The Cyprus Machine

One Island, Every Regime

Confirmed - Corporate Registries Pattern Analysis

In thirty-five years of Armenian independence, four governments have held power. They have disagreed on everything -- territory, Russia, democracy, war, peace. They agree on one thing: Cyprus.

Cyprus is the island where Armenian money goes to disappear. Not occasionally. Not by coincidence. Systematically, across every administration, through the same corporate formation agents, the same legal architecture, the same telecommunications infrastructure. OWL has now mapped the complete Cyprus pipeline across all eras.

The political theater changes every decade. The Cyprus address stays the same.

Mirelis Limited: The Shell with the World's Worst Password

Confirmed - Breach Data Confirmed - DNS Records

Mirelis Limited has been registered in Cyprus since 1998. That is twenty-eight years of continuous operation as an offshore vehicle. In that time, it has acquired Microsoft 365 for its corporate operations -- a modern enterprise email and productivity suite.

One of its employee accounts belongs to a user named "dorothy." The password for this account, found in publicly available breach data: 123456.

This is the same password that protects Armenia's Bavra border checkpoint (18 accounts), the same password found on Bjni mineral water's mail.ru account, the same password that appears across dozens of critical Armenian systems documented in Investigation #1.

An offshore shell managing potentially billions in flow, operating for nearly three decades, protected by the most common password on earth. The negligence is the point. When you do not expect anyone to look, you do not bother with security.

Neltax Holding: Compliance Theater from the Seychelles

Confirmed - DNS Records Confirmed - Corporate Registry

Neltax Holding is registered in the Seychelles -- one of the world's most opaque corporate jurisdictions. But its digital footprint reveals something remarkable: it uses Smarsh, a financial compliance and communications archiving platform.

Smarsh is software designed to help financial institutions demonstrate regulatory compliance. It archives communications, monitors for policy violations, and creates audit trails. Banks use it. Hedge funds use it. Regulated entities use it to prove to regulators they are following the rules.

A Seychelles-registered entity linked to a network engaged in industrial-scale gold laundering and sanctions evasion deploys compliance software. This is not compliance. This is compliance theater -- the appearance of regulatory adherence on a structure designed to evade regulation.

The CyTA Connection: Physical Presence Proven

Confirmed - Breach Data

Cyprus Telecommunications Authority (CyTA) is the state-owned telecom provider in Cyprus. A CyTA subscriber account -- cytanet.com.cy -- requires a physical address in Cyprus, a local subscription, a real presence on the island. You cannot obtain one remotely.

In publicly available breach data, OWL found a CyTA subscriber account with the password: mariam-sukiasyan.

The password is the proof of presence. "mariam-sukiasyan" is not a random string. It is a family name embedded in a credential for a service that requires physical residency. This places the Sukiasyan family -- the controllers of the gold laundering pipeline documented in Investigation #11 -- physically on the island where their offshore entities operate.

Vardi Invest and Walnort Finance: The $1.2 Billion Lawsuit

Confirmed - Court Records Confirmed - Corporate Registry

Vardi Invest is the third Cyprus entity in the Sukiasyan-linked network. It operates alongside Walnort Finance, which is the subject of a $1.2 billion lawsuit -- a figure that alone would represent roughly 5% of Armenia's entire GDP.

When a single offshore network faces legal exposure equivalent to 5% of the national GDP, the line between private business and state capture disappears. This is not an oligarch with offshore accounts. This is a parallel financial state operating through Cyprus.

Spirikov and Storm BV: The Dutch-Russian Hybrid

Confirmed - DNS Records Confirmed - Corporate Registry

The Cyprus machine does not operate in isolation. It connects to other nodes. One such node is Spirikov, operating through Storm BV -- a company registered in the Netherlands but communicating through Russian email addresses.

A Dutch-registered company using Russian email infrastructure fits the pattern OWL has documented across the Armenian offshore network: Western corporate shells with Eastern operational reality. The registration is for legitimacy. The emails reveal where decisions are actually made.

GeoProMining Investment (CYP) Limited: The Sanctioned Director

Confirmed - Corporate Registry Confirmed - Sanctions Lists

This is perhaps the most significant Cyprus entity in the entire Armenian offshore network. GeoProMining Investment (CYP) Limited is the Cyprus-registered arm of the company that controls ZCMC -- Armenia's largest mine, documented in Investigation #3.

Roman Trotsenko is not merely a beneficial owner. He is not hidden behind nominee directors. He is listed as a personal director of GeoProMining Investment (CYP) Limited. A sanctioned Russian oligarch, personally named on EU and US sanctions lists, sitting as director of a Cyprus company that controls Armenia's most valuable natural resource.

Cyprus does not just enable Armenian corruption. It enables sanctioned Russian oligarchs to personally direct the extraction of Armenian national wealth. Trotsenko does not need proxies in Cyprus. He sits as director himself. The island provides enough opacity that a sanctioned individual can openly control a $307 million extraction pipeline.

Marathon S.A.: The BVI-Cyprus Bridge

Confirmed - Corporate Registry

Marathon S.A., registered in the British Virgin Islands with Cyprus-linked operations, is controlled by Papazian and Grigoryan. It represents another node in the cross-regime offshore architecture that uses Cyprus as its operational base while registering in even more opaque jurisdictions.

The BVI provides ultimate opacity. Cyprus provides operational infrastructure -- banking, telecommunications, legal services. Together they form the two-tier architecture that Armenian money flows through: BVI for hiding, Cyprus for operating.

The Cross-Regime Pattern

Pattern Analysis

The most important finding is not any single entity. It is the pattern. Cyprus has served every Armenian regime without interruption:

Revolutions come and go. Governments rise and fall. Prime ministers hold press conferences about fighting corruption. And the Cyprus pipeline operates continuously, like a utility -- always on, always available, serving whoever holds the keys.

Pashinyan's revolution did not disrupt the Cyprus machine. It plugged new operators into the same infrastructure. The Sukiasyan network replaced the Minasyan network. The flow direction stayed the same: out of Armenia, into Cyprus, onward to wherever the money needs to go.

Digital Fingerprints Summary

Confirmed - Multi-Source

What This Means

Cyprus is not one offshore destination among many for Armenian elites. It is the operating system. It provides the corporate infrastructure, the banking relationships, the telecommunications (CyTA), and the legal framework that every Armenian regime has used to extract national wealth.

The entities change names. The beneficial owners rotate with political power. But the island, the service providers, the formation agents, and the architecture remain constant. A sanctioned Russian oligarch can sit as personal director of a Cyprus company controlling Armenia's largest mine. A family can prove its physical presence through a telecom password. An offshore shell can run Microsoft 365 protected by 123456.

This is not a series of isolated offshore accounts. This is a machine. And Cyprus is where it runs.

When every regime uses the same island, the problem is not the regime. The problem is the island -- and the system that makes it indispensable.

Methodology

This investigation is based on analysis of corporate registries in Cyprus, the British Virgin Islands, and the Seychelles; publicly available breach databases; DNS records and MX analysis; court filings; EU and US sanctions lists; and open-source intelligence. No systems were accessed, penetrated, or tested. OWL does not encourage unauthorized access to any system.