A private house for staff, an office disguised as a car parts shop, and around twenty people looking for couriers, drivers and chemists. This is how a former operator described the Kartel Khimprom’s operations in the Bila Tserkva area in 2025. His letter also mentions another name – ‘Mamba’. According to him, this was the name given to the recruitment team in Cyprus. Our journalists are already on the island and are gathering information on the ground. We are publishing excerpts from the letter and comparing the account of recruitment methods with reports from the Ukrainian and Kazakhstani police.
A letter from a former operator
The author of the letter states that he worked as an operator from early spring until August 2025. He was introduced to the team by an acquaintance with whom he had previously worked in call centres. According to him, he knew what he was getting into, but agreed to the role partly because of a promise to help him leave the country. In the letter, he describes in detail two Ukrainian teams, the recruitment process and what he had heard about the overseas offices.
“I have information relating to drug trafficking, but I won’t be able to confirm it or send evidence to the media.”
The interviewee explained that he was afraid of the consequences if he were caught gathering evidence. The editorial team received his written account. He speaks about Bila Tserkva and Kyiv as someone who worked there. In the letter, he does not mention that he worked at the Cyprus office or that he had personally seen it on the island.
What the editorial team found out about the ‘Mamba’ office
According to the former operator, the name ‘Mamba’ came from the nickname of the man who led the Cypriot team. He explains that, in the circles he was familiar with, nicknames were known as ‘naves’ and were used in everyday conversation. Therefore, the same word in his account may refer to both the team leader and the office. The source did not provide any material that could be used to verify the team’s place of work, its composition or its reporting lines.
“What surprised me most was the branch in Cyprus, called ‘Mamba’.”
Another source contacted by our editorial team links the nickname ‘Mamba’ to a woman. According to him, she has a husband and a child. He also claims that her husband was involved in the network’s activities. Our editorial team is treating this claim as a separate line of inquiry. We do not yet have any documentary evidence of his alleged role.
The Cyprus angle came up in the editorial team’s conversations with several sources. To verify this, it must be established separately whether the name ‘Mamba’ was used, whether operatives were based on the island, and whether there is any verifiable link between this team and ‘Khimprom’s’ recruitment centres. There is as yet no confirmation of the Cyprus theory in the publicly available materials examined.
The name of a foreign base can mean different things. The team might have been based in one country, liaising with candidates from another, and recruiting operatives to work in a third. This is precisely the division seen in the case published by the Kazakh Ministry of Internal Affairs, where staff at offices in Kyiv were recruiting stashers and packers to work in Kazakhstan. Therefore, in the Cyprus version, the editorial team is checking separately where the people involved in the correspondence were based, where they were offered work, and who made the hiring decisions. Statement by the Kazakh Ministry of Internal Affairs regarding call centres in Kyiv.
Bila Tserkva. A house for operatives and an office disguised as a car parts shop
Upon arriving in Kyiv, the source writes, he and an acquaintance were taken to the Bila Tserkva area. They lived in a large private house in a quiet neighbourhood. They worked in a separate building, which, according to him, was passed off as a car parts shop. These are two different locations mentioned in the source’s account. The letter contains descriptions of both, though the street name and house number are not specified. We have checked publicly available reports of searches but have not yet been able to establish the exact address of the office.
“There were about 20 people working there; the operatives were looking for ‘personnel’ (couriers, drivers, chemists, etc.), whilst the senior staff passed on details of the personnel and provided the contacts of the supervisors.”
According to the interviewee, there were two people at the workplace who were referred to as ‘sportsmen’. They were responsible for maintaining order and safety. The author of the letter claims to have witnessed them severely beating an employee whom they suspected of stealing 1,000 hryvnias from a colleague. The editorial team has not yet received independent confirmation of this specific incident. In the materials of the international investigation, the police described separately the use of violence against staff at recruitment offices. Statement by the Ukrainian National Police on recruitment centres.
According to the source, the operators worked on inexpensive laptops that were easy to carry around. Filming inside the premises was prohibited. He also recalls that local taxi drivers told him about the nature of the office’s work. The claim that the same building had previously housed a fraudulent call centre is also based on stories he had heard. For now, this information helps to describe exactly what the editorial team is looking for in Bila Tserkva.
How recruitment via fake job vacancies began
The initial contact might have appeared to be a standard offer of part-time work. A former operator recalls job adverts for porters and other advertisements for what, at first glance, seemed like legitimate work. Mass messages were sent out via Telegram, VKontakte and other platforms. According to him, each operator chose their own method of searching. The actual role was only revealed during the conversation. Most often, candidates were offered work as stashers, although the teams were also looking for people to transport and manufacture drugs.
‘Among other things, they posted adverts under the guise of legitimate job vacancies, such as “loaders wanted…”’
The Ukrainian National Police described a similar modus operandi in a statement regarding an international operation against ‘Khimprom’. According to the investigation, fake job advertisements were used to attract candidates, who were then assigned specific roles. The police list includes operators, recruiters, chemists, couriers, stashers, logistics staff and warehouse workers. This network sought both those who would carry out the tasks and those who would recruit new members. Statement by the National Police of Ukraine dated 31 August 2026.
For a candidate, the change in conditions could take place gradually. At first, they were promised a salary for a straightforward job. Then the recruiter would offer a different position and pass the candidate’s details on to the next person. According to the operator, teams were given an Excel spreadsheet setting out age requirements for different cities. At the registration stage, he explains, candidates were asked to provide a photo with their documents or a deposit. The details provided by the supervisor, he says, were only valid for a limited time. Of particular value to the editorial team are cases where both the original advert and the correspondence in which the terms changed have been preserved. Together, they show exactly how a person was drawn into the scheme.
Who sought out candidates and who managed their data?
According to the source, a regular operator handled the initial correspondence. A senior member received information about candidates and passed on the supervisors’ contact details. Consequently, two people from the same team might have seen different parts of the process. One knew which job advert the applicant had responded to, whilst the other decided where to direct them. Each person’s testimony must be cross-checked against their role and the conversations they may have personally witnessed.
According to the source, the typical target was to recruit three candidates a week. A bonus was paid for meeting the target. He estimates the basic pay at 6,000 hryvnia a week. The money was paid in cash. According to him, it was delivered to the bases by a man known as ‘Vova’. Each operator had a four-digit code, which changed when they moved to a different team. The interviewee claims that the basic pay was paid for the first two months and that, after a change of base and code, this period would start afresh. Teams that failed to meet their quota could be disbanded, and staff reassigned to other locations.
In June 2026, the Kazakh Ministry of Internal Affairs reported the arrest of 11 people following a May operation in Kyiv and specifically noted that the investigation had distinguished between organisers, senior operatives and rank-and-file recruiters. The ministry reported the seizure of mobile phones and computers. At the time of the report, investigators were analysing the seized equipment, identifying the organisers’ accounts and conducting a separate financial investigation. It is precisely this evidence that allows them to cross-reference statements with correspondence and establish who was in charge of the recruitment drive. Documents from the Kazakh Ministry of Internal Affairs on the May operation.
The Kyiv base, mailings and a sudden departure
Later, the source says, he moved to the Kyiv base, which was considered more prestigious within the organisation. There, he says, there were no ‘sportiks’, and the operators chose their own search methods. At the same time, attempts to resign were treated more harshly than in Bila Tserkva. A separate senior staff member was in charge of Telegram. Together with an IT specialist, he attempted to develop his own tool for mass messaging from multiple accounts, which the source compared to Telegrand. According to him, there were no other Telegram specialists of that calibre in their unit.
The letter also contains an account of an alleged payment for an employee who, according to the source, was detained by representatives of the TCC. The source claims that $10,000 was paid for him, and the sum was subsequently recorded as a debt that he was required to work off. The letter does not state that the source witnessed the handover of the money. The editorial team has not received any documents confirming the payment or its recipient.
The source describes one incident at the Kyiv base from a first-person perspective. One afternoon, a senior officer ordered the staff to pack their belongings immediately and find a flat. According to him, the money for the rent was paid from the team’s budget. The operators took their laptops and were given permission to return that very evening. The IT specialist remained at the base. The interviewee does not specify the reason for the urgent departure and states that no data storage devices were destroyed whilst he was present.
Where they recruited staff from, and what the source heard about the overseas offices
According to the former operator, Ukrainian teams were looking for recruits in Russia, Belarus, Kazakhstan, Tajikistan and Uzbekistan. As he described it, Ukraine was where the operators were based, whilst recruits for drug trafficking were sought outside its borders. He recalls a specific operation in Moscow and the Moscow region. According to him, the team believed that some Moscow coordinators were sending recruits to addresses where people were waiting for them in a car or a patrol. The editorial team does not have any information enabling it to establish who was waiting for the recruits or whether the handlers were aware of this.
The source also mentions a similar office in Odessa and speaks of activities in Spain, Bulgaria and Cyprus, and, in 2025, in Germany. He gives a specific example regarding Bulgaria. According to him, a former assault team member from his unit deserted his unit without permission, left Ukraine and ended up in Bulgaria. There, according to the source, a similar office was operating. The source says that recruitment was also taking place there, but was unable to specify whether they were looking for operators or couriers. He does not mention any personal visits to the overseas offices listed. The editorial team is verifying each location separately.
How people were kept within the network
At the outset, the source claims, he was promised help in leaving the country. According to him, the condition for such assistance was that he work for the network for a year. He explains that at the time, due to age restrictions, he was unable to leave through the normal channels. It is not possible to determine from the letter how many employees actually took up this offer or who organised their departure.
Official documents show that investigators looked into the pressure exerted on those who tried to leave the network. The National Police of Ukraine and the Ministry of Internal Affairs of Kazakhstan reported fines, beatings and unlawful detention in the cases under investigation. In March 2026, according to the Ukrainian police, the case of two Ukrainian citizens was referred to court in Albania. According to the investigation, they had detained operators at recruitment centres and subjected them to violence. A public statement confirms that the case has been referred to court. Ukrainian National Police · Kazakhstan’s Ministry of Internal Affairs.
The polygraph and the fraudulent office. A separate episode from 2026
According to the author of the letter, in January 2026 he took up a post at another office, which he describes as fraudulent. During a polygraph test, he was asked whether he had communicated with journalists, government officials or law enforcement agencies. The interviewee recalls that the NABU and the SAP were specifically mentioned. There were also questions about criminal convictions, debts, addiction and instances where an employee had cheated colleagues out of money. According to him, he passed the test, even though he replied that, given the opportunity, he might have defrauded the office of money. He resigned in February. His personal experience of the polygraph test relates to this recruitment process. The editorial team has not yet received any information indicating that a similar screening was carried out at the ‘Mamba’ office.
According to the source, in January that fraudulent office was authorised to target Russian-speaking audiences in Germany and other European countries. The source describes how the minimum deposit demanded from victims fell from $500 to around $100. According to his observations, the number of victims and staff was dwindling, whilst recruiters, when making new calls, denied that they were offering jobs at a fraudulent call centre. The most recent similar offer he mentioned was for remote work. This is a separate thread in the correspondence. The editorial team has not established a link between this and drug recruitment or ‘Mamba’.
What investigators in Ukraine, Albania and Kazakhstan have established
The Ukrainian National Police have published a timeline of the operation carried out by three countries in 2025–2026. It shows that behind a single report on the dismantling of call centres lay operations across several jurisdictions and various criminal incidents.
- August 2025, Ukraine. According to the National Police, 26 searches were carried out at call centres. Investigators seized around 4,000 pieces of digital evidence. Analysis helped identify 31 Telegram shops and hundreds of recruited individuals, whose possible involvement in drug trafficking was being investigated in Kazakhstan.
- March and May 2026, Albania and Ukraine. In Albania, the case files relating to the detention of operators have been referred to court. In May, the police reported that 70 searches had been carried out and that recruitment centres in Kyiv and the Kyiv region had been shut down.
- July 2026, Kazakhstan. As part of the joint operation, 15 searches were carried out. The Ukrainian police reported that 17 people had been detained in connection with this case.
- 24–25 August 2026, Ukraine. According to the National Police, law enforcement officers carried out 35 searches, dismantled two branches of the network and detained seven people. Nine individuals were served with notices of suspicion, including the alleged leader and co-organiser, who was charged in absentia.
Ukrainian National Police report dated 5 November 2026 · Statement from the Kazakh Ministry of Internal Affairs on an international operation.
This timeline confirms that law enforcement agencies investigated international recruitment and identified specific Ukrainian centres. Cyprus does not feature in the published description of the operation. The editorial team has not yet been able to link the premises, disguised as a car parts shop in the Bila Tserkva area, to any searches carried out as part of this operation.
How a similar recruitment operation was documented in Moldova
A specific example of the traces left by such an office has been published by the Moldovan police. In February 2026, they reported that searches had been carried out in Chișinău as part of an investigation into the recruitment of people to transport and store drugs in Moldova, EU countries and the CIS. According to the investigation, the job advertisements for the couriers themselves concealed the nature of the work, whilst tasks and instructions were given via Telegram. The police reported that during the search they identified ten couriers and seized equipment. The report makes no mention of any link between this group and ‘Khimprom’ or ‘Mamba’. Moldovan police documents.
The Moldovan case shows that even people recruited to work at computers could have been misled. Therefore, two different types of testimony are valuable for the Cypriot investigation. Job applicants can describe how the terms of the vacancies changed. Former operators can explain what tasks they were given after being hired and who was responsible for selecting candidates. Comparing these accounts helps to establish whether people are describing the same team.
What the local media have already reported about call centres in Cyprus
In September 2026, the Cypriot publication SigmaLive reported on an investigation by the Ukrainian outlet Glavkom. ‘Glavkom’ journalists, who had been in contact with recruiters, were offered jobs involving relocation, including to Cyprus and Bulgaria. That article referred to offices which, according to the journalists, were defrauding people through financial schemes. SigmaLive explicitly stated that it had not independently verified this information. The reports by ‘Glavkom’ and SigmaLive in this instance are based on the same conversations with recruiters. An investigation by Glavkom · Published by SigmaLive.
This is a key distinction for the Cypriot investigation. In one scenario, operators seek out people who can be drawn into drug dealing. In the other, they call potential victims and try to get hold of their money. Job titles, messaging apps and promises of relocation may be the same. To conclude that there is a link, one needs common contacts, correspondence, financial trails or documents that can be independently verified. In the articles published by Glavkom and SigmaLive, the editorial team found no such information regarding the ‘Mamba’ office.
Also, look out for our report on a similar office in Bulgaria that recruits so-called ‘mules’.
Journalists from Kartel Khimprom are already working in Cyprus
Our team of journalists is in Cyprus gathering information on the ground. We are establishing the context in which people have heard the name ‘Mamba’, what they know from their own experience, and what information can be linked to incidents already known to us. We are particularly interested in cases where a person was invited to take up a regular job, only to be asked subsequently to recruit others or transport illicit substances, and where their wages were withheld or they were threatened after refusing.
If you have been affected, come across a job vacancy like this, worked in a similar team or witnessed pressure being exerted, please write to us. We are looking for people who can tell us about the office in the Bila Tserkva area or about the ‘Mamba’ team in Cyprus. For your initial message, simply give a brief description of where and when this took place, what work you were offered, and what changed after the first contact. If you already have a job advert, correspondence or other materials, please let us know. Please indicate a safe way to contact you. Contact details for the editorial teams of Kartel Khimprom and Signal.
If you can provide further details regarding this article or wish to respond to the account given, please use the same editorial contact details. The editorial team will review any messages received and update the article should new, verified information come to light.
