Kremlin Shaping Cybercrime Into Deniable Geopolitical Tool

After decades of mainly turning a blind eye to a cybercriminal underground flourishing inside its borders, the Russian state appears to be taking an increasingly hands-on – if not Machiavellian – approach to its many hackers.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The Kremlin appears to have taken a much closer interest in how cybercriminals can be used to influence geopolitical events and acquire information for intelligence purposes, says a report from threat intelligence firm Recorded Future’s Insikt Group.

That interest is leading to a shaking out of low-level operators who Moscow now classifies as a liability not worth the political capital to protect, the cybersecurity firm says (see: Is Russia Reining In Ransomware-Wielding Criminals?).

Russia has long functioned as a safe haven for cybercriminals who honor the implicit rules of not targeting Russia or its allies and doing favors on request from intelligence agencies, including serving as proxies or deniable assets in information-gathering campaigns.

Now, Moscow is being more discriminating in who the deal applies to, Recorded Future analysis holds. “Russia’s ‘safe haven’ is conditional, selective and governed by state interests rather than law,” Recorded Future’s report says.

As with all Kremlinology, making conclusions about strategic intent based on known actions by various government officials must be caveated by uncertainty about what analysts don’t know.

Russian ransomware hackers arguably became a problem for the Russian state after then-U.S. President Joe Biden pressed Russian leader Vladimir Putin about them during a June 2021 U.S.-Russia summit. Putin, who had already began massing troops on Ukraine’s border, was reportedly taken aback when Biden slammed the leader for failing to stem the onslaught of hackers disrupting Western critical infrastructure, including Colonial Pipeline.

Russian authorities appear by 2024 to have taken a more active, albeit selective, approach to policing cybercriminals, which has included their “conspicuously” moving “against certain facilitators,” the Recorded Future report says. This has included targeting the payment exchanges Cryptex and UAPS, leading to nearly 100 arrests, after the U.S. Department of Treasury sanctioned them. Russia later arrested top executives, including the CEO of St. Petersburg-based malicious infrastructure hosting firm Aeza Group.

“Higher-value ransomware networks with suspected ties or usefulness to security services have largely avoided commensurate consequences,” even when named and sanctioned by Western countries, the threat researchers said.

Eroding Trust Among Cybercriminals

Other forces are also affecting the Russian cybercrime ecosystem. International law enforcement crackdowns, including the ongoing, multinational police effort Operation Endgame. Launched in May 2024, it continues to target ransomware operators and the services they rely on such as malware loaders, botnets and money-moving infrastructure.

These crackdowns appear to be causing actual disruption to Russian criminal hacking, with ransomware operators “receiving fewer ransom payments since 2024, and this trend is continuing in the first half of 2025,” the report says, in part due to newcomers failing to “achieve the same scale of operations and market share” previously enjoyed by operations such as LockBit and Alphv, aka BlackCat.

In response, many ransomware operations appear to have begun trying to decentralize their operations to better evade both domestic and foreign monitoring. In addition, more groups have switched to pure data breach extortion that skips the crypto-locking malware in an apparent bid to make themselves less of a law enforcement or political target.

Chatter on cybercrime forums by low-level players shows growing paranoia. Western targeting, plus unpredictable crackdowns by Russian law enforcement and predation by fellow criminals – who run their own scams or impersonate the police – are eroding trust, the researchers said.

Cybercriminals who want to reliably insulate themselves appear to cultivate close ties with elements of the state, which includes courting high-level political players and buying protection. “Leaked communications show coordination between criminal leaders and Russian intelligence intermediaries, as well as bribery, tasking and mutual exchange of information,” said Alexander Leslie, a senior adviser at Recorded Future, in a LinkedIn post.

Black Basta chats that leaked earlier this year revealed that the ransomware group’s leader, Oleg Nefedov, was previously part of the high-flying groups REvil and Conti, and that he was “protected by high-ranking Russian political figures and the FSB and GRU agencies,” reported researchers at Barracuda.

All the World’s a Stage

Russia’s newfound determination to crack down on criminals likely has limits, even for those who the Kremlin says are dispensable. When Russia does move against domestic cybercriminals, the fallout is often minimal for the individuals involved, and entails markedly less severe penalties compared to many other countries. “These actions are less about enforcement and more about optics,” Recorded Future’s Leslie said.

In early 2022, Russia arrested 14 individuals suspected of being part of the notorious REvil, aka Sodinokibi, ransomware operation, acting on intelligence shared by the United States. Subsequently, all received suspended sentences, with the judge making no reference to cybercrime in their sentencing.

“This aligns with a ‘pressure-response’ pattern in which Moscow prioritizes reputational management over dismantling strategically useful networks,” the report says. “The threat actors were not providing something of value to the state, compared to the pressure being placed on Russian authorities.”

Russian cybercrime shouldn’t be viewed only through the lens of criminality or law enforcement.

“Russian cybercrime cannot be understood in isolation from the state,” Leslie said. “It is both a profit-driven economy and a tool of foreign policy – an auxiliary intelligence resource, an influence vector and a means of signaling resilience under sanctions. Western policymakers must therefore treat cybercrime as part of the broader Russian strategic toolkit, not a law enforcement nuisance.”