Inside Pravfond: Russia's Shadow Slush Fund Inside the EU

Fifty thousand leaked emails from inside a Moscow-based legal aid foundation have exposed one of the most systematic influence operations ever documented inside the European Union - a network that kept moving Russian state money to spies, propagandists, and academics across 11 EU member states, even after the organization was sanctioned and supposedly cut off from the Western financial system.

The foundation is called Pravfond - the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad. Its stated mission is charitable: helping Russians who get into legal trouble in foreign countries. Its actual function, according to the leaked records, European intelligence agencies, and court documents, is something else entirely.

The archive - nearly 50,000 internal emails spanning from 2012 through November 2024 - was obtained by Danish public broadcaster DR and shared with OCCRP and 28 media partners as part of the "Dear Compatriots" investigation published in 2025 and 2026. What it reveals is a decade-long covert funding operation, running from an office off the Arbat Street pedestrian strip in central Moscow, that funneled millions of dollars to convicted spies, paramilitary organizers, propaganda websites, and academics presenting Kremlin-friendly research at international conferences - including the OSCE's own human rights forums.

The EU sanctioned Pravfond and its executive director Aleksandr Udaltsov in June 2023. The foundation adapted within weeks - warning grantees about "possible risks," then developing a toolkit of workarounds that included cash couriers, Panama bank accounts, cryptocurrency wallets, Russian embassy intermediaries, and transfers routed through university trust funds.

It kept paying anyway. That is the story.

The Architecture of a Covert Influence Fund

Pravfond was established in 2012, quietly and officially, as a tool of Russian foreign policy. Under Russian law, the state treats millions of former Soviet citizens in neighboring countries as "compatriots" - a designation that carries both cultural and strategic weight. The view that these people remain part of Russia's sphere regardless of their citizenship is enshrined in federal law and forms a central pillar of Kremlin doctrine.

From day one, Pravfond operated as the financial arm of that doctrine. Its 18 employees worked out of a Moscow office processing grant applications that ranged from mundane - custody disputes, immigration paperwork - to politically explosive. Internal emails show it funded legal defense for men arrested for espionage, paramilitary organizers, pro-Russian propaganda networks, and academics who presented at international human rights forums while secretly on the Kremlin's payroll.

"Countries don't subsidize their citizens in foreign countries with legal costs," said Edward Lucas, a Senior Fellow at the Center for European Policy Analysis. "So you have to ask why this is something that the Russian state wants to spend its tax income on. This is a classic example of a Kremlin influence operation - working in plain sight, and exploiting the inherently trusting nature of a liberal society."

The leaked archive shows over 360 confirmed grants, though contract numbering suggests the total exceeds 1,000. The average grant was around $16,500. The geographic focus was sharp: roughly a fifth of all known grants targeted Latvia, Estonia, and Lithuania - the three Baltic states that were once Soviet republics, now NATO members, and which Russia has treated as priority targets for influence operations since their independence.

Pravfond's executive director Aleksandr Udaltsov was explicit about the ideological purpose. In an unpublished promotional video found in the email archive, he called Russians abroad "an army, a force that is very important to us." The phrase is not metaphorical. It describes a real operational network - one with its own intelligence component.

"The foundation was created to fund influence operations under the cover of combating discrimination. It is an extension of the Russian intelligence services, enabling the control and direction of the Russian-speaking diaspora." - Marta Tuul, spokesperson for KAPO, Estonia's internal security service

Spies, Paramilitaries, and the "Aussie Cossack"

The breadth of Pravfond's grantee list is its most damning feature. This was not a legal aid fund that occasionally helped the wrong people by accident. The emails show a consistent, deliberate pattern: when someone got arrested for acting on Moscow's behalf, Pravfond paid their lawyers.

Alexander Franchetti was a Russian former fitness trainer who had been living in Prague for years. After Russia's 2014 annexation of Crimea, he formed a paramilitary unit called "North Wind" - a dozen men who scouted for the Russian Navy in occupied territory. "We gave all the information to the navy command," he told an interviewer, without embarrassment. When Ukrainian authorities sought his extradition from Czech Republic years later, Pravfond awarded at least three grants totaling over 3.4 million rubles - approximately $37,000 - to cover multiple lawyers and a translator. A Czech court eventually acquitted him in 2022; the acquittal was overturned on appeal, and Franchetti slipped back to Russia before he could be imprisoned. He is now serving a sentence in absentia.

In Latvia, Pravfond funded Sergejs Sidorovs, a taxi driver arrested by the country's security services in 2023. Prosecutors accused Sidorovs of photographing military installations, cataloguing Ukrainian-flagged homes, and plotting to bomb a drone testing site near Riga. He was convicted of espionage and sentenced to seven years. Pravfond's grant to him: 5,000 euros for legal defense. Sidorovs is currently appealing and faces additional charges in a separate espionage case.

Then there is Simeon Boikov - the self-described "Aussie Cossack" in Sydney, Australia. A prominent pro-Russia activist who first gained followers by promoting anti-vaccine conspiracies during the COVID pandemic, Boikov was convicted of assaulting an elderly Ukraine supporter in December 2022. Rather than face the legal consequences, he took refuge inside the Russian consulate in Sydney. The leaked emails show Pravfond was in communication with Russian officials about his case - providing not just money but diplomatic pressure from Moscow.

These are not anomalies. Andrei Soldatov, the Russian investigative journalist and expert on Russia's security services, explained the logic: "These days it's getting more difficult to provide cover for Russian intelligence officers. The embassies are not as big as they used to be. Russian cultural centers are closed in many countries. But if you create a flow, a stream of legal services provided to the Russian community, of course it makes it easier. It gives a new legal cover to your spies."

The Academic Cover: Kremlin Narratives at OSCE Conferences

The most insidious layer of Pravfond's operation was its academic and research funding - money that put Kremlin-curated narratives inside the most credible institutions of European civil society.

Valery Engel is a Russian historian based in Latvia. He runs the European Center of Democracy Development, a Riga-registered non-profit that describes itself as dedicated to studying xenophobia and radicalism in Europe. Its annual reports list European Commission funding. What they do not list is Pravfond's money - even though, according to leaked Pravfond emails and grant documents, Engel has received Pravfond funding on at least 10 occasions since 2013.

In November 2022 - four months after Russia's full-scale invasion of Ukraine - Engel applied to Pravfond for 22,400 euros to fund a report on xenophobia against Russians. The grant application described Russia's invasion as a "special military operation" - the Kremlin's own preferred language - and argued that Russian speakers in "unfriendly countries" had suffered "ethnocratic discrimination." Pravfond funded the report.

In September 2023, three months after Pravfond was sanctioned by the EU, Engel applied for 1,230 euros - plus travel, hotel, and per diem - to present that report at an OSCE human rights conference in Warsaw. Russia's Ministry of Foreign Affairs sent an official letter supporting the application the same day. The leaked Pravfond spreadsheets confirm the grant was approved. Engel presented at the conference in October 2023.

When contacted by reporters, Engel denied ever receiving Pravfond funding after 2022 and denied having submitted the grant applications. He suggested the documents were fabricated. Reporters verified the documents through metadata analysis, email address confirmation, and cross-referencing with verifiable real-world events - including cell phone billing records showing multiple calls between Engel and Pravfond in the days surrounding the Warsaw conference.

The OSCE declined to vet participants' funding sources. "Participation in such events does not imply endorsement," a spokesperson said - adding that the body operates on principles of "openness and inclusivity."

Latvia's State Security Service was less diplomatic. It confirmed that Engel had been under scrutiny for years. In February 2026, following a request from the security service, Engel was added to a list of foreign nationals banned from entering Latvia.

"It's designed to be citable in neutral forums, I think, but it definitely has an orientation that aligns more with a Russian narrative." - Seva Gunitsky, Associate Professor of Political Science, University of Toronto, after reviewing the Pravfond-funded report

Engel was not alone. The leaked emails show at least ten other individuals who sought Pravfond funding to attend OSCE conferences over the past decade. The pattern is consistent: academics and researchers receiving Kremlin money to present nominally neutral research at international forums, inserting Moscow's preferred framing into the vocabulary of European human rights discourse.

How Money Crossed the Sanctions Wall

When the EU sanctioned Pravfond on June 23, 2023, the foundation did not shut down its European operations. It adapted. A draft annual report sent to the Russian Foreign Ministry in March 2024 noted that despite "difficulties for practical work" caused by the sanctions, it had "so far been possible to resolve issues in each specific case, using, among other things, alternative and workaround options."

Those workarounds were diverse, creative, and - until the leak - largely invisible to authorities.

The simplest method was cash. In October 2024, Estonian border guards stopped Tatjana Sokolova, a 65-year-old travel agent, trying to enter Estonia from Russia carrying 10,000 euros in cash. It was not her money. She had traveled to Russia specifically to collect five payments from Pravfond totaling over 50,000 euros, intended to pay lawyers defending a Russian man accused of collaborating with Russian intelligence in Estonia. Pravfond had warned her about the "possible risks" days after it was sanctioned, in the summer of 2023. She responded the same day by sending her Russian bank details. She was convicted in April 2025 of violating sanctions and sentenced to time served plus community service.

Panama provided another channel. Lithuanian lawyer Stanislovas Tomas received 10,000 euros from Pravfond via a Montenegrin bank account, then paid back the Montenegrin-account holder in cash - a classic layering scheme. "Latvians are crazy - they can put you on an Interpol wanted list," Tomas wrote in a 2023 email urging Pravfond to find more secure communications, while simultaneously confirming receipt of the money.

Russian embassies also served as intermediaries. Dmitry Erokhin, who runs a legal center for Russians in Vienna, corresponded with Pravfond in January 2023 about difficulty opening bank accounts in Austria. "The embassy is working on the option of transferring [the funds] through itself," he wrote. A signed contract from March 2024 confirmed Pravfond had agreed to pay him 40,000 euros - after sanctions - routed in two tranches over the year.

For the Ragnar Locker ransomware case in France, Pravfond funded the legal defense of Oleg Basov - a Russian living in Czech Republic who worked for a major French aerospace and defense firm before his arrest. His wife transferred Pravfond's money to a man with a Russian-sounding name, who sent it from a Montenegrin account to Basov's French lawyer. The lawyer said he had never heard of Pravfond. "My invoices have been settled directly by my client's wife and family," he told reporters.

The Propaganda Infrastructure

Beyond individual cases, Pravfond funded a broader media and propaganda infrastructure across Europe - one designed to be invisible from the outside.

IMHOclub, a Latvian-Russian website, received approximately 150,000 euros from Pravfond over several years. Its stated goals were to "counter the demonization of Russians in Europe" and "form a loyal attitude among European citizens toward Russia." In November 2018, the site's operators - Yuri Alekseev and Pyotr Pogorodny - were detained and later charged with working against Latvia's interests by spreading disinformation using Russian state funds. They are currently on trial.

The leaked emails show that Pravfond's funding for IMHOclub continued long after the criminal case was opened - until at least 2024. Money was routed through an international trustee fund affiliated with Moscow State Aviation Technology University, then on to a Russian company called Creative Research Agency owned by one of the defendants.

In a November 2024 email, a dispute erupted when the university fund's head demanded a commission for handling the transfers - a piece of dark comedy that inadvertently documented the entire money chain for investigators.

Pravfond also funded a Lithuanian history textbook that justified the Soviet occupation, pro-Russian Telegram channels, and legal centers across 20 countries stretching from Spain to Mongolia that doubled as organizing hubs for pro-Kremlin events. The contracts for these centers, found in the email archive, required grantees to organize a minimum number of public events per year - including conferences, seminars, and media appearances - effectively turning legal aid offices into influence hubs.

In Lithuania, emails show how Pravfond collaborated with Russian intelligence agents to undermine a prosecution of former Soviet officers accused of war crimes during Lithuania's 1991 struggle for independence from the USSR. Normunds Mezviets, director of Latvia's State Security Service, confirmed that "individuals who present themselves as independent experts, researchers, employees of this fund, are actually staff officers of Russian intelligence services."

Sanctions: Imposed, Ignored, Circumvented

The EU's June 2023 sanctions against Pravfond were clear. They froze assets and prohibited EU persons and entities from making resources available to the sanctioned organization. According to Estonia's Ministry of Foreign Affairs, this covered not just Pravfond's own funds but any money under its control or influence - including grants it was making to grantees abroad.

Kadri Elias-Hindoalla, director general of Estonia's Department of Sanctions and Strategic Export Control, reviewed the cases documented by journalists and was unambiguous: what Pravfond was doing was "very likely a violation of sanctions." She described the scale of violations as "extremely regrettable."

"It is extremely regrettable that this is happening so widely and visibly in front of everyone's eyes," she said. "Looking from the sanctions implementers' perspective, it definitely shouldn't be like this."

The Sokolova case - the Estonian travel agent convicted of carrying Pravfond cash across the border - helped establish a legal precedent for what counts as a sanctions violation. But beyond Estonia, enforcement has been uneven. Different EU member states interpret the sanctions differently. Grantees in Germany, Austria, France, and Cyprus faced no comparable prosecutions, even as the leaked emails documented their continued receipt of Pravfond funds.

Pravfond's internal March 2024 report to the Russian Foreign Ministry made its operational confidence explicit. The sanctions, it wrote, had created "difficulties" but had not stopped the work. "Alternative and workaround options" had solved each problem as it arose.

The EU has no centralized enforcement mechanism for sanctions violations at the individual grant level. Each member state is responsible for prosecution within its own jurisdiction. That patchwork is, by design or by accident, exactly the kind of gap a sophisticated influence operation can exploit indefinitely - provided no one leaks 50,000 emails to a Danish public broadcaster.

What the Leak Changes - And What It Does Not

The "Dear Compatriots" investigation has now put names, amounts, methods, and timelines into the public record. It has triggered at least one ban from Latvia, prompted security service reviews in multiple countries, and created a documentary record that prosecutors can potentially use.

But history suggests that intelligence-adjacent influence operations are extraordinarily difficult to prosecute in democracies, even with documented evidence. The Sokolova conviction - for smuggling cash across a border - is the kind of prosecutable offense that leaves the larger network intact. Paying a researcher to present at a conference, routing money through a Panama account, or using an embassy as an intermediary are all murkier legally.

The more important impact may be structural. European intelligence agencies have spent years warning about Russian infiltration of civil society organizations, academic networks, and legal aid institutions. The leaked Pravfond archive provides the most detailed confirmation yet of how that infiltration actually works in practice - not through crude propaganda but through patient, methodical funding of people who generate plausibly credible work that serves Moscow's narrative interests.

Seva Gunitsky, the University of Toronto political scientist who reviewed Engel's Pravfond-funded report, identified the mechanism precisely: "It's designed to be citable in neutral forums." That is the whole point. Not to produce obvious propaganda - but to generate sources that look independent, that appear in academic footnotes, that get cited by other researchers, that eventually become background assumptions in policy discussions.

Russia's Ministry of Foreign Affairs supported Engel's grant application in September 2023, three months after Pravfond was sanctioned. The ministry's letter described him as "a successful researcher and speaker at international venues." This is the institutional infrastructure of a long-term influence operation - one that a single leak, however damaging, does not dismantle.

Pravfond did not respond to requests for comment from journalists in any of the "Dear Compatriots" reports. Udaltsov, its executive director, has not spoken publicly. The organization's website continues to describe its mission in terms of legal protection and humanitarian assistance.

The 50,000 emails say something different.

The Implications: A System Built to Survive Exposure

Pravfond did not need secrecy to operate. For most of its history, it functioned entirely in the open - a registered non-profit, publicly funded by the Russian state, openly providing legal assistance to Russians abroad. The cover was not a lie. It was a partial truth.

This is the sophisticated structure of modern Russian influence work: not a covert operation hidden from view, but a legitimate-looking institution that conducts covert operations as a secondary function. The Kremlin does not need to conceal Pravfond's existence. It just needs its critics to find the humanitarian work credible enough that accusations of intelligence coordination seem paranoid.

The leaked emails demolish that calculation. But they also reveal something about the scale of effort Russia has invested in this infrastructure. Over a decade, more than 1,000 grants, 28 countries, 18 employees in a Moscow office - all to maintain a network of people who can be activated, funded, and directed when needed.

The Baltic states received the most intensive attention - roughly a fifth of all grants. That maps precisely onto where Russia has the most strategic interest: populations with historical Russian connections, NATO members on Russia's western border, and countries with active debates about historical memory of Soviet occupation. Pravfond funded all sides of those debates - or rather, one side with the appearance of multiple independent voices.

European intelligence agencies had been warning about this for years. KAPO in Estonia called Pravfond "an extension of the Russian intelligence services." Latvia's security service said it had been investigating the organization for years and had identified actual intelligence officers operating under its cover. Finland's security service, in the OCCRP reporting on the shadow fleet, used similar language about Russian state actors exploiting legal ambiguity.

The common thread across all of these cases - the shadow fleet, the Shamkhani oil empire, Pravfond - is the same: Russia builds infrastructure that is defensible in legal terms, that operates through legitimate-appearing intermediaries, and that generates plausible deniability at every step. It is not proof-of-innocence they are generating. It is enough noise to slow down prosecution.

The Pravfond leak is significant not because it enables easy prosecutions. It is significant because it removes the noise. The 50,000 emails show the decision-making, the calculations, the workarounds, the explicit acknowledgment of sanctions violations - all in the organization's own words, from its own servers, documented in contracts, invoices, and telephone billing records that prosecutors can subpoena.

What European authorities choose to do with that material is now the real question. The evidence is there. The precedent - the Sokolova conviction - exists. The intelligence is confirmed. Whether the political will follows is a different calculation entirely.