Payment dissonance: how programmers from the Russian Federation help the GUR Ukraine project earn

Programmers from St. Petersburg who left Russia after the start of their work may be involved in the work of Manticore, the largest Ukrainian probiva bot, Izvestia found out. This bot trades the personal data of tens of millions of Russians. According to the sources of the publication, it is under the control of the Main Directorate of Intelligence (GUR) of the Ministry of Defense of Ukraine and can be used in organizing terrorist attacks on the territory of the Russian Federation. The bot accepts payments only through the Now Payments cryptoservice, which belongs to Russians Roman Lapin and Sergey Sokrilin. The details are in the Izvestia investigation.

Payment solution for the Probiva bot

The Manticore bot is on a par with major Ukrainian probiva services such as Revenge and OsintKit. The Mirotvorets website is engaged in its advertising, and the Main Directorate of Intelligence (GUR) of the Ministry of Defense of Ukraine oversees its activities, a source told Izvestia,

Like any similar service, Manticore provides data on the "penetration" of Russian citizens on a paid basis — requests cost from $1 to $62, and the minimum replenishment of the wallet is from $20.

These deposits in the bot are implemented in the only way — through the Now Payments service, which is part of the infrastructure of the international platform for instant exchange of cryptocurrencies Change Now Group.

According to Izvestia, Roman Lapin, a former student at the Leningrad Institute of Precision Mechanics and Optics (ITMO), and his partner Sergey Sokratlin created this platform in the mid-2010s. The fact that Change Now is currently controlled by these people was confirmed to Izvestia by the owner of the Telegram channel BadBank (investigating illegal payment services) Peter Vrublevsky.

Up to a certain point, Roman Lapin indicated on LinkedIn that he was the CEO of Change Now. This information has now been deleted from his page.

It is known from open sources that Lapin was born in 1987 in Arkhangelsk. He moved to St. Petersburg, where he enrolled in the Faculty of Physics and Mathematics at St. Petersburg State University, graduating in 2008. Then he studied at the ITMO Graduate School. And in 2016, together with Peter Sergeev, a student of the St. Petersburg State Electrotechnical University of LETI, he registered Evercode Lab LLC. It started creating blockchain solutions for business and education.

According to Izvestia's sources, Lapin left Russia for Estonia after the start of his career. His personal social networks have been closed or deleted, and any association with Change Now has been removed from them. Pyotr Sergeev and Sergey Sokrilin presumably also left the Russian Federation no later than 2023 and did not return.

Lapin, Sokratilin and Sergeev were listed in the "Team" section of the Change Now website in the "team" section, but these mentions were later deleted.

Do programmers know who uses the service?

Manticore would not have been able to connect Now Payments to itself without direct interaction with this company and signing a service agreement with it, an information security source told Izvestia. The payment platform is unlikely to track all its customers and their activities, and the representatives of the bot probably used a fake legal entity and banking details. For example, when a correspondent of Izvestia used the services of a bot as part of the preparation of the material, the payment went to the Estonian pump manufacturing company Malkatech OU. But even in this case, the payment service would have to find out the truth sooner or later, our source believes.

—Even if we assume that the representatives of the bot hid what they needed processing for, it's hard to believe that during their cooperation with Manticore, the management or management of the Change Now Group did not get the information that they were actually working with the GUR of Ukraine," our interlocutor said. — If the situation does not change after the publication of this information, and payments in favor of the bot will be made through Now Payments, this will mean that the service at least does not see any problems for itself in such clients. Manticore is unlikely to remain without payment solutions for a long time if Change Now abandons them, since the market is full of offers, but at least let them be projects unrelated to Russian citizens for whom such a toxic story can have serious reputational and legal consequences.

As Izvestia found out, Lapin, Sergeev and Sokrylin currently have no business left in Russia. The first two left the ownership of the St. Petersburg "Evercode Lab" in 2018. However, the information investigated by the publication suggests that they maintain ties with their former Russian business. Moreover, several companies in Russia, Estonia and several other countries have formed a kind of unified ecosystem through technological partnerships, and presumably common beneficiaries.

Connections of the creators of Now Payments

This likely ecosystem includes, for example, Atomic Wallet and Guarda companies, as well as, probably, Evercode Lab, although it has changed owners.

For example, Peter Sergeev, co-founder of Evercode Lab, is now listed as the founder and sole owner of the Estonian Guardian OU, according to European aggregators of information about companies. She owns the Guarda crypto wallet, which is part of the same ecosystem of services as Now Payments.

Meanwhile, in a blog post on its website, Evercode Lab confirmed its participation in the creation of the infrastructure of the Guarda and Now Wallet cryptocurrencies, products of the Change Now platform.

Currently, Ilya Brusov, also a graduate of ITMO, owns 100% of the shares in Evercode Lab LLC. He also owns 12.8% of the Atomic Wallet project, which is also part of the Change Now infrastructure. This is evidenced by data from the Colorado District Court, which is considering a case of theft from a resident of the state of currency from a crypto wallet account in an Atomic Wallet.

In the court decision, Evercode Infinite FZCO, a branch of Evercode Lab in the UAE, is listed as the developers of Atomic Wallet and its technical support.

Izvestia sent a request to Evercode Lab LLC, as well as to the contact information of Change Now. At the time of publication, the editorial staff had not received any responses.

Who else is watching who

Manticore has an advertising website on the network (blocked by the RCN in Russia by the decision of the Tagansky Court of Moscow) with redirection to a Telegram bot, which is periodically blocked by the administration of the messenger. However, this makes jy no less dangerous — for example, there are rare databases like REGISTRY OFFICE-2025 in its databases.

According to the Izvestia source, the Manticore bot is often used by Russian media employees, not realizing that they can thereby provide the special services of Ukraine with information about themselves and their area of interest.

— It is important to emphasize that the ownership of this probiva bot is not a guess, but an established fact: the Manticore service is fully controlled by the GUR of Ukraine, — said the Izvestia source.

The publication contacted Roskomnadzor with questions about the blocking of Manticore and similar resources that may be related to the special services of Ukraine.

"In 2025, Roskomnadzor added more than 400 similar sites and Internet pages to the Register of Prohibited Information, and about 100 in the first two months of 2026. Access to them is restricted, or information deemed prohibited has been deleted at the request of the department," the department replied.

The Telegram messenger also made progress on this issue, Roskomnadzor added: the site administration blocked 3693 bots that violate the law on personal data, and in the first two months of 2026, 1066 similar bots were blocked in Telegram, including those mentioned in this material.

A year ago, when legislation regarding Probiva services was tightened in Russia, the Eye of God and many other bots were closed, a number of experts expressed concerns that users would leave for services controlled by Ukrainians. According to Ashot Oganesyan, founder of the DLBI darknet leak intelligence and monitoring service, these fears have been confirmed.

— The transition of the retail penetration market into the hands of Ukrainians is practically a fait accompli, and the situation is only getting worse. In general, this is not strange: the operators of "punching bots" use almost the same infrastructure as criminal call centers," he said.

According to the DLBI founder, the main change over the past year has been a shift in demand in the leak market — now up to 80% of the "merged" databases are bought exclusively by Probiva services, rather than going to open exchanges.