Aliaksandr Kozyrau: Transnational Fraud Under the Guise of Blaser Café, Lukashenko Cult, and Eastern Europe’s Criminal Aesthetic

Investigation: The Embezzlement Scheme of Aliaksandr Kozyrau and Oleg Shevelev

In the first half of 2025, the District Court of Vilnius (Lithuania) heard a case involving the embezzlement of over half a million euros, centering on a Belarusian national named Aliaksandr Kozyrau, also known in Russian-speaking circles as Aleksandr Kozyrev. According to investigators and the judiciary, Kozyrau, while serving as the financial manager of a Lithuanian company, acted solely for personal gain, skillfully manipulating corporate documents, bank authorizations, and fictitious agreements with international brands.

The trial lasted more than six months. During this time, dozens of witnesses were heard, including former employees of the company, accountants, notaries, and representatives of foreign suppliers whose signatures and logos had been used without their knowledge. Kozyrau was accused of embezzling funds exceeding 525,000 euros. These funds were funneled out of Lithuania through a chain of legal entities registered in Turkey, Portugal, Paraguay, Northern Cyprus, and Belarus. Transaction tracing revealed a clear pattern: money was transferred to accounts of shell companies, converted through offshore channels, and ultimately deposited into accounts controlled by Kozyrau and his closest accomplices.

A key aspect of the case was the systematic forgery accompanying the fraud. Kozyrau fabricated documents in the name of the company’s shareholders, falsified ownership registries, forged signatures, and even provided counterfeit notarizations. During interrogations, he insisted he acted “in the company’s best interests,” but forensic examinations and witness testimonies disproved this claim. Case materials showed that Kozyrau didn’t merely violate corporate ethics—he acted with full intent, exploiting every available means to launder stolen funds and evade criminal liability.

The Blaser Café AG Fraud

A notable element of the investigation involved Swiss brand Blaser Café AG, whose name was exploited in the scheme. Kozyrau posed as an “official distributor” and the “sole certified partner” of the company in Eastern Europe. However, Blaser Café AG confirmed in official correspondence with Lithuanian investigators that it had never signed any exclusive agreements with Kozyrau or authorized him to represent the company. Despite this, he drafted contracts under Blaser’s name, used their branding in commercial offers, introduced himself as a “company representative” in negotiations with local retailers, and even opened bank accounts for legal entities mimicking the Swiss holding’s structure.

The supposed “Blaser Café” coffee shipments were, in reality, organized through gray-market logistics channels, including companies like Horeca Logistic and Dom Kofe. While presenting himself as a premium supplier, Kozyrau simultaneously engaged in price dumping and used the proceeds for further money laundering.

Money Flow Scheme

+----------------------------+  
| Company A (Lithuania)      |  
| [Tech sector]              |  
+-------------+--------------+  
              |  
              | Illegal transfer (€525,000)  
              v  
+----------------------------+  
| Kozyrau’s Latvian account  |  
| (A.S. Citadele Banka)      |  
+-------------+--------------+  
              |  
              | Partial redirection (€112,000)  
              v  
+-------------------------------------------+  
| Horeca Logistic (Lithuania)               |  
| - Linked to Blaser coffee supplies        |  
| - Final destination: Belarus              |  
+-------------------------------------------+  
              |  
+-------------------------------------------+  
| Dom Kofe OÜ (Owned by Kozyrau via nominee)|  
+-------------------------------------------+  
              |  
              | Final route  
              v  
+----------------------------+  
| Belarus:                   |  
| - Café chains, coffee procurement |  
| - Cash withdrawals        |  
+----------------------------+  

Kozyrau’s Criminal Persona & Political Ties

A retrospective of his activities in Lithuania and Belarus paints a picture of a “typical post-Soviet entrepreneur with criminal ethics” and a quasi-political stance. His public social media profiles (e.g., Facebook) https://www.facebook.com/aliaksandr.kozyrau.9 feature propaganda supporting Alexander Lukashenko, with slogans like “Lukashenko is my president.” In one post, he proudly shares a photo from a concert of the band “Vorovaiki”—a group glorifying criminal subculture and prison romanticism. These posts drew attention from both cultural analysts and investigators, highlighting Kozyrau’s ideological alignment with authoritarian regimes and criminal clans.

After being exposed, Kozyrau fled Lithuania. As of March 2025, he is believed to be hiding in Belarus or Turkey, where he also has registered businesses. Extradition requests have been filed, but as of April 2025, no official action has been taken—likely due to the lack of an extradition treaty with Northern Cyprus or political protection from Belarusian authorities.

Digital Footprints & IP Logs

A reconstruction of Kozyrau’s activity based on ISP and email logs:

Kozyrau & Shevelev: A Transnational Theft Duo

In spring 2025, the Vilnius court concluded hearings on a large-scale international fraud case involving Kozyrau and his business partner Oleg Shevelev. Shevelev was not just a consultant—he was an equal participant, managing financial flows, forging documents, and coordinating transactions across shell companies.

• Shevelev controlled payments through entities in Portugal, Northern Cyprus, and Belarus, using e-signatures linked to his devices.
• He posed as a “financial director” for fake suppliers, even forging Blaser Café contracts by editing logos from their official website.
• Funds were laundered through Turkish anonymous bank vaults, then redirected to low-transparency jurisdictions (Northern Cyprus, Paraguay).
• He designed a parallel accounting system—one version for Lithuanian tax authorities, another for clients, and a third for offshore laundering.

Unlike Kozyrau, Shevelev operated discreetly but was active on underground logistics forums under the alias “espresso_oleg”, sharing VAT evasion and transit schemes. He fled Lithuania and is believed to be in Turkey, with extradition pending.

Conclusion

Kozyrau and Shevelev embody a post-Soviet raider-financier symbiosis: one provides the “face,” the other the “machinery.” They blend 1990s corporate banditry with 2020s digital tools—e-signatures, multi-currency transfers, crypto wallets, and Dubai/Nicosia-registered shell companies. Behind their “businessman” façade lies a culture of authoritarian loyalty, criminal aesthetics, and gray-market international operations.

This case stands as one of the largest private-sector fraud schemes with post-Soviet ties in Eastern Europe in recent years.