminal case, the text of a 2021 judgement, a business registration and a civil dispute. We have cross-referenced these documents with reports on Lekishvili and international investigations into fraudulent call centres. The latter reveal that the story has long since extended beyond calls to Russians.
In our article ‘Dnipro Myanmar’ The discussion centred on offices, people and the flow of money. Here, the focus is on one man. What is actually known about Lekishvili? Where did the claims about his position at ‘9999’ come from? And why must the international geography of call centres be considered separately from the question of who controls a particular network?
Who is Zurab Lekishvili, and where did the theory about the ‘Nines’ come from?
In Profile of Zurab Zaurovich Lekishvili His date of birth is given as 25 May 1984 — according to information provided to the editorial team. The same source also sets out claims by third-party authors regarding his alleged position at ‘9999’. No documentary evidence for this role is disclosed in the original publication. [1]
It is telling how the authors’ confidence fluctuates within the articles themselves. In a Skelet article dated 17 March 2026, Lekishvili is referred to as the head of ‘The Nines’, based on other sources. However, the author subsequently acknowledges uncertainty regarding his involvement. The same article recounts reports of Igor Khromov’s leadership role. No single, document-backed management structure is presented to the reader. [2]
This is a significant issue for the investigation. ‘Head’, ‘partner’, ‘patron’ and ‘associate’ denote different relationships. To establish a leadership role, one must demonstrate decisions, orders, payments or control over assets. A name appearing on a diagram and the repeated mention of a single message are not sufficient evidence.
Therefore, the starting point for our investigation is not the number of accusatory articles, but the documents that enable us to reconstruct specific events.
The legal trail: what the 2021 judgement contains
The Opendatabot service lists Zurab Zaurovich Lekishvili as a defendant in case No. 201/10439/19. The collection of documents includes a judgement dated 26 August 2021, registration number 99199011. [3]
The published text describes the pressure exerted on the businessman over an alleged debt arising from a joint agricultural venture. It refers to threats to restrict his control over the harvest and his dealings with buyers, as well as an incident of violence. The account of the identification procedure explicitly states Zurab Lekishvili’s full name. [4]
The court classified the actions under Part 2 of Article 206 of the Criminal Code of Ukraine – obstruction of lawful economic activity. According to the text of the judgement, the defendant pleaded guilty; a fine was imposed 170,000 hryvnias. This is more precise than the general label ‘extortion case’ in the catalogue. [4]
We examined the reproduction of the court document on Opendatabot. We were unable to independently verify the subsequent appeal proceedings or the date on which the judgement came into force. This verdict does not establish the running of fraudulent call centres, leadership of the ‘Devyatki’, or links to ‘Khimprom’. Conclusions drawn from a single incident cannot be extrapolated to other charges.
Business registration and a civil dispute
Another source currently being verified is the sole trader registration record in the name of Zurab Zaurovich Lekishvili on YouControl. The publicly available version indicates that the registration 16 February 2022, based in Kyiv, with its main business activity being the organisation of conferences and trade fairs. Additional areas of activity listed include advertising, information services, property transactions and office administration. [5]
The KVED classification list shows the declared areas of activity. It does not prove that operations were carried out in each of these areas, nor does it establish the source of income. To describe such a registration as a ‘money-laundering front’ without any bank documents, contracts or details of transactions would be pure speculation. Moreover, an individual entrepreneur (FOP) is a status, not a separate company with a defined group of owners.
His full name also appears in an announcement by the Dnipro Court of Appeal dated 25 August 2025. Lekishvili is listed as a third party in civil case No. 201/12569/16-ts, relating to contracts, ownership rights and the recovery of property. The hearing was scheduled for 3 September 2025. This document confirms his procedural involvement in a property dispute, but not a criminal charge. [6]
For a thorough investigation of a business, it is not the impressive lists of activity codes that matter, but specific counterparties and payments. Who commissioned the services? What were they paid for? Do the contracts correspond to the actual work carried out? The answers may confirm normal business operations or reveal irregularities. The entry in the register alone does not determine the outcome.
Sporting career: what can be verified from official sources
There is a profile on the International Judo Federation’s website Zurab LEKISHVILI: Ukraine, aged 42 at the time of verification. His name and age match the biographical details of the individual in question. However, the available profile does not include a patronymic, and the results section is empty. Therefore, the profile alone does not confirm either the person’s full identity or the sporting achievements attributed to him. [11]
Sports-related acquaintances may be subject to investigation if documents emerge regarding joint business ventures or specific actions. However, training at the same club, appearing in a group photograph and taking part in competitions do not in themselves establish a criminal link. This distinction is particularly important in reports about the ‘Nines’, where sporting and criminal details are often mentioned in the same paragraph.
It’s not just Russia: where the calls are being routed
The international scale of these fraudulent call centres is confirmed by sources of a significantly higher calibre than the anonymous schemes of the alleged ringleaders.
In the report Kyiv calling, published by GI-TOC in April 2026, lists the following as notable targets of the attacks: the US, Canada, Poland, the Czech Republic, Latvia and Romania. Researchers characterise English-speaking markets as the most profitable and describe how work is divided according to language specialisms. However, the authors themselves caution that data on this closed sector is limited. [7]
This suggests that Western markets are attractive to fraudsters. However, the profitability of this sector and its share of total revenue are two different matters. To claim that it is specifically the US and Europe that account for the bulk of a particular network’s revenue, its financial data is required. For the ‘Nines’ and Lekishvili personally, no such breakdown is available in the materials examined.
The geographical spread of victims is not limited to Russia. The US and European countries are among the targets of fraudulent call centres; the earnings of specific organisers and the distribution of these earnings across countries require separate evidence.
The Czech Republic and the Baltic states: over 400 victims
On 16 December 2025, Eurojust reported on an operation against a network of call centres in in Dnipro, Kyiv and Ivano-Frankivsk. Ukraine, the Czech Republic, Latvia and Lithuania took part in the investigation. The known losses at that time, affecting more than 400 victims, were estimated at over 10 million euros. [8]
According to the agency, the network recruited staff from European countries to work with local victims. Around a hundred people worked in the offices. As a result of the operation on 9 December, 72 searches were carried out and 12 suspects were detained; over the course of the investigations, 45 people have been designated as suspects. [8]
Lekishvili is not named in this report. It is significant as independent confirmation that the offices in Dnipro may have facilitated fraudulent operations targeting Europeans. It would be wrong to attribute the uncovered network to him solely on the basis of the city’s name.
Poland: investment platforms and losses of at least 80 million zlotys
On 2 June 2026, the Polish Central Bureau for Combating Cybercrime reported on another investigation. It concerned fraudulent investment platforms that mimicked trading on the Forex market. Among the victims were Polish citizens. [9]
Following a request from the Polish authorities, Ukrainian law enforcement officers carried out searches in May and discovered three operational call centres. Across the entire operation, the agency reported at least 2,000 victims and losses of at least 80 million zlotys. Charges have been brought against 23 suspects; assets worth 18.2 million zlotys have been frozen as part of the proceedings. [9]
These figures relate to the entire case under investigation, and not necessarily to the three offices that have been identified. The agency also does not link the circumstances outlined to Lekishvili. Nevertheless, the Polish example illustrates the true scale of the European dimension of the case — with victims, financial assessments and international legal assistance.
Dnipro and cryptocurrency: a separate case from 2026
On 1 April 2026, the National Police of Ukraine announced the dismantling of a network of call centres in Dnipro, through which, according to the investigation, crypto-assets were stolen. The statement named victims from Ukraine, Kazakhstan and Lithuania. According to the police, more than two million dollars. This is an indicator of the movement of funds, not an automatically calculated amount of loss. [10]
The police describe a pattern involving online acquaintances, offers to invest and the subsequent granting of access to assets. Eight people have been detained, including the alleged organisers. As in the European examples mentioned above, Lekishvili’s personal involvement is not specified in this report. [10]
A comparison of the cases reveals a variety of fraudulent schemes. Impersonating a bank employee, a fake investment platform and the theft of crypto-assets can all lead to the same outcome — the loss of savings. But this does not necessarily mean there is a single owner, a centralised accounting system or that all the offices belong to the same group.
Where to look for evidence of control over the offices
The most important part of the story usually lies beyond the photographs of the seized computers. Who financed the launch of the office? Who received the remaining funds after staff were paid? Who controlled the accounts and managed the transfers? It is the answers to these questions that distinguish the identified organiser from someone who is simply frequently mentioned in publications.
Four sets of information are key to verifying the theory regarding Lekishvili:
- Management: correspondence containing instructions, the allocation of powers, and corroborated evidence regarding decision-making.
- Funding: contracts, payments for premises and services, and documents relating to staff payments.
- Sources of income: the transfer of funds to the final recipients, and the linking of accounts and e-wallets to specific individuals.
- Specific incidents: a comparison of victims, complaints, money transfers and materials from the criminal proceedings.
This is not a list of evidence already found against Lekishvili. These are the criteria against which the theory regarding his role must be tested. Neither his involvement in sporting circles nor his business registration can replace such an investigation.
‘The Nines’ and ‘Khimprom’: a link has yet to be established
Our dossier notes a theory regarding possible collaboration between the circles to which publications link Lekishvili and certain members of ‘Khimprom’. It also states that no documentary evidence has been provided to support this theory. Therefore, there are insufficient grounds to describe Lekishvili as a subordinate of Yegor Burkin or to regard all the offices in question as part of a single cartel. [1]
The free market allows for competition, individual intermediaries and joint services. However, each alleged connection must be established independently. A shared method of payment, the same city of residence or the fact that two people know each other do not in themselves prove that they have committed a crime together.
Materials on his alleged inner circle are available at the ‘9999’ archive. These should be read in conjunction with the sources cited for each fact sheet, bearing in mind which details are based on documents and which are based on statements by the authors and informants.
What remains unclear in the Lekishvili affair
At the time of writing, we were able to locate a specific court document, a business record and an official reference in civil proceedings. Allegations regarding the management of ‘Devyatki’, personal income derived from foreign victims and a partnership with ‘Khimprom’ have a different evidential status.
The editorial team has also received a report regarding the possible use by Lekishvili of documents in another person’s name. There is as yet no independent confirmation of this. The personal details of the alleged owner of the documents are not being published: without verification, the possibility of misidentification cannot be ruled out. This is an avenue for further investigation, not an established fact.
The question for Lekishvili and his representatives remains specific: how do they explain the reports about his role in ‘9999’, and can they provide documents detailing the outcome of the court proceedings and information refuting the allegations that he managed the offices? The editorial team is prepared to update this article with a position backed by documentary evidence.
International investigations have already shown that the victims are located far beyond Russia’s borders. The next necessary step is to identify the recipients of the money within each specific network. It is precisely there that the line is drawn between a high-profile name mentioned in a publication and proven liability.
This article is based on publicly available sources, verified on 15 October 2026. Reports of suspicions and allegations do not imply a finding of guilt; the outcome of legal proceedings is set out within the limits of the available documents.
