Headline
84 Arrested as Russian Ransomware Laundering Networks Disrupted
Operation Destabilise was a major international operation led by the UK’s National Crime Agency (NCA) to dismantle two Russian-speaking criminal networks: Smart and TGR. These networks were backbone in laundering billions of dollars for various criminal activities.
****KEY POINTS of THIS STORY****
Operation Destabilise Success: The UK’s NCA led an international effort that dismantled two major Russian-speaking criminal networks laundering millions of dollars.
Criminal Activities: The networks funded ransomware attacks, drug trafficking, and Russian espionage, laundering over $2.3 million in ransomware payments.
Global Reach: These networks operated in 30 countries, using cryptocurrency and cash-for-crypto methods to fund illicit activities.
Arrests and Seizures: Authorities arrested 84 individuals, seized £20 million in cash and crypto, and imposed US sanctions on key figures.
Blockchain Analysis: The operation highlighted the critical role of blockchain tracing in combating cyber and traditional organized crime.
A joint international effort led by the UK’s National Crime Agency (NCA) has successfully disrupted two large-scale Russian-speaking criminal networks involved in laundering millions of dollars in illegal funds.
Dubbed Operation Destabilise, the investigation exposed a network of financial transactions that supported various criminal activities, including ransomware attacks, drug trafficking, and Russian espionage.
Two networks, identified as “Smart” (led by Ekaterina Zhdanova) and “TGR” (led by Rossi, Chirkinyan, and Bradens), were instrumental in facilitating the movement of illegal funds across borders, often using cryptocurrency as a primary tool.
Authorities found that between 2022 and 2023, these networks laundered over $2.3 million (£20 million) in ransomware payments made to the Ryuk ransomware group, provided financial support to notorious criminal organizations like the Kinahan crime syndicate known for drug and arms trafficking, and facilitated funding of Russian espionage operations, helping to bypass financial sanctions imposed on Russia.
According to the NCA’s press release, the network had a global reach, with operations spanning across 30 countries, including the UK, Russia, the Middle East, and South America.
Further probing revealed the techniques employed to hide the origin of ill-gotten funds, often involving cash-for-crypto transactions. Criminal gangs used cryptocurrency to reinvest in their illegal business, buying more drugs and firearms without transferring physical money across borders. This financial service allowed these groups to continue their violent activity.
The operation resulted in the arrest of 84 individuals and the seizure of over £20 million in cash and cryptocurrency. Additionally, the US Department of Treasury’s Office of Foreign Assets Control (OFAC) has imposed sanctions on four entities and five individuals associated with the TGR network. These sanctions target key figures involved in laundering money for Russian elites and cyber criminals.
The operation was a collaborative effort involving multiple international law enforcement agencies, including the UK Metropolitan Police Service, French police, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC), the Drug Enforcement Agency (DEA), and the Federal Bureau of Investigation (FBI).
“While these organisations have sought to exploit emerging technologies such as cryptocurrency to obscure their activities, the inherent traceability of blockchain has proven invaluable in unravelling their activities that operated on a truly global scale, moving billions of dollars for a range of different threat actors,” the NCA’s head of cyber intelligence, Will Lyne, stated.
This operation has significantly disrupted the activities of various criminal organizations, including ransomware groups, drug traffickers, and Russian intelligence services. It has also exposed the complex ways in which cybercrime and traditional organized crime intersect.
- Russian Court Jails Four REvil Ransomware Gang Members
- Leading French IT firm Sopra Steria hit by Ryuk ransomware
- Russian Man Extradited to US over Phobos Ransomware Attacks
- Dark Web Hydra Market Mastermind Sentenced to Life by Russia
- Hacker Wanted by FBI in Ransomware Attacks Arrested in Russia