What We Found
Over the course of 28 investigations, OWL has mapped the power structure that controls Armenia -- not as described by politicians, media, or official narratives, but as revealed by data. Breach databases, corporate registries, DNS records, audited financial statements, sanctions designations, and open-source intelligence.
What emerged is not a collection of isolated scandals. It is a single interconnected network -- one machine with many moving parts, operating continuously across four regimes, spanning three decades, and extracting billions from a nation of fewer than three million people.
| Metric | Count | Scope |
|---|---|---|
| People mapped | 127 | Politicians, oligarchs, officials, intermediaries |
| Organizations investigated | 79 | Companies, shell entities, government bodies, NGOs |
| Regimes covered | 4 | Ter-Petrosyan, Kocharyan, Sargsyan, Pashinyan |
| Financial flows traced | $4.3B+ | Dividends, offshore transfers, gold laundering, ANIF |
| Investigations published | 28 | Cybersecurity, corruption, sanctions, labor, spyware |
| Countries involved | 15+ | Armenia, Russia, Cyprus, BVI, Panama, UAE, UK, others |
The Four Networks
Across 28 investigations, four interconnected networks emerged. They are not separate systems. They are layers of the same machine.
1. The Badalyan Infrastructure Backbone
Confirmed - DNS/Corporate Records
Hayk Badalyan's Ucom and BetConstruct form the digital infrastructure backbone of Armenian power. The same fiber, the same data centers, the same networks carry government communications, oligarch operations, mining company data, and gambling revenue.
| Entity | Role | Connected To |
|---|---|---|
| Ucom | Telecom infrastructure | ZCMC, government networks, media |
| BetConstruct | Gambling platform / tech | Password 123456, offshore entities |
| Badalyan network | Infrastructure control | Every major sector of Armenian economy |
2. The Cyprus Offshore Machine
Confirmed - Corporate Registries
Cyprus is not just a convenient offshore jurisdiction for Armenian oligarchs. It is THE jurisdiction. Every major financial extraction we documented passes through Cyprus-registered entities.
| Cyprus Entity | Connected To | Flow |
|---|---|---|
| Neo Metals Holding Ltd | Trotsenko | $307M+ ZCMC dividends |
| GeoProMining Investment (CYP) Ltd | Trotsenko | ZCMC ownership chain |
| Mirelis Ltd | Sukiasyan family | Offshore wealth management |
| Pioneer Investments entities | ANIF / government | $27M+ misallocation |
3. The Russian Email Dependency
Confirmed - Breach Data / DNS
Armenian government officials, military personnel, intelligence officers, and business leaders use Russian email services -- Mail.ru, Yandex -- for official and sensitive communications. This means Russian intelligence services have legal access to Armenian state communications.
| Sector | Russian Email Usage | Risk |
|---|---|---|
| Government officials | Mail.ru / Yandex for official comms | Russian FSB access to state communications |
| Defense/Military | Defense minister using Moscow email | Military intelligence exposure |
| Media organizations | Armenian news on Russian servers | Content control, censorship capability |
| Business leaders | Corporate accounts on mail.ru | Commercial intelligence exposure |
4. The 123456 Network
Confirmed - Breach Data
The password 123456 is not just a weak credential. It is a map. It connects border checkpoints to offshore shells, mining companies to TV channels, gambling platforms to cocaine smuggling operations.
| Sector | 123456 Accounts | Investigation |
|---|---|---|
| Border security (Bavra) | 18 customs terminals | #1, #27 |
| Border security (Bagratashen) | Karen Tonoyan account | #27 |
| Gambling (BetConstruct) | info@ account | #1 |
| Mining/Water (Sukiasyan) | Bjni account | #1 |
| Offshore (Mirelis Cyprus) | dorothy@ account | #1 |
| Russian cruise (Trotsenko) | Vodohod account | #1 |
| National TV (Armenia TV) | armeniatv@ account | #1 |
| ISP (Arminco) | arameart@ account | #1 |
| Narcotics (banana import) | banana-am@ account | #1, #8 |
The Complete Investigation Index
Every investigation OWL has published, with its core finding:
| # | Title | Core Finding |
|---|---|---|
| 1 | The 123456 Network | One password connects borders, oligarchs, media, narcotics |
| 2 | Armenian News on Russian Servers | Armenian media infrastructure hosted on Russian servers |
| 3 | One Man's Network | Badalyan's Ucom/BetConstruct as infrastructure backbone |
| 4 | Russian Email Dependency | Government officials using Russian email services |
| 5 | ZCMC: $307M to Sanctioned Russian | Trotsenko extracts $307M through Cyprus shells |
| 6 | ZCMC: 13-Year Financial Autopsy | Profit suppression, ownership transfer, extraction cycle |
| 7 | Defense Minister's Moscow Email | Defense chief uses Russian email for official comms |
| 8 | Cocaine, Customs, One Password | 123456 connects customs to cocaine smuggling pipeline |
| 9 | The Cyprus Offshore Machine | Cyprus as the single hub for all Armenian oligarch money |
| 10 | Corruption Scorecard: Four Presidents | Every regime scored on corruption metrics |
| 11 | The $4 Billion Gold Laundromat | 68 tons of Russian gold re-labeled as Armenian origin |
| 12 | Every Leader, Same Offshore | All four presidents connected to same offshore structures |
| 13 | Trotsenko Sanctions Evasion | How Trotsenko evades sanctions through Armenian entities |
| 14 | Pioneer Investments / ANIF Pipeline | Government investment fund as extraction vehicle |
| # | Title | Core Finding |
|---|---|---|
| 15 | ANIF: The $27M Theft | $27M misallocated from national investment fund |
| 16 | Sukiasyan: Pashinyan's Wallet | Sukiasyan family's financial ties to current regime |
| 17 | Anna: "Destroy Them Both" | First lady's influence on political and business decisions |
| 18 | My Step Foundation | Campaign foundation as political slush fund |
| 19 | Pashinyan's Broken Promises | Systematic catalog of unfulfilled reform pledges |
| 20 | Pashinyan Freed Criminals | Political prisoners released, oligarchs left untouched |
| 21 | Avinyan-ANIF Triangle | Deputy PM's connection to investment fund irregularities |
| 22 | Minasyan: The $350M Fugitive | Former official's $350M extraction and flight from justice |
| 23 | Register Then Divorce | Asset-hiding through strategic divorce filings |
| 24 | Predator Spyware: Who Is Watching? | Armenian government procurement of surveillance spyware |
| 25 | 2020 War: Command Incompetence | Systemic military failures in the 2020 war |
| 26 | Four Presidents: The Damage Report | Cumulative damage assessment across all regimes |
| 27 | 18 Border Terminals, One Password | All 18 Bavra terminals use 123456, Iranian presence at Meghri |
| 28 | $307M Left, Workers Fired | Workers fired for striking while $307M went to sanctioned entities |
Key Connections Across Investigations
Pattern Analysis
The most important finding is not any single investigation. It is how they connect. The same names appear across investigations. The same offshore jurisdictions. The same patterns of extraction, concealment, and impunity.
| Connection | Investigations | Significance |
|---|---|---|
| Trotsenko across ZCMC, sanctions, 123456 | #1, #5, #6, #13, #28 | Sanctioned Russian controls Armenia's largest mine |
| Badalyan across infrastructure, passwords | #1, #3, #5 | One man's network carries all Armenian digital traffic |
| Sukiasyan across offshore, Pashinyan | #1, #9, #12, #16 | Oligarch family connected to all four regimes |
| Cyprus across every financial investigation | #5, #9, #12, #14, #15 | Single offshore hub for all Armenian extraction |
| 123456 across borders, crime, oligarchs | #1, #8, #27 | One password maps the entire power structure |
| Pashinyan across ZCMC, ANIF, promises | #5, #15, #19, #20, #24 | Revolution leader enabling same extraction |
The Numbers
| Category | Amount | Source |
|---|---|---|
| ZCMC dividends to Trotsenko network | $307M+ (single payment) | KPMG-audited financials |
| Gold laundering through Yerevan | $4B+ (68 tons) | Trade data, customs records |
| ANIF misallocation | $27M+ | Fund disclosures, corporate records |
| Minasyan extraction | $350M+ | Investigation findings, legal filings |
| Total traced flows | $4.3B+ | Cumulative across all investigations |
The Pattern
Four regimes. One system. The faces change. The offshore structures remain. The money flows out. The passwords stay the same. The workers stay poor. The oligarchs stay rich. The borders stay open.
This is not a conspiracy theory. Every data point in this map comes from a public source -- a corporate registry, an audited financial statement, a breach database, a DNS record, a sanctions designation. The network is hiding in plain sight. It always has been.
127 people. 79 organizations. 4 regimes. $4.3 billion. One network. All from public data. The question was never whether the corruption existed. The question was whether anyone would bother to connect the dots.
Methodology
This summary draws on all data and sources cited in Investigations #1 through #28. Primary sources include: breach databases, DNS records, WHOIS registrations, Armenian corporate registry filings, Cyprus/BVI/Panama corporate registries, KPMG and EY audited financial statements, OFAC/EU/UK/Canadian/Swiss sanctions designations, OCCRP/ICIJ leak databases, Citizen Lab research, Armenian parliamentary records, and open-source intelligence. No systems were accessed or penetrated. All data was publicly available at time of analysis.