The Bear Net “Pirate”

The “Bear Net” of Russian Long Range Aviation has been relatively busy during the last few months, no doubt some of this due to the exercises playing out in Northern Europe by Western countries and NATO. They also tend to increase activity around the same time as USSTRATCOM have their Global Thunder exercises, one of which kicked off on the 29th October and lasted for just over one week.

Three Russian missions took place within the last two weeks, all of which travelled through the same airspace as the area covered by Exercise Trident Juncture 2019 (TRJE18) off the North coast of Norway. One flight was of a single Tu-142M, RF-34063//Red 56, that made a low pass near participating ships. I was unable to follow this flight so not received by me, the likely callsign on the CW frequencies for this was LNA1. This was intercepted being called by IWV4 on 8112 kHz at approximately the same time as the pass was being made. Images of the pass were caught by AFP correspondent P. Deshayes who was on one of the ships.

One of the other missions was of more interest than normal. The “Bear Net” is always an interesting thing to follow on HF, but when extras are produced it makes them even more fascinating. In this case it wasn’t so much what the Russian did, but what happened late on in the mission that wasn’t them.

Stepping back, we’ll go to the beginning of the day – 31st October 2018. The net was still on the autumn frequencies with ground station CW first being picked by myself sending “W” markers at 0920z on 8162 kHz. I quite often put one of the receivers on the current season ground station frequency to get any alert of possible flights heading out thanks to the markers sent every 20 minutes at H+00, H+20 and H+40. With this 0920z interception I started recording the frequency and I switched all radios to the other known frequencies – 9027 kHz for Air CW and 8033 kHz for Simplex USB voice comms – and got set up to start recording these should anything happen.

The 0940z W marker came, but interestingly when I went through the recordings later on I was able to hear a very faint G marker in the background. This had at least two operators carrying out the task as there were two distinct methods of sending. One would use the standard G every two seconds, whilst the other sent as double G’s and slightly quicker. The marker also started approximately 10 seconds earlier than the W and – guessing as it was stepped on by the W – looks to have lasted the two minutes too. You could hear it in the background between the odd W space.

At 0949z 8033 kHz became active and I started up recording on multiple SDR’s whilst using my Icom IC-R8500 as the live radio. By this time, I had also observed callsigns associated with QRA flights on my SBS so was pretty certain something was heading towards the UK.

With a few more USB calls following, but no CW traffic except for the markers I was certain the aircraft involved were Tu-160’s as they don’t use CW.

My Russian is still pretty basic (if that) so I totally rely on recordings to go through it all in slow time. I had been able to work out live that there was at least the usual STUPEN callsign along with TABLITSA; but I was also hearing another one that when going through the recordings I worked out to be KONUS – this one I hadn’t heard of before.

Going through the recordings, this mission certainly helped my knowledge of Russian numbers, or rather the methodology of how the messages are sent, as there were plenty of messages involved. The two aircraft callsigns were 16115 and 16116. These callsigns carry on in sequence to those that were used on a mission a few days earlier on the 28th with 16111, 16112 and 16114 being used by Tu-160’s and 50606 by an accompanying A-50.

In general 16115 was much harder to understand than 16116. 16116 said it all much slower and louder. STUPEN was very clear at the beginning, but faded towards the end, whilst TABLITSA may of well have been in my room, she was that loud.

Here then is the first part of my USB log:

8033 – Bear Net

0941z 16116 calls STUPEN
274 443 624

0949z 16116 calls STUPEN
458 842 156 816 443 896

0959z 16116 calls STUPEN [replies, 16116 faint]
KONUS calls 16116 and tells him to pass the message to him

1000z [16116] 303 847 023 534 734 619 822 332
[with wrong read back of group three, corrected by 16116]

1002z 16115 call KONUS
138 534 005 964 312 147 443 896

1010z 16115 call KONUS
741 534 724 619 822 180 443 594

1020z 16116 calls STUPEN
478 815 023 534 071 955 117 957 084 305

1028z 16115 calls TABLITSA, then straight away calls STUPEN
138 1?5 [error?] 138 534 540 115 ??? 251 660 033 084 316
[garbled with a possible error]

1036z 16116 calls STUPEN and TABLITSA, STUPEN replies
303 815 023 534 671 612 842 768 084 544

1039z 16115 calls TABLITSA and STUPEN, STUPEN replies
741 534 671 619 246 768 023 084 544

1048z 16115 calls STUPEN
138 534 491 236 896 443 084 635

1050z 16116 calls STUPEN
478 815 023 534 635 233 107 219 084 615

The recording below contains the 1048z and 1050z messages

1112z 16116 calls STUPEN
452 635 084 125
[repeats third number twice]

1129z STUPEN calls 16116 twice – no answer

1132z STUPEN calls 16116 twice – no answer

1133z STUPEN send message
BLIND 553 028 533 ??1

1141z 16115 calls STUPEN
741 534 360 810 719 980 447 023 038 914

1144z 16116 calls STUPEN
303 875 023 534 106 673 980 719 038 914

1148z 16115 calls STUPEN
138 537 023 534 674 400 388 521 038 496

1159z 16115 calls STUPEN
741 537 023 534 940 441 388 441 038 896

1201z 16116 calls STUPEN
478 816 023 534 717 355 637 321 038 496

1210z 16115 calls STUPEN
138 537 023 534 600 902 955 462 038 844

1213z 16116 calls STUPEN
303 815 023 534 186 117 388 117 038 896

1217z 16115 calls STUPEN
741 537 023 534 981 980 356 789 905 149

1306z 16115 calls STUPEN
138 537 023 534 540 288 810 236 905 206

1318z 16115 calls STUPEN
352 315 544 243 942

1320z 16115 calls STUPEN
[4 calls, no answer]

1322z 16115 calls STUPEN
741 537 023 534 724 284 312 816 315 555

1325z 16116 calls STUPEN
457 187 905 844

1351z 16116 calls STUPEN
457 187 315 715

Then comes the interesting part of this…… the arrival on frequency of the “Pirate”.

At 1427z an open mike became present on the frequency, in AM mode. This was fairly brief, and at 1429z the Pirate started.

Mike Delta Kilo Romeo, Mike Delta Kilo Romeo
Mike Delta Kilo Romeo, Mike Delta Kilo Romeo Standby
Mike Kilo Delta Romeo, Mike Kilo Delta Romeo, Mike Kilo Delta Romeo Standby

Note his own error or change with the callsign


Image of carrier wave and transmissions of MDKR//MKDR. The Pirate is using AM mode, but as the recording was in USB only that half was captured.

This was followed at 1431z
Mike Kilo Delta Romeo

The audio for the above is here:

At 1439z he was back but very faint, almost like it was a recording or live transmission of a Numbers Station. Shortly after this 16116 tries to call STUPEN and KONUS, getting stepped on by the Pirate who sends yet another attempt at an EAM/Numbers Station.

C78AAA5ACBCEA77D76FF33EAFAE63CF5A7AAAAFAF555A85CDBEEBBA5D6DFCCA – or something like that! It was hard to work out some of the digits due to the lack of phonetics. Each time I listen to it I get a different result!

Fake EAM/Number station message

The audio is below.

At 1446z, 16116 calls STUPEN, KONUS and TABLITSA but gets no response back.

The Pirate then attempts to jam the frequency again. First of all with an extract from a selcall system used by the Russian Ministry of Foreign Affairs given the name “Mazielka”, designated X06 in the Enigma Control list. See the end of the blog for analysis on this.

This was followed by a continuous tone at 1090 Hz for approximately 35 seconds. These are the last transmissions by the Pirate.

Again at 1459z, 16116 tries the ground stations until TABLITSA finally acknowledges his presence and a message is sent. 16116 is barely readable with me by this time, though TABLITSA was ridiculously loud.

1459z 16116 calls STUPEN
calls STUPEN
calls TABLITSA answers [very strong]
452 730 969 463

1506z 16115 calls TABLITSA
590 375 143 986 196 233

1531z 16116 [very faint] calls TABLITSA
452 859 143 168

This was the end of all contacts on USB, with the last W marker coming it at 1520z (though these then did start up again at 1640z, though much weaker).

From various OSINT feeds, the approximate route of the Tu-160’s took them out over the Barents Sea having departed Olen’ya air base in the Murmansk Oblast and heading north before turning west once out over the sea. At some stage they were intercepted by Norwegian Air Force F-16’s and were escorted to abeam Bergen/NE of the Faroe Islands before turning for home. The Russian Air Force have stated that the flight lasted for ten hours which ties in with the seven hours or so of HF traffic, with the remaining 3 hours probably within range of Russian VHF communications.

Olen’ya is a common forward operating base for LRA missions, being one of the remaining Arctic Control Group (OGA) airfields available. The base itself hosts Tu-22M-3R Backfire-C of the Russian navy. These are Tu-22M3’s that have been converted for a navy reconnaissance role though it is unknown just how many are airworthy. The base has over 30 Tu-22’s in permanent storage.

Twitter feed for записки охотника (Hunter Notes) has a rough plan of the route flown, along with his intercept of the messages sent – he has few of the earlier ones, and there’s a couple of differences between his and mine.

So, who is this Pirate? It isn’t the first time he’s been around. He was also heard in September.

On this occasion he was a little bit more direct.

Russians we are watching you
Russians we know where you are
Russians, turn around and abort your mission

And later

We will blow you out of the sky
The Russians. We have you under observations [sic], stand down

Despite having what is clearly a South East England accent, he signed off using something along the lines of:
This is the United States BC36

No doubt he is trying to gain some sort of attention, and in a way he is succeeding – me writing this blog is proof of that. But what else is he trying to achieve? Is he hoping the Russians respond? I doubt they will. Apart from anything, I expect the radio operators, having had to listen to all the noise on HF for every flight, have learnt to ignore any calls which aren’t specific to their mission.

My initial thoughts were that he isn’t a radio amateur and hasn’t worked in any other field that involves speaking on the radio. His use of poor phonetics made me wonder this. However, with access to a transceiver and associated antenna this may not be the case – and amateur radio operators tend to make up their own phonetics rather than standard ones, and he may just not know them.

That said, he must have some interest in military aviation and possibly a member of a military aviation forum. These tend to have thousands of members that have not been vetted in any way or form and quite often have threads that give notice of flights are on their way, be it with an alert of a QRA launch or actual comms received on Bear net frequencies.

Twitter, of course, is another example of information being out there for anyone to then take action on.

One thing is for sure, if caught he will find himself in trouble with UK authorities with the possibility of a two year prison sentence and a heavy fine. He will most definitely lose his radio licence should he actually have one, and have all equipment confiscated.

Lets see if he turns up again in another LRA mission.

Analysis of the Mazielka (X06) transmission

It was obvious straight away that this was a recording of X06 – in this case the sub-variant X06b.

However there was something odd about it.

X06 is a selcall system used by the the Russian Ministry of Foreign Affairs to alert outstations of an upcoming message, normally on another frequency.

The system sends out 6 tones, each lasting 333 milliseconds, making each call 2 seconds long. Each tone represents numbers 1 to 6 making a total of 720 different selcall combinations available for use.

The tones are sent on slightly different frequencies:
1 – 840 Hz
2 – 870 Hz
3 – 900 Hz
4 – 930 Hz
5 – 970 Hz
6 – 1015 Hz

The image below is taken from a X06 call I intercepted in November 2017 and decoded using go2Monitor. This shows a selcall of 116611. In this case the tones, which are still 333 ms long, sound longer but this is because the digits join on the same tone.

Whilst you can use a decoder, for X06 it is easy enough to decode using other means, such as Adobe Audition or Signals Analyzer. With these you can measure the tone frequencies and lengths.

In Adobe Audition the Pirate transmission is shown below


What is unusual is that the tones are off by 60 Hz. Whilst 1 should be at 840 Hz, here it is at approximately 900 Hz, and 6 is at 1075 Hz rather than 1015 Hz. Whether this is because the Pirate was transmitting in AM rather than USB I’m not sure. Maybe it is something to do with his original recordings. My recording is below

It is likely the long tone sent after the selcall here is the usual long tone that is sent before the standard ones. This is sent at 1090 Hz.


Looking at it using Signals Analyzer (SA) you can see that it is definitely X06. With SA you can measure more accurately the frequency and length of each tone.


Here you can see the two tones (actually 6). The total time for the selcall is 2.040 seconds with 1 marked at 896 Hz and 6 at 1074 Hz


Measuring the length of an individual tone (though actually 3 joined together) gives a length just over 1 second or 3 tones at 333 ms each


Finally, measuring the space between each call gives us 1.312 seconds which is the correct spacing for X06

The sub-variant of X06b is designated due to its format of six tones sounding like two. It is thought this is a test transmission.

Finally, just to confirm my theory, I ran a looped sound file through go2Monitor with the result confirming the selcall as 111666



February’s Blackjacks

After a couple of days of teasing us with the standard “W” markers in CW, on the 17th February the Russian Air Force (Военно-воздушные cилы России [BBC России]) carried out a Long Range Aviation mission using two Tu-160 Blackjacks.

I was able to monitor nearly the whole mission on HF (both in CW and Voice USB), with a small amount on UHF (though no Russian Air to Air voice comms were received on VHF/UHF) and following some investigation into my data along with other logs and reports from the internet and friends, I can now compile a rough idea of the routing they took on their journey to the English Channel and back again.

The first reception I had that showed a mission was taking place was at around 0830z when a standard 3 figure group message was sent by IWV4 but unfortunately I was just setting up my gear and so missed it to write down. Further “W” markers took place at the usual every 20 minute schedule of 0840z and 0900z, with IWV4 sending another message at 0903z to the aircraft. This call gave us the CW callsign for the aircraft, probably the IL-78 Midas4YMA

Russian Air Force TU-160 Blackjack RF-94104 “Alexander Golovanov” © Crown copyright 2016

As is standard, the early part of the mission was relatively quiet on CW with markers only, though there was one unusual thing that took place around 0920z. Firstly there was no 0920z “W” (this only happened one other time for the whole day at 1600z – the 20 mins schedule was kept going solidly otherwise) and secondly, at 0922z, there was a sending of data on the frequency. The first eight minutes was a carrier tone centred exactly on 8112; with the full data commencing at 0930z continuing until 0943z. Unfortunately, the CW recording I had for the day got corrupted so I wasn’t able to analyse the signal to at least try and determine what type it may have been. Of course, it could have been coincidence as we all know that many of the frequencies used by the Russians are shared, but this does seem almost too good a coincidence. One thing is noteworthy in recent missions, and that is the big reduction in CW messages over the large increase of voice messages – are the Russians trying out a new data messaging system for their Long Range Aviation fleet?

8112 continued in the usual manner for most of the morning, with the occasional message or “radio check” [QSA] but there wasn’t much else. The Winter CW frequency for the aircraft side of the “Bear Net” had always alluded us and was in fact the only missing frequency we had for the whole net, so it was just the ground side of the duplex network that I was receiving. I had 8990 down as a back-up frequency for their voice comms and I was monitoring this frequency on my Icom IC-R8500 in USB mode, with all the remaining Winter frequencies on the Titan SDR Pro. I was also using the Titan to monitor most of the Oceanic frequencies in case they were coming this way, something useful to do as this can sometimes give away the rough position of the Russians. Because of this set-up I had the SDR monitoring the Oceanic frequencies in the 8MHz range. The bandwidth I’d allocated also incorporated 8990 and it was during a QSA check at 1205z from IWV4 on 8112 that I noticed a faint trace of CW on the frequency! I quickly changed the mode on the Icom to CW and caught the end – “QSA3” – nothing else followed, but it looked like I had found the Winter CW airborne frequency for the “Bear Net”. But, I had to be sure.

Russian Air Force TU-160 Blackjack RF-94101 “Paval Taran” © Crown copyright 2016

Up until now there had been zero voice comms on 8131, the primary Winter voice frequency, but not too long after the 1205z QSA check on CW the first call came with 44732 calling KATOLIK followed by a call to BALANS after not much luck with KATOLIK. There was one more call after this on 8112 before this frequency went to markers only, but there was a reply on 8990 confirming that this was the Winter CW frequency for the aircraft. The complete 8112/8990 transcript can be found in PDF format in my full CW log

Going from various reports, the Northern QRA had not launched so this led me to believe that the Russian aircraft were not coming in the direction of the UK, but when I noticed on my SBS that the Tanker was travelling north from Brize Norton, then I wondered if they were. The only comms I had was from the Tanker with Swanwick Mil so I presume (and with no logs showing anything from Lossiemouth) that a long range track of the Blackjacks was taking place.

Certainly, on Oceanic warnings were being passed about the “unknown” traffic heading south and it’s from this information that I’ve been able to roughly guess their initial routing, down through the Shetland Island and Faeroe Island gap to near ERAKA, before tracking south along the 10W line – like I say, a rough guess, but going on previous routes this won’t be far out. They probably got to around the NIBOG area before tracking SW to go around Ireland, before heading in again towards Lands End and the English Channel.

Voice comms on HF with BALANS was pretty continuous by this stage, with three potential callsigns heard. Two would have been the Blackjacks, 44731 and 44732, with a third more than likely the support IL-78 Midas tanker that remained clear up to the north and so was much weaker with me – I think it was 60991 but was too weak to tell, with only the readback from BALANS copied.

At about 1505z it was reported that two Typhoons from Coningsby that had launched about an hour before, and had been holding in ARA10W, had joined up with the “unknowns” and these were identified as Tu-160 Blackjacks. The comms were again picked up by Kyle, and the Typhoons gave full details including the tailcodes, with the lead aircraft being RF-94101, the second RF-94104. The Russians name their Tu-160’s and these are given “Paval Taran” and “Alexander Golovanov” respectively.

By coincidence, at 1510z, 44732 calls BALANS with a message starting 502. I always suspect that they send messages out when they’re intercepted and I expect this was one of those messages. It could well have been that they were entering the Channel though, it’s hard to tell, but certainly for the whole time they were in that area, the messages sent began with 502. Around 1600z the French QRA also joined up and from images produced by the MOD, these were shown to be a single Rafale and a single Mirage 2000C – callsigns noted on Fighter Control as MASTIFF01 and MARAUD03.

Russian Air Force TU-160 Blackjack RF-94104 with a French Air Force Rafale and Mirage 2000C © Crown copyright 2016

From there the Blackjacks turned around and I expect pretty much followed the same route back. I could certainly tell that they were near to me later on, they were ridiculously loud on HF.

Below then is a copy of my voice logs, along with the recordings I made. A good test of my recently installed Wellbrook Loop that I’d finally been able to put up on the mast just the week before, after having it for nearly three months! Scottish weather!!

NOTE – These recordings are copyrighted to me. It has been noted that other recordings have ended up on YouTube, uploaded by a third party. Should this happen with my recordings, further action will be taken


1216z 44732 calls KATOLIK

1217z 44732 calls KATOLIK [KATOLIK very faint]

1218z 44732 calls KATOLIK, BALANS replies

1220z BALANS passes message 130 525

1222z BALANS calls 44731 numerous times
– Note, contains all of the above

1226z 44732 answers, BALANS passes message 130 525

1232z 44732 calls BALANS with message [too faint to copy]

[messages continue until 1245z, all too faint, multiple callsigns]

1302z 44732 calls BALANS with message 157 133 796 290 525 853

1306z BALANS and 60991[?] 532 598 757 706 057 162 363 395

1318z BALANS passes message 727 to 44732

1356z 44732 calls BALANS with message 197 077 950 525 305

1510z 44732 calls BALANS with message 502 549 447 360 981 848 842 366 215 492 481

1551z 44732 calls BALANS with message 502 956 447 339 822 532 842 942 563 592 339

1612z 44732 calls BALANS with message 502 411 447 132 196 010 565 564 978

1641z 44732 calls BALANS with message 926 429 564 695 525 447

1745z 44731 called by BALANS

1750z BALANS calls 44731 with message 861 408 850

1826z 44732 calls BALANS with message 976 170 408 953 525 055


Approximate routing of the Tu-160 Blackjacks

One final thing to note – on exactly the same day in 2015 (day of the year, not actual date, so the third Wednesday in February) the Russians carried out almost the same flight, going down the West coast of Ireland. Further information on that mission, including HF recordings, can be found in Bear Hunting – part two

Bet you a few quid they’ll be back same day next year 😉