A single malware infection on one senior officer’s computer exposed the active caseload of a Syrian National Army military police unit – seven interrogation records, complete with detainee photographs, family maps, and fingerprinted confessions. Among them: an alleged espionage network, a smuggling ring run by serving soldiers, and one statement that exists in two different versions.
Executive Summary
In May 2023, an infostealer infected a computer belonging to the Military Police Investigation Section in Suluk, northern Syria – a unit of the Turkish-backed Syrian National Army (SNA).
The malware took saved passwords, cookies and a live Telegram session. Then its file-grabber module reached the Desktop and took the unit’s active detainee files: interrogation records holding each detainee’s full identity, their family, their photograph, and a first-person confession closed with a thumbprint. No encryption, no password – Word documents on a desktop. Five of the fourteen recovered files are Office lock files, meaning investigators were editing detainee records at the moment the malware ran.
Seven of those files are interrogation records. This article works through all of them, ordered from the most serious allegation to the least.
Three findings stand out
- An alleged espionage network feeding photographs and coordinates of National Army positions to Kurdish intelligence – named by a detainee who then offered to help arrest the people he named.
- A confessed human-smuggling ring run by serving soldiers from three SNA factions, moving groups over the border wall with a wooden ladder for 150 dollars a group.
- One detainee’s statement that exists in two different versions – with a prior drug conviction removed from the second, and a denial of drug use added.
Every personal name is withheld – detainees, the civilians they accuse, the smugglers they name, and the officers who signed. These people are in custody, under suspicion, or serving in an active war zone. Names appear as “******” in Arabic quotes and as a bracketed label in English.
The Machine & Identity Confirmation
UserInformation.txt from the stealer log, taken from Hudson Rock’s Cavalier platform.
The Windows account is not named after a person – it is named after the unit.
Most stealer logs list a first name as the Windows username. This one lists an institution. We did not have to work out who owned the machine; whoever set it up typed it in.
The IP places the machine in Gaziantep, Türkiye – but no Turkish keyboard layout is installed, the system language is
Arabic, the time zone is saved under its Arabic label (“Kuwait, Riyadh”), and the saved logins include a Syrian
.sy domain. Gaziantep is where the Syrian Interim Government and the SNA keep their administrative offices.
The log also contains a saved Facebook autofill entry whose Arabic name, once decoded from a codepage error, matches the name that signs the unit’s arrest reports as رئيس قسم التحقيق – Head of the Investigation Section. His personal Facebook, PayPal and bank logins sit in the same log as the interrogation files. This was one officer’s computer, used for work and for everything else.
The Interrogation Format
Seven documents share one template, which the unit calls ضبط تحقيق – “Interrogation Record.” Each opens on Syrian Interim Government and National Army letterhead, under the Military Police crest, then a fixed identity block. As Figure 1 shows, the detainee’s photograph is pasted in alongside:
- Full name and kunya
- Father’s and mother’s names
- Year and place of birth
- Job and address
- Marital status and children
- ID number and phone
- Nationality, ethnicity and tribe
- Education
- Date of arrest
After the statement, every file ends with the same closing line:
تليت عليه افادته فأيدها وبصمها
“His statement was read back to him; he affirmed it and fingerprinted it.”
And three signatures: محقق / محقق / صاحب الإفادة – Interrogator, Interrogator, and the person giving the statement. Two interrogators, one detainee, a thumbprint. No lawyer and no judge anywhere on the form.
Two details recur. The ID field usually reads لا يوجد (“none”), and identity is taken بمجرد اقوالي الشفهية, “purely from my spoken statement.” And every file carries the printed assurance that the statement was given بدون ضغط أو إكراه – “without pressure or coercion.”
The Cases, Most Serious First
Alleged espionage: coordinates on National Army positions
Longest file in the set (~17KB). Detainee handed over by the Ahrar al-Sharqiya faction, arrested 29 April 2023.
The detainee is a laborer, born 1995, seventh-grade education, from a village south of Tell Abyad. He arrives with no ID at all – his file records that his and his wife’s identity cards were being held by a Raqqa hospital against an unpaid bill.
His own record is not clean. He served nine months in the Kurdish Self-Defense Forces, in broken stretches because he kept deserting. He was a fugitive when he was caught: he had beaten his maternal uncle with a stick in a dispute over an aid card, and a court in SDF-held Raqqa sentenced him in absentia to three years for intentional harm. He fled toward Tell Abyad through a chain of smugglers on motorbikes and was arrested the same day he crossed.
Most of the file is not about any of that. It is about other people.
He names a relative by marriage – a man he says pledged allegiance to ISIS, later ran a bakery, and now works with Kurdish intelligence – and describes watching him take a video call from a contact saved in his phone with no name, only a row of repeated letters (ااااا):
وكان يطلب منه صور ونقاط للجيش الوطني وأهالي تل أبيض المنتسبين للمراكز الأمنية والجيش الوطني وطلب منه صور بمحكمة تل أبيض
“[He] was asking him for photographs and positions of the National Army, and of Tell Abyad residents affiliated with the security centres and the National Army, and asked him for photographs of the Tell Abyad courthouse.”
He names a woman he says is paid for photographs and locations, specifying two transfers – 500,000 and 750,000 Syrian pounds – through a named money-transfer office in Raqqa. He names an alleged Kurdish intelligence officer, and describes being driven to a roundabout in Ain Issa and held by the neck while that man questioned him. He gives tribes, neighbourhoods, workplaces, and vehicles down to make and colour.
Then the interrogators put a direct question to him:
سؤال : من هم أشقاء وانسباء المدعو ****** ويتواصلون معه
“Question: Who are the brothers and in-laws of [name withheld] who are in contact with him?”
He answers with a list – one brother in contact and serving as a soldier, though he says he does not know in which force; another with no contact; the rest family only. The exchange shows the purpose of the session: not to resolve his own case, but to expand a target list.
He closes by volunteering:
واني مستعد للتعاون والمساعدة باي شكل ترونه مناسبا والتعاون معكم لإلقاء القبض على المتعاونين
“I am ready to cooperate and assist in any way you see fit, and to work with you to arrest the collaborators.”
Whether any of it is true cannot be assessed from the document, and that is not what makes it the most serious file here. What makes it serious is that unproven accusations of spying, attached to real names and neighbourhoods, in a region where that accusation gets people killed, were sitting in a Word file on a malware-infected computer. This log has been circulating since 2023.
A smuggling ring run by serving soldiers
Serving soldier, Jaysh al-Majd. Arrested at his own home, 30 April 2023.
The only file written as a formal question-and-answer session – and the only one where the unit clearly had evidence before the detainee spoke.
He is a soldier, born 1994, ninth-grade education. He farmed with his family early in the war, lived in Türkiye from 2015 working construction, and returned two months after the SNA took the area, joining Jaysh al-Majd immediately because his brother commands a group in it. He was still serving when they came to his house.
The unit already had the case
من خلال البحث والتحري وافادت المهربين السابقين… ورد اسمك ولقبك في عدة إفادات وتقارير لهم تبين ضلوعك في عمليات تهريب البشر اشرح ذلك بالتفصيل
“Through investigation and inquiry, and from the statements of previously arrested smugglers… your name and alias appeared in several of their statements and reports, showing your involvement in human smuggling. Explain this in detail.”
This is one detainee’s file being used to build the next. Earlier smugglers named him; now he is in the chair, and he will name more.
The confession
نعم عملت بالتهريب منذ سنتين او اكثر… وكان العسكريين الذين ذكرتهم يأمنون لنا الطريق… وانا بدوري نقوم بمساعدتهم عبر سلم خشبي بتجاوز الجدار وكنا ناخذ على كل دفعة ركاب 150 دولار تقريبا وكل دفعة حوالي 10 أشخاص أو أكثر إلى 15… أما فوق الجدار أو عن طريق عبارة تحت الجدار
“Yes, I have worked in smuggling for two years or more… the soldiers I named secured the route for us… my own part was helping them over the wall with a wooden ladder. We took around 150 dollars per group, each group about 10 people, up to 15… either over the wall or through a culvert underneath it.”
The network he describes is almost entirely military: two partners in his own faction (one of them in custody alongside him as he speaks), one in Suqour al-Sunna, 20th Division, and two men known to him only by kunya who served with Jaysh al-Sharqiya and delivered the passengers. Soldiers secured the route. On the Turkish side, three men in one village housed the groups and moved them on to Urfa once fees were settled – one a Turkish national, two Syrians living there.
The interrogators widen it
سؤال : من هم الذين يعملون بالتهريب من منطقة ****** اذكر أسماؤهم
“Question: Who works in smuggling from your area? State their names.”
He gives three. Two are marked عسكري جيش المجد – soldiers in his own faction. The third is a civilian.
Across the whole statement, only one person he names is a civilian. Read as a document produced by the SNA’s own military police, this is an SNA unit recording on its own letterhead that soldiers from three of its factions were running the border as a business – while, in the same folder, civilians sit in its cells for trying to use routes like it.
An armed soldier, a shooting, and a statement that exists twice
Serving soldier, 20th Division. Two versions of his file were recovered.
The detainee is a soldier born 1994 in a village near Deir ez-Zor, sixth-grade education. His file compresses ten years of war into a few lines: Free Syrian Army from the start; fighting ISIS in Marqada and the Hasakah countryside in 2014; withdrawal to Quneitra; then Jaysh Usud al-Sharqiya in the Qalamoun, where he was captured by Assad government forces and held for a year, released in a prisoner exchange; then Liwa al-Qaqaa under the Shamiya Front from 2016; then the 20th Division.
He was arrested after a checkpoint stop turned into a firefight. He was riding as a passenger; military police stopped the car at the market gate and asked for IDs:
وطلبوا منه هويته العسكرية ورفض أن يعطي هويته ونزل من السيارة وحصل مشادة كلامية… وحصل إطلاق نار
“They asked him for his military ID, he refused to hand it over, got out of the car, and an argument broke out… gunfire was exchanged.”
The driver had a Russian rifle, the front passenger a pistol. Both ran. He stayed, saying he had been trying to get between the two sides and was unarmed, and he is the one in the file.
And then the same statement appears again, changed
Both versions cover the same career and the same incident. Four things differ:
| Version A | Version B | |
|---|---|---|
| Arrest date | 28 February 2023 | 28 January 2023 |
| 2018 conviction | “In 2018 I was detained in Azaz military prison on a charge of narcotics use for one year” | −Removed |
| The 2021 killing | “a manslaughter occurred during my pursuit of a stolen car” | +“…during my pursuit of a stolen car at the request of my command in al-Qaqaa“ |
| Drug residue in the car | Not mentioned | +Q&A added – he denies it, and states “I do not use any type of narcotics” |
The changes run one way. The version that adds the foil wraps found in the dashboard – and his blanket denial that he uses narcotics – is the version with the year in military prison for narcotics use taken out. The killing during the vehicle chase, meanwhile, acquires a clause placing it under orders. The arrest date moves by a month, so at least one of the two documents is wrong on a basic fact.
We cannot say who made the edits or why. What the two files show is that these statements are drafted, revised and reshaped – while carrying, in both versions, the printed line that the account was given “without pressure or coercion” and closing with the detainee’s thumbprint on it.
He ends both the same way: واطلب الشفقة والرحمة – “and I ask for pity and mercy.”
Smuggling with a receipt
Water-tanker driver, born 2001, two years of schooling. Arrested 5 May 2023.
He hauls drinking water to his village. He also drives people toward the border in the same tanker, and moves diesel bought from a supplier who brings it up from Raqqa. He does not appear to have been pressed hard; the admissions come in sequence with the rest of his account:
وكنت أخذ 50 الف على الشخص
“I took 50,000 [Syrian pounds] per person.”
The detail that matters is what he does next. For both the passengers and the diesel, he takes a receipt from المكتب الاقتصادي لأحرار الشرقية – the economic office of the Ahrar al-Sharqiya faction. This is not smuggling hidden from the authorities; it is smuggling that pays a fee and is issued paperwork.
His file also carries the fullest example of a pattern that runs through the whole set. Before his story begins, it enumerates his family – father, mother, nine siblings, seven uncles, his sisters’ husbands – each with an age, a town, a job, and an individual verdict appended:
****** : مقيم في الكنطري ٣٥ عام مزارع لم ينتسب أو ينضم لاي حزب ارهابي
“[uncle, name withheld]: lives in Kantari, 35, farmer, did not affiliate or join any terrorist party.”
Two of the siblings cleared of terrorist affiliation are five and eight years old. Nobody assessed a five-year-old – the line is there because the form asks for a line. The unit is not investigating a suspect so much as filling in a map of his entire family. His file also notes his father’s earlier three-month detention on suspicion of ISIS allegiance, ultimately released; suspicion in these documents runs up and down a family tree.
Twice conscripted by the other side, twice deserted
Laborer, born 1986, three children. Arrested 11 April 2023.
His file is a decade of being pulled into other people’s armies. Conscripted by the Assad government, discharged sick with hepatitis, re-arrested at a crossing to finish his service, then deserted. Five months with the Free Syrian Army. Oil burners under ISIS. Then, in 2018, Kurdish forces stopped him on the road while he was hauling fuel:
وتم سوقي إجباريا إلى الخدمة في الدفاع الذاتي
“I was forcibly taken to serve in the Self-Defense Forces.”
Three months on a guard post beside government lines, armed with a Russian rifle, on a salary of 70,000 Syrian pounds – then he ran. Two years later they caught him again, fined him 300,000 pounds, and since he could not pay, sent him back to the same post. Six more months, then he ran again. He puts his total service at eight months across the two stints.
This is what makes his case more serious than the two below it: he carried a weapon for the adversary, however unwillingly. His statement addresses that directly, and closes on the question that clearly matters most to the interrogators:
كلا لست مكلفا باي مهمة بالمنطقة وليس لي اي علاقة بتنظيم قسد الإرهابي بعد هروبي منهم
“No, I am not assigned any mission in the area, and I have no connection to the terrorist Qasad organisation after deserting them.”
He came to the border to reach his brother in Mardin, who works on a cattle farm, and brought his nine-year-old son with him. The smuggler wanted 1,700 dollars for the two of them. They were caught by border guards, he paid a 1,000-lira fine, and then the SNA arrested him.
A salary from the Asayish, for playing in the band
Hairdresser, born 1999, divorced, two young daughters. Arrested 5 May 2023.
She trained a year in a salon, then worked from home. Her file records that in February 2023 she registered for a civilian post in the Asayish’s music band in Qamishli, to draw a salary and help her family – learning drums and guitar four hours a week under a named instructor, paid about 275,000 Syrian pounds a month for two of her three months. She quit before leaving for the border.
That is the whole of the affiliation against her, and it is the reason her case sits this low. Her file, like the others, enumerates her brothers with an affiliation verdict on each – including that two of them, aged 16 and 23, are in custody alongside her.
The group she travelled with was her two brothers and a deaf relative who speaks only Kurdish, with his wife and two daughters. The smugglers wanted 3,500 dollars per person. They were caught by border guards, held five days by criminal security in Tell Abyad, and released after paying 300 Turkish lira each.
Then they went back – because the deaf relative’s wife and children were still in the smuggler’s house. They were arrested as soon as they crossed in. That second arrest is this file.
No allegation at all
Farm laborer, born 1989, six years of schooling, three children. Arrested 24 February 2023.
He was discharged from Assad-government conscription in 2010, worked mud and farm labour, and stayed in his village through the war. He paid smugglers to reach his brother in Diyarbakır, who has worked as a porter in a vegetable market since 2012. He crossed with a group of about fifty people he did not know, and was picked up on the street before he ever reached the wall.
His file contains no alleged affiliation, no confessed crime, and no denunciation. It contains the reason he was held:
واشتبهوا بي بانضمامي أو انتسابي لقوات قسد الإرهابية كوني كردي
“They suspected me of joining or being affiliated with the terrorist Qasad forces because I am Kurdish.”
The phrase قوات قسد الإرهابية (“the terrorist Qasad forces”) is the unit’s own standard wording, not his. It appears in file after file, including in files where the detainee is denying any link to them.
He ends: “I regret this, and I ask for pity and mercy… and if released I will return to my home.”
The Rest of the Folder
A referral report. ضبط صفخة اولى.docx is a different form – a
محضر ضبط with its own case number, رقم الضبط: 47/2023, dated
30 April 2023. It refers a man from Deir ez-Zor to the القاضي الفرد العسكري بتل ابيض, the
single military field judge in Tell Abyad, for carrying no identification and being suspected of smuggling. The same
document records a seized truck released back to its driver under a signed release order, “and a settlement was reached
on-” – the sentence stops mid-line, unfinished.
Two registers. السيارات المحجوزة فرع سلوك.docx (“Seized Vehicles, Suluk Branch”) and a
stub headed تقارير السجن اليومية (“Daily Prison Reports”) are effectively blank in this
snapshot, but both are standing logs. The same desktop that held the confessions held the impound register and the
daily custody roll.
Five lock files. The ~$ files name documents that were open on the machine but whose
contents were not captured – including at least two further personal case files and a document titled
ورقة افادة درايف (“statement sheet – drive”), suggesting the caseload extended past what the
malware took.
The Rest of the Log
Phone forensics tools. The installed-software list is ordinary except for three entries:
Recover My Files, UltData for Android, and UltFone Android Data Recovery – tools
that pull contacts, messages, call logs and deleted files off Android handsets.
Set against the many files where detainees arrive with no ID, this suggests how the unit actually reconstructed who someone was and who they knew. The record captured the confession; the recovery tool captured the phone.
A stolen Telegram session. The log contains a full Telegram desktop session including its key files, enough to open the officer’s Telegram as him, with no password or code, read unit traffic, and message his contacts.
How it likely happened. The same machine holds logins for Facebook, PayPal, TikTok, cloud storage, a Turkish bank, a Syrian charity, dozens of router panels, adult webcam sites, and a cracked-Adobe-template site. With UAC disabled and Defender alone, this looks like an ordinary pirated-software or drive-by infection. No spear-phishing, no state actor.
What this leak adds
In a broad sense, much of what these files describe is already on the record. UN bodies, human rights organizations, and investigative journalists have documented SNA faction smuggling, arbitrary arrests of Kurds, coerced confessions, and detention without due process.
What is new here is not the allegation. It is the primary-source paperwork: the unit’s own interrogation records, unencrypted and never meant for outsiders, proving from the inside what was previously known mainly through victim testimony and external reporting.
What is fundamentally new
- Administrative proof of faction-run smuggling. Extortion and smuggling by armed factions were widely alleged. Here, the same folder holds a detainee describing people and fuel moved for a fee, with receipts issued by the Economic Office of Ahrar al-Sharqiya. That is institutional paperwork for racketeering, not a rumour.
- Side-by-side evidence of confession rewriting. Coerced or manufactured statements are often reported from outside. Here, two live revisions of the same official interrogation exist together: a prior narcotics conviction is erased, a manslaughter during a chase is rewritten as under military orders, and a denial of drug use is added before the thumbprint closes the file.
- An internal admission of ethnic profiling. Human rights reporting has long accused the SNA of holding civilians for being Kurdish. In Case 7, the Military Police’s own file states the custody basis as suspicion of joining “terrorist Qasad forces” because he is Kurdish, with no criminal charge or evidence recorded.
- Raw, unvetted espionage tip-offs on a criminal market. Named neighbours, phone contacts, vehicle models, and wire-transfer amounts (gathered from a detainee offering to help arrest the people he named) sat in a Word file on an internet-connected workstation, then dumped onto cybercrime markets. Unverified human intelligence, with real names attached, circulating since 2023.
- The unit’s workflow, in its own forms. Two interrogators, no defence counsel, no judge on the
form. Standardized thumbprints. Consumer Android scrapers (
UltData,UltFone) for building contact networks. Family profiling down to five-year-old siblings marked clear of “terrorist” affiliation. The bureaucratic machinery of a Turkish-backed military police section, captured mid-shift.
Conclusion
Infostealer logs are usually read for passwords. This one is worth reading for something else: it shows how an armed group processes people, in its own words, on its own letterhead.
Nothing here was written for outsiders. There is no press statement, no leaked policy paper, no defector’s account – just a form, and the form is more candid than any statement would be. Two interrogators and no lawyer. A thumbprint instead of a signature. Ethnicity as a field, and in one file as the stated reason for an arrest. Identity taken from nothing but the detainee’s own words. Families mapped down to five-year-olds. A printed promise of “no pressure or coercion” on statements that turn out to exist in more than one version.
The seven cases also line up into something the unit did not intend to document. At the serious end sit two files about the people running the border and allegedly spying across it – one of them a serving soldier who names five more soldiers, the other a detainee who names civilians and offers to help arrest them. At the other end sits a farm labourer with no allegation against him at all, held because he is Kurdish. The unit’s most serious cases were its own men. Its least serious were the civilians in its cells.
And the exposure runs the same way. The unit had complete physical control over its detainees, their documents and their phones, and almost none over its own computer. The people most harmed by that are not the officers. They are the detainees, whose confessions, family trees and accusations against their neighbours were copied to a criminal marketplace and have circulated there since 2023 – without any of them knowing.
In a breach like this, the people harmed by the leak and the people held by the unit are the same people, twice.
About Hudson Rock
This investigation was built from an infostealer log recovered and analyzed in Hudson Rock’s Cavalier platform. Hudson Rock maintains cybercrime intelligence on over 30 million computers infected by information-stealing malware – the same datasets used by governments, financial institutions, and research teams to attribute compromises, map threat actors, and surface operational intelligence that never appears in public reporting.
Explore the platform at hudsonrock.com, or check any email, domain, or IP against our data with free tools at hudsonrock.com/free-tools.
The post Inside a Syrian Interrogation Room: The Detainee Files an Infostealer Stole From a Military Police Unit appeared first on InfoStealers.