Brussels as a Transfer Hub - How a GRU Man Organized Europe’s High Tech for Russia’s Defense Industry

Belgian investigators have ordered the arrest of Viktor Labin, a man previously described by investigations as a link between European precision technology and the Russian defense industry. According to the Belgian Federal Prosecutor’s Office, Labin’s premises were searched as early as June 2025. He has been in pretrial detention since then. The first hearing is scheduled for February 26. It is a case that shows how closely circumvention structures can operate to Europe’s political centers without being immediately stopped.

Labin is said to have operated a business network in Belgium together with his sons Roman and Ruslan. At the center is a Belgian company named Groupe d’Investissement Financier, which according to available information supplied equipment to Russian recipients, including measuring and testing technology crucial for high precision manufacturing. The end recipient named is a Moscow family company: Sonatek. This company is said to have provided delivery and maintenance services for products used at at least 18 enterprises connected to the Russian defense industry. The material explicitly refers to coordinate measuring machines, devices used in modern production chains to check components for minimal deviations and to control manufacturing processes.

The listed customs data document repeated deliveries of high precision industrial and measurement technology from Europe to the Moscow company Sonatek. Belgian companies under the designation Groupe d’Investissement Financier appear as senders, with Sonatek in Moscow consistently listed as the recipient. Among the items recorded are coordinate measuring machines, CNC systems, and electronic testing systems - technology indispensable for industrial high precision manufacturing.

The matter becomes sensitive through the question of who Labin actually is. Investigations assign him to the Russian military intelligence service GRU. One indication cited is a Moscow address documented in registries that databases link to a known dormitory of the GRU Academy on Narodnogo Opolcheniya Street. In addition, another address appears in Zelenograd, which further research connects to housing for members of the military.

Such service or military addresses have been mentioned in several internationally documented cases in which GRU officers were later identified. In connection with the Salisbury operation in 2018, investigative teams demonstrated that involved individuals were registered in datasets linked to military facilities or service addresses. Similarly, in cases involving members of GRU Unit 26165 indicted by the United States for cyber operations, registry and service addresses at military locations appeared in investigations. Comparable patterns were also described in the investigation of the explosions in Vrbětice in the Czech Republic, where GRU personnel were likewise identified.

In Russia, registration through service or academy addresses for members of the security apparatus is not unusual. It serves administrative purposes and reflects institutional affiliation. At the same time, investigations in several cases have shown that such addresses could function as formal cover for operational officers before they appeared abroad under civilian identities. Such an address is not proof of a specific operation. It is, however, a substantial indication of structural proximity, especially when additional factors are present, such as business activities in security relevant technology sectors or family ties to defense related companies. In combination, this pattern gains weight and corresponds to structures documented in previous GRU cases.

The extract from the Belgian corporate registry shows Groupe d’Investissement Financier based in Uccle near Brussels. On June 8, 2023, at an extraordinary general meeting, the mandates of board members Roman Labin, Ruslan Labin, and Viktor Labin were unanimously renewed. Viktor Labin was simultaneously reconfirmed as managing administrator. The document also records the relocation of the company’s registered office within Uccle.

When exactly Labin moved to Belgium remains unclear and has not been precisely documented. Documents and registry entries, however, indicate that he was already living in Brussels in 2000, including at Avenue Winston Churchill, and was commercially active in Belgium at that time. The investigation in Belgium thus fits a pattern that European authorities have repeatedly confronted since the beginning of the large scale war of aggression against Ukraine: high tech that is not officially intended for military purposes can nevertheless enter defense supply chains if intermediaries, third countries, and formally clean constructions are used. Investigations show that deliveries did not simply end after sanctions began, but shifted. According to the findings, beginning in April 2023 the Belgian company allegedly used supply routes via a Turkish company with a similar name. Turkey is frequently cited as a transit country when goods flows are redirected because direct deliveries come under pressure. The investigations suggest that this shift was precisely part of the method: not necessarily open rule breaking at the outset, but the exploitation of gaps, exceptions, and jurisdictional boundaries until a gray area becomes a reliable channel.

Residential building of Viktor Labin in Brussels

Noteworthy as well is how openly the familial division of labor is described. Ruslan Labin, reportedly head of Sonatek in Moscow, is said not to have denied upon inquiry that the listed defense enterprises were customers. His response, paraphrased, was that they were their customers, that they had supplied them before, and perhaps were supplying them now. At the same time, he reportedly emphasized that his father was a businessman and that he and his brother had never served in the army. This kind of distancing is typical for such structures: business language, formal separation, no clear line on which responsibility can be firmly pinned.

Roman Labin, who lives in Brussels, is described in the documents as having business connections with the Moscow company as well. Investigations uncovered a payment from Sonatek to Roman in the amount of 3.3 million rubles in 2022 for a delivery recorded as a machine tool. At the same time, Roman is politically active, appearing at pro Russian demonstrations in Western Europe, including serving as a translator at an anti American protest in Paris and participating in actions in Brussels directed against Ukraine. Viktor Labin’s wife, Vera Labina, is also described as publicly supportive of the war, with corresponding posts on social networks.

One detail that remains striking is the proximity to the center of power. Brussels is home to the European Commission and NATO headquarters. If a man attributed with a GRU role maintained companies there for years, with an address, an office, a second company, and a network, this is not merely a matter of customs paperwork. It concerns a state’s capacity to enforce its own rules, and the question of how many such nodes remain unnoticed as long as they are not exposed by investigative work or chance discoveries.

Belgian authorities appear to have intervened precisely at that point: search in June 2025, pretrial detention since then, now a court date. What remains missing for a full assessment is what matters most: which concrete charges are being pursued, which deliveries are documented, through which companies they were routed, and which legal provisions are considered violated or circumvented under Belgian law. The outcome of the investigation remains open, but the arrest shows that Belgium no longer treats the issue as a superficial sanctions problem, but as a criminal matter.

In the end, the Labin case shows above all one thing: circumvention today is rarely a crude smuggling story. It is company registries, seemingly inconspicuous addresses, technical products with civilian surfaces, transit routes through third countries, and a system that functions until a state loses patience and forces the door. In Brussels, that has now happened. How deep the network runs and who else will appear in it will only become clear once Belgian files reveal more than the information that a man is in custody and is to appear in court on February 26.

To be continued .....