The Mysterious Background of Geo Trend Corporation
How a Russian systems integrator, hacked by GUR, led to a Russian oil and gas operation, owned by a BVI shell company, and registered as a U.S. Delaware corporation
Posted in the OilCareer.Ru forum on July 16, 2013:
Good afternoon.
GEOTREND. Tell people in the know who heard about this company?
Here is their website http://geo-trend.ru/
I found only one review on the Internet ..... "company g *** o, the equipment is the same, just money laundering." (emphasis added)
SOFCOM is a Russian systems integrator company that works with a wide array of Russian government and corporate clients to assist them with their IT business requirements; everything from servers to hardware to video surveillance. As such, they were a company of interest to Ukraine’s Main Directorate of Intelligence at the Ministry of Defense (GUR) Cyber team, who successfully breached the company’s network after Russia seized Crimea in 2014.
System integrators are popular targets for hackers because access to one is access to many. SOFCOM clients include a number of Russian government agencies including the Ministry of Defence, the Russian Railways, and the FSUE CFPO (Federal State Unitary Enterprise "Center for Financial and Legal Support" of the Administration of the President of the Russian Federation), so once SOFCOM’s email system was compromised, a hacker could, for example, find an email exchange with a target that included an attachment, add an 0-day to the attachment, and re-send with a high expectation for success.
NOTE: More information about how GUR’s cyber operators conduct their operations during the war against Russia will be shared by in an exclusive video interview (voices and faces disguised for security) coming this September. This will only be for paid subscribers and invited guests.
According to files shared with Inside Cyber Warfare from GUR’s cyber team, one of SOFCOM’s clients was a U.S. oil and gas company named Geo Trend Corporation based in Houston, TX. According to the company’s LinkedIn page:
Geo Trend is the leading independent provider of oil field optimization products and services. We offer customized Measurement While Drilling (MWD), Logging While Drilling (LWD), and completion products as well as expert services to ensure customer success, including training, technical and field support, repair and maintenance, and geological and geodynamic modeling. Headquartered in Houston, Texas, we partner with best-in-class technology and tool vendors to customize the world’s most advanced drilling solutions to the conditions of customer oil fields.
The company is a Delaware corporation and it registered with the Texas Secretary of State’s office on August 25, 2003. The most recent filing shows its headquarters as 4801 Woodway Dr., Suite 350W, Houston, TX 77056. LinkedIn shows 26 employees, 22 of whom are in Russia. There’s no founder mentioned, but that’s the really interesting part which comes later.
Even though the company has been in business for 18+ years, it doesn’t have a working website. According to WHOIS data, Geo-Trend.com was created on Sep 11, 2007 by Dennis Vongeist (oilman.com) and its registration data was modified on Nov 11, 2013. None of the registration details, including the name of the registrant, appears to be valid, and there’s no website.
The company’s Russian domain is Geotrend.ru. A historical WHOIS search showed that it was created on Jan 26, 2009 by “d.dzjuba@geo-trend.com.” There’s no evidence that that person exists either, but if you visit geotrend.ru, you’ll either get a 500 error or see the “It Works” message pictured below.
Geo Trend in Moscow
Geo Trend Corporation’s most recent address in Moscow was at Starokonyushenny Lane, 10. The four story building is rated as a class A business center. Geo Trend was a client of SOFCOM who spec’d out and installed the Internet, telephony, security, and video hardware and software for each floor according to client specifications. For example, here’s a partial list of the ALCATEL ports in the server room that served Geo Trend, Helios Advisors, and Soho Real Estate; the building’s occupants at the time.
Below is one of the IT documents created by SOFCOM for Geo Trend’s offices on the second floor.
The full documents, plus many more, are included in the SOFCOM data archive for paid subscribers at the end of this article.
Geo Trend in Nizhnevartovsk
Nizhnevartovsk is home to the world’s sixth largest oil field and the largest oil field in Russia - Samotlor Field, which has made the city one of the wealthiest in Russia. It is and will continue to be Russia’s main strategic raw hydrocarbons resource with over 475 oil and gas fields discovered to date.
Geo Trend Corporation had its offices at 628602, Khanty-Masi Autonomous Okrug, Nizhnevartovsk, st. Kuzovatkina d.5, building 3. It’s listed in the city directory of companies under Geology and geophysics, Foreign representations, Rental points.
Who Owns Geo Trend Corporation
The answer is unknown as regards Geo Trend Corporation.
There is a similarly named company in Russia called GeoTrend, LLC, also in oil and gas, which according to Audit-IT is owned 100% by Strandside Holdings Limited of the British Virgin Islands. It was incorporated in 2006 by the now infamous law firm of Mossack Fonseca. It has two shareholders - Bridgewater First Nominees Limited and Bridgewater Second Nominees Limited, neither of which are very revealing.
More interesting is that Strandside Holdings Limited is a shareholder of another BVI incorporated company New Media Technologies Capital Partners Limited.
All of the shareholders of New Media Technologies depicted on the above graph - USM Internet Holdings, ABU Holding International Limited, DST Advisors Limited, DST Capital Partners Limited, Epion Holdings Limited, and Kanton Services Limited - are holdings of Alisher Burkhanovich Usmanov, who’s listed as Beneficiary. The DST entities could also include Usmanov’s partner and another oligarch, Yuri Milner.
This begs the question as to whether Strandside Holdings Limited should also be included as an Usmanov shell company. It’s hard to believe that out of all the shareholders, it would be the one exception.
Sanctions
Usmanov’s business interests are so vast and intangled that the U.S. Treasury Dept created a special exemption for him when he was added to the sanctions list for fear that “curtailing (Usmanov’s) businesses could trigger broader economic pain and legal blowback” according to the Wall Street Journal.
Like the U.S. banks during the 2008 banking crisis, Usmanov appears to be “too big to fail.”
SUMMARY
Geo Trend Corporation doesn’t conduct itself like a legitimate U.S. company. There’s no web presence and the WHOIS data is fake. The company doesn’t maintain a white pages listing for its telephone service. It’s annual report filed with Delaware is a bare bones one page document. The vast majority of its employees are Russian. A different Russian company with the same name but registered as an LLC, is a shell company registered in the British Virgin Islands, that’s also a shareholder of a larger shell company the beneficiary of which is a Russian oligarch who’s so rich and whose holdings are so vast that the U.S. Treasury had to modify its sanctions order immediately after issuance to avoid a U.S. economic crisis; a tactic now known as the “Usmanov Mitigation”.
At the time of this posting, Inside Cyber Warfare has been unable to confirm if Geo Trend is still in business. A call to the Houston office building where Geo Trend lists its headquarters merely confirmed that Suite 350W was an accurate address for the company. It could just be a mail drop or virtual office.
A call to the Moscow office went un-answered. A real estate listing for 10 Starokonyushenny Lane announces that all four floors are leased but that “there are premises in the building … that … may become vacant soon. Call for exact dates.”
A call to the Nizhnevartovsk office also went un-answered.
This article will be updated with new information as it becomes available.
UPDATE
I received an email from USM Press Service that provided the following clarification:
New Media Technologies Capital Partners Limited was affiliated with Russian Geotrend LLC (ООО «Геотренд»), which has no ties to the U.S. Geo Trend Corporation.
The email did confirm that Strandside Holdings Ltd was an Usmanov-controlled entity, and both companies (GeoTrend, LLC and Geo Trend Corporation) were in the oil and gas business.
This article has been updated to reflect that new information.
A 27MB download for this article is available to paid subscribers. If you don’t see the download link, and you’d like to have access to the downloadable data for all of the Inside Cyber Warfare articles that offer it, please sign up for one of the subscription plans.
Keep reading with a 7-day free trial
Subscribe to Inside Cyber Warfare to keep reading this post and get 7 days of free access to the full post archives.