The investigation, prepared by OCCRP's Russian partner, the outlet Important Stories (Vazhnye Istorii), describes the structure of Telegram's network layer. Journalists exchanged messages via the messenger and recorded traffic with the Wireshark analyzer: the IP addresses the app contacted belonged to Global Network Management (GNM), registered in Antigua and Barbuda. According to the authors' estimate, GNM leases more than 10,000 IP addresses to Telegram.
The messenger itself emphasizes the distributed nature of its infrastructure in its official FAQ: cloud chat data is stored in data centers in different jurisdictions, and decryption keys are split and not stored together with the data. The investigation, however, focuses on another level—on who ensures the passage of traffic.
Evidence from a Court Case
Materials from a civil lawsuit filed in Florida in 2018 (a dispute between GNM and a contractor) name Vladimir Vedeneev as the company's owner. In court, he described that his firm "participates in the installation of client equipment—in this case for Telegram Messenger—and the subsequent technical support of that equipment." According to the documents, Vedeneev was the only person with access to Telegram's servers in a Miami data center, and his company owned a router in the messenger's server room.
The same documents state that Vedeneev held a power of attorney to sign documents on behalf of Pavel Durov and Telegram. One contract was signed by him twice—as director of GNM and as CFO of Telegram. Vedeneev himself called such an arrangement "informal" and said he did not receive a salary from Telegram.
"If a company controls the routers that distribute traffic through Telegram's servers, it means that it—or anyone it grants such access—can see the identifiers of the messenger's users," said security specialist Michał "rysiek" Woźniak.
Affiliated Companies and Their Clients
Vedeneev is the founder of the St. Petersburg backbone operator GlobalNet, which, according to the investigation, manages 18,000 kilometers of backbone infrastructure in two dozen countries. Last year he transferred his majority stake in the company to relatives. Until 2020, the Telegram IP addresses now managed by GNM were controlled by GlobalNet.
Among GlobalNet's clients, the authors name the Main Research Computing Center (GlavNIVTs) of the Administrative Directorate of the President of Russia and the Kurchatov Institute. According to the state procurement portal, GlobalNet also provided communications for the Kurchatov Institute. After 2022, the company announced that it was the first among Russian operators to implement a Deep Packet Inspection traffic monitoring system "according to Roskomnadzor's rules." A minority co-owner of GlobalNet (4%) is listed as Roman Venediktov, an officer of the Space Forces.
Another company linked to Vedeneev—Electrontelecom—according to the investigation, assigned more than five thousand Telegram IP addresses. Internal accounting documents for 2024, which the journalists reviewed, show that one of its key government clients is the FSB: the company installs and maintains surveillance system equipment for the FSB directorates for St. Petersburg and Leningrad Oblast.
The authors specifically note: there is no evidence that GNM itself worked with Russian state agencies or transferred any data. The issue is a potential vulnerability of metadata—information about which device and from which address connects to the servers—rather than access to the content of conversations.
Assessments and Reactions
According to OCCRP, Durov did not respond to a request for comment; Vedeneev spoke with the journalists but declined to have his words published. Former Telegram manager Elies Campo and other sources familiar with the company's structure, according to the authors, had not heard of Vedeneev.
Citizen Lab senior researcher John Scott-Railton said: "If true, the investigation highlights a dangerous gap between what many people think about Telegram's security and privacy and the reality." According to him, people who do not know how things stand but rely on metadata protection may unknowingly put themselves and their contacts at risk.
An anonymous Ukrainian IT specialist told the journalists that Russian military forces used man-in-the-middle interception in his country after seizing network infrastructure: "You gain physical access to the data transmission channel and install your equipment there." According to him, in such an attack, the primary interest is metadata—IP addresses, location, who exchanges packets with whom.
In an update dated June 12, 2025, OCCRP clarified the year the Miami lawsuit was filed—2018.
1
