An office can disappear overnight. The network it served, however, remains. The closure of the premises, the arrest of the operators and the seizure of computers do not yet answer the questions: who financed the operation, who supplied the staff, who owned the customer databases, and who controlled the revenue? In the story of ‘Khimprom’, it is precisely these connections that help us understand why reports of a crackdown coexist with new investigations.
In Part One of the analysis of the ‘Khimprom’ structure We have separated the HR and sales divisions and raised the question of ultimate control. We are now expanding the model: adding fraudulent offices, technical maintenance, cash flows, coercion and corruption risks. We are examining Kazakhstan, Moldova and Poland separately — three areas where it is crucial to distinguish between a confirmed incident and the assumption that the entire organisation is involved.
This material is based on publicly available reports from law enforcement agencies and journalistic investigations. The fact that the agency reported the incident does not amount to a conviction of all the individuals mentioned. The diagram below is a functional reconstruction based on several sources, rather than an actual organisational chart of a single enterprise.
Different systems may operate under a single brand name
The word ‘office’ works well as a headline but is insufficient for an investigation. In one room, they might be recruiting operatives; in another, processing orders; and in a third, swindling money out of victims. Technically, such premises may look similar: workstations, telephones, shift supervisors. But their functions and sources of income differ.
Consequently, the new diagram comprises three main branches. The first provides personnel. The second relates to the production and distribution of illicit substances. The third concerns telephone and investment fraud. Financial, technical and security support are shown separately. This avoids having to classify every identified role as a separate unit and prevents different criminal incidents from being lumped together under a single, vast figure.
The most important issue in such an analysis is not the number of rectangles drawn. What matters is what substantiates the transition between them: correspondence, a specific payment, an instruction, witness statements, or merely the author’s assumption.
Notes on the diagram: the red blocks contain information from sources; the grey connections explain functions and do not indicate personal reporting lines. Versions and gaps are highlighted in amber. The geographical blocks should be read separately: not every country shown in the diagram represents a confirmed ‘Khimprom’ branch.
First area of focus: the ongoing search for talent
In National Police press release dated 31 August 2026 recruitment via fictitious job vacancies is described: people were recruited for roles as operators, HR staff, chemists, couriers and logistics specialists. The agency linked this network to ‘Khimprom’ and reported on joint efforts with Kazakhstan and Albania.
The nature of the recruitment process itself is key here. Networks require staff with a range of skills, so the HR function is not limited to finding a street courier. The loss of a single branch can create a need for new staff in several places at once: replacements are needed, as well as training and the reallocation of responsibilities. This is an analytical explanation of the importance of recruitment, rather than a fixed headcount for specific departments.
The outward resemblance of a job vacancy to a standard job offer can obscure its true nature. To assess an individual’s liability, it is necessary to establish what they were promised, what they knew, when they became aware of the unlawful actions, and whether they were free to withdraw their involvement. The mere fact of working on the premises does not in itself describe the full extent of their role.
The second area: from production to revenue
In April statement by the National Police regarding ‘Khimprom’ The U420 project occupies a special place. The agency referred to Kyiv and Dnipro as production centres and reported an increase in the number of retail outlets from 13 in November 2025 to 105 in April 2026. These figures relate to the specific area described, rather than the size of the entire international network.
Production, storage, transport, sale and receipt of money are distinct activities. In an investigation, these must be linked in sequence. The discovery of a laboratory does not automatically reveal the owner of every shop; the general appearance of the packaging does not prove the existence of a single organiser. Information is required on the origin of the consignments, their distribution and the financial transactions between the parties involved.
In the diagram, these functions are grouped into a single branch, but this does not mean that each element corresponds to a separate manager or that all products followed the same route. This model is useful for interpreting documents: it shows which link is missing from the explanation of a specific case.
The third area: an office that thrives on trust
On 16 December 2025, the Ukrainian police reported on fraudulent call centres in Kyiv, Dnipro and Ivano-Frankivsk. The victims were said to be residents of the Czech Republic, Latvia and Lithuania. The operators posed as bank staff and law enforcement officers. In an April 2026 statement, the National Police linked this previously uncovered network to individuals involved in the ‘Khimprom’ case.
The December release describes the division of responsibilities between shift supervisors, operators, interpreters, technical specialists, HR staff and mentors. According to the police, native speakers of the victims’ languages and technologies for altering appearance and voice were used to make the scam more convincing. At least 47 victims have been identified, with losses amounting to nearly 50 million hryvnias.
An important distinction: such an office receives money directly from the victim, whereas a recruitment office provides staff for someone else’s operations. They can only be grouped together where sources indicate common organisers, resources or management. The term ‘call centre’ alone is not sufficient for this.
There is a practical lesson here for the reader: a persuasive manner of speaking, familiar language and a person’s appearance during a video call do not confirm their authority. In the incident described by the police, trust in institutions became part of the deception itself.
Finance department: who features on the payslip and who makes the decisions
The April report on U420 contains a specific indication of alleged centralised control: the police stated that 145 affiliated business operators were being managed from a single IP address. The agency also reported the use of cryptocurrency wallets. This is the investigation’s version of the financial infrastructure it has described.
The distinction between the formal owner and the actual controller is significant. The name on a bank document answers one question: in whose name the account is held. It does not always answer the other: who gave the instructions and received the ultimate benefit. Establishing control requires a comparison of documents and actions, rather than speculation based on a single surname.
A shared network address cannot, either, be regarded as conclusive evidence of centralised criminal control. It may be one of several indicators taken together, but on its own it does not identify an individual nor does it explain the legality of all operations. In this article, we cite it as a detail from the police report, not as the result of our own technical investigation.
In the new diagram, the finance function is aligned with both revenue streams. This raises an analytical question: are there any common administrators? From the available materials, it cannot be concluded that all the funds mentioned in various cases invariably flowed into a single cash desk.
Technical support and coercion — different ways of maintaining the system
The technical function ensures the operation of communications and digital services. Coercion keeps people in line and suppresses resistance. It is useful to distinguish between them: a qualified specialist, a security guard and the organiser of an attack do not become one and the same participant simply because their actions may have served the overall structure.
The National Police’s August press release refers to fines, violence and the unlawful detention of those who attempted to leave the system. It also states that in March 2026, a case was brought before a court in Albania against two Ukrainian citizens in connection with the detention of operators and the use of violence. In an April statement, the police separately announced the persecution of opponents and staff members who had been investigating the community’s activities.
For the purposes of analysis, this means that the network’s stability cannot be explained by revenue alone. Fear may prevent a person from leaving, providing information or giving evidence. However, every allegation of violence must have its own evidential basis: the victim, the circumstances, the alleged perpetrators and the link to the instigator. A general description of the organisation does not replace the establishment of a specific incident.
Corruption: no longer just a journalistic hypothesis
On 22 April 2026, the Head of the National Police, Ivan Vygovsky, spoke publicly about the corruption within ‘Khimprom’. According to according to a report by ‘Interfax-Ukraine’ from the briefing; he mentioned law enforcement officers, including police officers, and other officials, including MPs. This is an attributed statement by the head of the department, not a published list of those convicted.
Why is this issue important for the organisation of the network? Potential unlawful assistance from officials alters the conditions under which it operates. Advance warning of an inspection, interference in a decision or the disclosure of confidential information can influence the outcome of a criminal case. The areas for analysing corruption risk are listed here; the article does not claim that every such mechanism has been proven in relation to ‘Khimprom’.
It is particularly important to distinguish between corruption and threats. In one instance, an official may receive a benefit in return for assistance; in another, they may be subjected to pressure. The mere fact that a police officer has been threatened does not mean that they are working for a criminal network. Nor can the existence of a bribe be automatically inferred from protracted legal proceedings.
The editorial team is examining the theory that offices linked to ‘Khimprom’ and corrupt contacts in Moldova, Poland and Kazakhstan have become more active. The open sources verified for this publication do not allow such increased activity in all three countries to be presented as an established fact. In the new diagram, this version is shown separately from specific police incidents.
Kazakhstan: a specific international line of inquiry
The Kazakhstan operation is directly linked to ‘Khimprom’ in the aforementioned August statement by the Ukrainian police. The agency stated that in July 2026, 15 searches were carried out in Kazakhstan and 17 individuals were detained, whom the investigation linked to drug trafficking and a criminal organisation.
This is more substantial than an assumption based on the geography of the trips. There is a specific instance mentioned in the international investigation. However, this does not provide grounds for automatically concluding that every recruitment office described in the press release was located on Kazakhstani territory, or that the involvement of local officials has been established.
In the diagram, the country is therefore marked as a region explicitly named in the ‘Khimprom’ investigation. Corruption-related contacts and the expansion of office infrastructure have been separated into a distinct area under investigation. The number of those detained relates to a specific stage of the operation and does not represent an estimate of the total size of the network in the country.
Moldova: the existence of the fraudsters’ offices has been confirmed, but their ownership has not
On 18 February 2026, the Moldovan police reported regarding a joint investigation with Romania into investment fraud. A call centre was uncovered in Chișinău; according to the investigation, the organisation employed operators, administrators, managers and coordinators. The report named 26 accused individuals. The investigation was conducted in cooperation with Europol and Eurojust.
The materials seized included accounting documents and tenancy agreements. The police also reported that they were analysing cryptocurrency flows. This is an example of how such evidence can be used to move from the discovery of an office to establishing its activities and connections.
In this report by the Moldovan police, the network is not referred to as a division of ‘Khimprom’. We are citing this episode to provide regional context; we are not attributing someone else’s case to the well-known cartel. The similarity in job titles and methods of fraud is not sufficient to conclude that they share a common owner.
For the theory regarding the Moldovan connection, verifiable links are essential: the same administrator, a joint contract, a payment with a specified purpose, or confirmed correspondence. Without these, a point on the map gives the impression of certainty that the investigation does not yet possess.
Poland: a place for victims, a police operation or an office location?
On 19 February 2025, the Polish police reported regarding a joint operation with Ukrainian colleagues to combat investment fraud. The operation took place on Ukrainian territory. It was reported that six key suspects had been detained, including employees, managers and the alleged ringleader. According to the agency, a search of the latter’s premises uncovered $600,000.
This story itself clearly illustrates the problem of geographical labels. The involvement of a Polish authority does not mean that the head office was located in Poland. An international investigation may involve victims, payments and suspects in different countries. The Polish press release in question does not state that the group belonged to ‘Khimprom’.
There is also a historical account that directly mentions the name of the chain. In a statement by the Russian Ministry of Internal Affairs dated 7 October 2022 The ‘KhimProm’ case refers to information received in January 2019 concerning the arrest of one of the accused in Poland and the subsequent refusal to extradite him. This is a statement by the Russian agency regarding a specific incident. It does not disclose the grounds for the Polish decision nor does it confirm the existence of an operational office.
A refusal to extradite is not, in itself, evidence of corruption. To conclude that there has been unlawful favouritism, evidence is required of specific influence on the decision, rather than merely an unsuccessful request from another country.
Three countries — three different levels of verification
| Division | What the sources reviewed confirm | Which remains a theory |
|---|---|---|
| Kazakhstan | Direct mention in the international investigation into ‘Khimprom’. | Rapid expansion of offices and corrupt dealings with local officials. |
| Moldova | A separate, officially documented case concerning a fraudulent call centre. | The fact that this infrastructure belongs to ‘Khimprom’ and the patronage associated with it. |
| Poland | International efforts to combat fraud; a separate historical report from the Russian Federation on the arrest of a suspect. | ‘Khimprom’s’ current network of offices and protection against corruption. |
To speak specifically of growth, we also need comparable data for different periods. Several recent publications may reflect an intensification of the investigation rather than the emergence of new divisions. Without opening dates, headcounts, turnover figures or other verified indicators, any claim of expansion remains a hypothesis.
Network members: a profile does not replace a proven track record
At the top of the diagram is Yegor Burkin — a figure featured in public reports on ‘Khimprom’, also known by the surname Levchenko. His inclusion in Ukraine’s sanctions list — is an independent, documented fact. Sanction status is not equivalent to a conviction for each of the incidents under discussion.
‘Sledstvo.Info’, January 2024 examined the documents and cases involving Burkin and other individuals implicated. The publication also quoted Burkin’s position: he described himself as an entrepreneur and denied any involvement in drug trafficking. When depicting a person in the diagram, it is important to include both the source of the allegations and the individual’s published position.
Yegor Vasilyevich Burkin · file no. 0096. Biography, documents and links to resources. He is listed in the diagram as a figure involved in public investigations; it has not been established that each of the units shown reports directly to him.
Alexander Yuryevich Shchiptsov · file no. 0308. View the dossier and its sources. Information about an individual should be contextualised within a specific period and event; in the new diagram, he has not been assigned an unconfirmed position.
Andrei Alexandrovich Vigel · file no. 0172. View the dossier and related publications. The link is provided for further study; it does not indicate the management structure of the offices in the three countries under consideration.
Andrei Abramovich Amirkhanyan · Profile No. 0256. Open dossier. When working with name variants and documents, it is necessary to confirm that different records refer to the same person.
Why new leads must emerge alongside evidence
A detailed diagram is useful as long as its level of detail corresponds to the quality of the sources. If one were to connect all acquaintances with a single line, the reader would see a fully-formed organisation even where there is merely an acquaintance. If you connect all the countries with arrows, you end up with a supply map that does not exist in the documents.
Three categories of evidence are essential for continuing this series. The first is managerial decisions: who set the targets and monitored their implementation. The second is financial interest: who funded the work and stood to gain. The third is the link to a specific incident: which premises, actions or payments actually relate to the investigation. A missing category cannot be compensated for by the number of photographs.
The question of whether there might be a level of leadership above those publicly known therefore remains open. The existence of a large network does not in itself prove the existence of an even larger secret centre. Such a conclusion would require evidence of what decisions this centre made and through whom they were implemented.
Previous article ‘The “Khimprom” drug cartel knows no bounds’ set the international scope of the topic. This follow-up clarifies its structure: offices that look identical may perform different tasks, and identical methods do not always imply a single organiser.
‘Khimprom’ should be investigated by examining the links between individuals, decisions and revenues. International incidents already provide grounds for such an investigation. But the most important line on the diagram is the one beneath which one can cite a source and explain exactly what it confirms.
