Putin's shadow network repopulates Tokyo: how expelled Russian spies traded European expulsions for a permissive Japan
Russian intelligence officers expelled from European capitals after February 2022 are rebuilding networks in Tokyo, where Japan's wartime-era legal architecture has left foreign intelligence services with room to operate.
A New York Times investigation circulated on 12 July 2026 through Ukrainian Telegram channels describes a migration of Russian intelligence officers into Japan that began in the months after the February 2022 invasion of Ukraine. The framing across the two Ukrainian channels that surfaced the piece, journalist Andriy Tsaplienko's feed and the Pravda_Gerashchenko channel, is consistent: Western capitals expelled Russian diplomats and intelligence officers en masse after the invasion, and the displaced officers did not retire. They relocated to Tokyo, where the investigative reporting says the Russian security services have built an active network under diplomatic cover, including positions inside the Russian embassy and inside Russian state airlines operating commercial routes into Japan.
The story matters less for the specific tradecraft described than for what it reveals about the uneven geography of Russian intelligence exposure. European services, with their wartime-era counter-intelligence institutions and their immediate proximity to the war, treated Russian diplomats as a priority threat. Tokyo, by contrast, sits more than 8,000 kilometres from the front line and operates under a legal regime shaped by a different history. The result is an asymmetric map of Russian intelligence activity: thinner in Berlin, Paris and London, denser in the one major G7 capital that has been slowest to close the aperture.
What the investigation describes
According to the reporting summarised in the Tsaplienko Telegram channel at 17:07 UTC on 12 July 2026, the operation in Japan is overseen by a GRU officer identified in the Times investigation as Maksym Filchenkov, who is described as working under the cover of an Aeroflot employee. Aeroflot has historically provided cover for Russian intelligence officers assigned to foreign stations, and the use of state airline roles for intelligence work is a documented pattern of Russian overseas operations dating to the Soviet period. The investigation frames the network as having expanded specifically after February 2022, when European states revoked accreditations and reduced embassy footprints.
The Pravda_Gerashchenko channel, which flagged the same investigation at 16:28 UTC on 12 July, emphasises a structural point: Tokyo's legal regime, designed after the Second World War and refined through the Cold War, does not give Japan's public security organs the same tools to monitor foreign intelligence services that European counterparts possess. The two channels together present a picture in which the operational constraint on Russian services in Europe has functioned, paradoxically, as a redistribution mechanism that pushed capacity into Asia.
Why Japan specifically
Three structural facts converge. First, Japan's postwar constitution constrains the scope of its domestic intelligence services in ways that European agencies, operating under different legal traditions, do not face. Second, the Russian embassy in Tokyo is staffed at a level that European states have already reduced at their own postings in Moscow, a retaliatory imbalance that has constrained Western intelligence reporting on Russia while leaving Russian intelligence reporting on Japan comparatively intact. Third, Japan's geographic position makes it a natural platform for Russian intelligence work on the Pacific: monitoring US force posture, Japanese defence industrial policy, and the technology and semiconductor supply chains on which Tokyo's alliance with Washington now depends.
The pattern is not unique to Japan. Russian intelligence has rebuilt networks in other jurisdictions with permissive legal environments over the past four years, including in parts of the Middle East, Africa and the wider Asia-Pacific. Japan's case stands out because of the asymmetry it produces: it is one of the United States' closest allies and one of the world's most exposed targets for industrial espionage, while remaining among the most permissive operating environments in the OECD for Russian intelligence officers operating under diplomatic cover.
What is known and what remains contested
The Times investigation, as summarised in the two Ukrainian channels, names a specific GRU officer, attributes a specific cover role and ties the operation to the post-February 2022 European expulsions. The substantive claim is that the Russian services redeployed assets expelled from Europe to Japan. The framing in both channels treats this as a deliberate strategic relocation rather than a coincidence, and presents the legal asymmetry between European and Japanese counter-intelligence regimes as a structural enabler.
Two points remain genuinely uncertain on the basis of the available reporting. The first is the size of the relocated network: the investigation describes a presence, not a headcount, and the sources do not provide a specific figure. The second is the operational yield: how much actionable intelligence the Japanese station has actually produced, and against which specific targets, is not addressed in the surfaced reporting. A reader should treat the investigation's value as one of mapping and attribution, not of operational consequence.
The stakes for Tokyo, and for the alliance
If the reporting is accurate, Japan faces a problem that is qualitatively different from the European experience. European capitals have spent four years hardening their diplomatic screening, tightening visa issuance and reducing embassy footprints on both sides of the Russia-Europe divide. Tokyo has not moved at the same pace. The cost of that asymmetry is borne not only by Japanese intelligence consumers, but by Washington, Seoul and Canberra, whose classified work with Japan passes through networks that Russian services are now better positioned to map.
The likely policy response, if the investigation gains traction inside the Japanese government, will be a tightening of screening on Russian diplomatic arrivals, an expansion of monitoring authority for Japan's public security organs, and quiet consultations with Five Eyes partners about reciprocity and intelligence-sharing arrangements. The trajectory points in one direction: Tokyo is on a slow glide path toward the European model, with the question being whether it arrives before or after the next significant Russian intelligence success on Japanese soil.
Desk note: Monexus framed this story around the asymmetric map of Russian intelligence exposure after the post-invasion European expulsions, rather than treating the investigation as a stand-alone spy scare. The structural point is the legal and diplomatic asymmetry between European and Japanese counter-intelligence regimes; the human-interest point is the GRU officer named in the reporting.
Wire provenance
This editorial synthesis draws on the following public wire/social posts:
- https://t.me/Tsaplienko/
- https://t.me/Pravda_Gerashchenko/