This investigation, based on data received by Ukrainian hackers from the anonymous group Falcons Flame (#FF), focuses on an e-mail obtained from e-mailing of Donbas Volunteers Union organization, Censor.NET informs citing InformNapalm.
The e-mail concerns foreign mercenaries that are part of the Prizrak brigade (illegal armed gang of the terrorist organization "Luhansk People's Republic," created by Alexey Mozgovoy and using left slogans for making its activities more ideological). Follow the links to see more on the terrorist group (in Russian):   .
Below is the screenshot of the e-mail and headers:
The e-mail is addressed to two recipients: the first is Olga Kulygina, call sign Christian Hans, firstname.lastname@example.org, the other is Donbas Volunteers Union, email@example.com. The e-mail includes passport data of foreign citizens of Italy, Spain, India and Finland who serve in the Prizrak illegal gang in the Luhansk republic, Ukraine. The author is writing that they need visa support for 'legal stay in the Russian Federation." The e-mail's sender is Alexey Markov, e-mail firstname.lastname@example.org, deputy commander of the Prizrak brigade, call sign Dobry (Kind), his details on Peacekeeper website.
Olga Kulygina calls herself a 'reporter' of Russian propaganda TV channel ANNA-News. She is supposedly an officer of Russia's FSB working under cover of a reporter.
Kulygina has also been listed in the Mirotvorets database. A short excerpt from the description of her activities:
"Olga Kulygina played a major role in the organization of the Russian special services operations to support terrorist groups in Syria, Georgia and Ukraine.
"She is one of the leaders of the agent network planted by the Russian intelligence to guide Russian nationalist groups. It is used for recruitment in sabotage groups and to control the radical movements back in Russia.
"She participated in two military coups."
Donbas Volunteers Union
"The organization was founded in the fall of 2015, allegedly to protect the rights of "volunteers" who fought in Ukraine as members of illegal armed gangs. However, one of the major goals of the organization is tracking and control of people who have received combat experience in the Donbas by the Russian intelligence agencies. Our analysis of information we received also reveals that the office is concerned with recruitment and visa support of foreign mercenaries, convalescence and rehabilitation of the injured, and survivor assistance. С lose relationship with intelligence agencies, immigration services, and border authorities of the Russian Federation is proven by the request in the e-mail.
"The charter of the organization can be found here. Also of interest is an article by Vadim Fulmakht discussing the real purposes of this organization: "Why is Boroday creating the Union of Donbas Volunteers". On Oct. 10, 2015, Moscow hosted a congress of the Donbas Volunteers Union, which was attended by about 600 participants of the military operations in eastern Ukraine, see  and .
"The old domain name of the organization's website was http://sdonbassa.ru (registered 2015.09.06). There is a parked page under this link, now redirecting to the new website http://sddonbassa.ru (registered on 2016.01.31 and hosted in Russia https://hosting.reg.ru/). Registered address: Russia, Moscow, 5 Nastasyevsky Lane, bldg.3. Judging by the e-mail correspondence, the office is located on the third floor," the authors of the article inform.
The organization has offices throughout Russia.
Persons included in the OSINT investigation based on the the data from the e-mail exchange:
Alberto Fazolo, born Oct. 26, 1979 in Italy, passport AA0278798, ID AR7346959. He participated in organization of the International Solidarity Forum "Anti-fascism, Internationalism, and Solidarity", which was held in Luhansk on May 8, 2015. Passport scan found in the hacked e-mail exchange:
Hector Arroyo Payero, born Jan. 25, 1988 in Spain, passport PAA770023, ID 02710783A. His social media profile can be found here 
Identification photos and proofs of participation in illegal armed groups in the east of Ukraine have been collected by InformNapalm volunteers from this post by separatist blogger quarterbackrene. Excerpt from the post:
"The photo shows Spanish fighters evacuated from the territory of "LPR." Because of amendments to the Spanish law, the guys were forced to leave the unit. But this is just temporary, they say. Meet our brothers in arms, and their escort: me, Becerra Rb, Héctor Arroyo Payero, Daniel Alcorcón, Adria Irigoyen Bretones, Bars, and Victor."
Additional reading: an article in Spanish dated Feb. 28, 2015:
"Eight Spaniards have been arrested for taking part in the conflict in the Donbas. The detention operation took place in Asturias, Barcelona, Murcia, Navarra, Madrid and Extremadura. There were three arrests in Madrid, including that of Hector Arroyo. It is said that Arroyo had been in Luhansk for three months, then returned along with three other companions before Christmas. The detainees were released in the evening after giving statements to the police. The arrested men are accused of attempted murder, possession of weapons and explosives, and acting against Spain's interests abroad."
This article names foreign citizens participating in the war in the territory of Ukraine alongside with terrorists: Spaniards - Alexis Kastiye Idodeai, Brian Rodríguez, Héctor Arroyo Payero, Andrés Rohm Sal, Serbs - Zoran Kjazic and Stevan Milosevic, Frenchmen - Guillaume Lenormand, Victor Alonso Lenta, Michael Takahashi, another Serbian citizen Nikola Perovic, who had previously fought in Afghanistan, and Víctor Alfonso Lenta.
Edy Ongaro, born Feb. 6, 1976 in Italy, passport AA1135734. His social media profiles can be found here  .
The ongoing information war, waged by the Russian intelligence agencies around the conflict in Ukraine, results in massive amounts of materials on the web that glorify foreign mercenaries. For example, these are articles from June 14 to 19, 2015 only, covering Edy Ongaro:   . In this video dated June 24, 2015 he says that he was at the frontline for 11 days. Passport scan:
Ravinder Singh, born Nov. 7, 1990 in India, passport P7561331. His social media profiles can be found here  
This article dated July 15, 2015, tells the story of Rav Singh, a 24-year-old business college student from New Zealand, an Indian national, who had arrived in Donbas a month before and had joined the Vostok battalion, "where volunteers from other countries are also fighting on the side of the army of the "Donetsk People's Republic"." Passport scans found in the hacked e-mail exchange:
Ilari Olavy Ikonen, born Jan. 10, 1975 in Finland, passport PT8258308. It is known that Ikonen ran for parliament in 2003 as a member of the Communist Party of Finland. He chose to report the following about himself: Ilari Ikonen, age - 28 years, e-mail address - email@example.com, presentation of the candidate:
"I am a fireman by profession. Aged 28 years. My hobbies: judo, nature, and hunting. My electoral program: exit from the EU, non-entry into NATO."
In 2003, he was 28 years old, so he was born in 1975, as stated above.
In 2010 Ikonen participated in the party's activities in Lapland, however, he was not just a fireman, but a fire station manager; here are the voting results. Presumably, he spoke at the May Day rally in 2011.
In 2011 - 2012 he took part in organizing local governance.
Petri Juhana Vijakainen, born June 16, 1976 in Finland, passport PU514631. His social media profile can be found here 
There are numerous videos confirming the facts of participation of this Finnish citizen in the illegal armed groups on the occupied territories of Ukraine -    .
Here is a photo of his Russian visa from the hacked e-mail exchange:
"Thus, out of those listed in the request, we have established four people who had taken part in the fighting in the Donbas as members of illegal armed groups of terrorist organizations "LPR" and "DPR." The other two are left-wing activists, one of who took part in preparation of a forum in Luhansk, and probably was there. Unfortunately, through OSINT we could not establish visiting of the occupied territory by Ilari Olavy Ikonen, a member of the Finnish Communist Party. However, we hope that Finland's security agencies will look into it with great interest, using this data as the starting point," the authors conclude.
The analysis of the message from the hacked mailbox showed the following:
§ There are foreign fighters in the Prizrak brigade, mostly left-wing radicals advocating forcible change of the constitutional order of Ukraine. They are mostly members of marginal social groups, not able to fulfill themselves in the homeland, coming to the Donbas either for financial gain or for ideological reasons.
§ The Donbas Volunteers Union is an organization established in Moscow for control, coordination, and recruitment of mercenaries.
§ Four of the six subjects of the investigation are war criminals. The presence of one of them in Luhansk has been confirmed by documents of a congress of communist parties.
§ The Donbas Volunteers Union and Olga Kulygina personally assist with obtaining and extending visas to foreign mercenaries through the Russian Federal Migration Service without personal presence of the applicants, which means that the process was spurred by the Russian intelligence agencies.
§ The mercenaries come to the occupied territory of Ukraine bypassing the border control of the Russian Federation, since, according to their documents, they did not leave Russia. Here, too, we can reasonably suspect a hand of the Russian intelligence agencies.
Related materials: Evidence of Russian aggression in Ukraine