Russia Trumpets Pro-Ukraine Hacker Arrests

Russian authorities bogged down by a war of attrition in Ukraine and a diminishing economy are touting what they say is the good news of domestic traitors spotted and arrested for hacking on behalf of Ukraine. The extent to which Kremlin-promulgated crime reports can be trusted is unclear, especially as officials seek distractions from grim milestones such as casualty numbers reaching an estimated million soldiers.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Recent Russian judicial announcements appear designed to highlight officials acting tough on cyber-enabled treason. A report from a Washington, D.C.-think tank in June calculated that Russian fatalities in the Ukrainian War raging since early 2022 likely reached 250,000 this spring. A top Russian official admitted Monday that the country is “on the brink of recession.”

Hackers on each side of the war have traded virtual blows, whether through military operations or a hacktivist underground with variable levels of government support.

Not all pro-Ukrainian hackers are necessarily from Ukraine, at least if Russian media is anything to go by. Take the case against Andrey Smirnov, a Siberian man arrested and charged in 2022 with having targeted Russian critical infrastructure with malware and disrupted unspecific websites on behalf of Ukraine. Given “the gravity and public danger of the act,” a regional court judge last week sentenced Smirnov to serve 16 years in a strict regime penal colony, the local prosecutor’s office said in a press release.

Another case involving an alleged Ukraine supporter came to an end in May. Authorities told state-owned Russian news agency Tass that the suspect, who hasn’t been publicly named, was a programmer for a regional medical system and in April 2022 transferred private medical information for Russian military personnel to a Telegram channel controlled by Ukrainian forces. A judge sentenced the defendant to serve 14 years in a strict regime colony.

Are the charges true? “It’s definitely possible,” said researcher Yelisey Bohuslavskiy, co-founder and partner at threat intelligence firm RedSense. “Ukraine has been very successful with operations on Russian soil, and also there are numerous cybercrime arrests in Russia,” he said.

Ukrainian operations on Russian soil have included big-impact military strikes, such as smuggling in small drones to take out a portion of Russia’s tough-to-replace bomber fleet, as well as low-level attacks, such as phone scammers convincing ordinary Russians – including pensioners – to launch arson attacks against local government offices, including military enlistment centers.

“It would not surprise me in the least that Ukraine’s intelligence service reached out and recruited some ‘assets,’ as pre-2014 the Russian and Ukrainian hacking scene was nearly indistinguishable, with tensions in the community only exploding after the 2022 invasion,” said Ian Thornton-Trump, CISO at cybersecurity services firm Inversion6.

Getting accurate statistics on Russians who have been incarcerated, including for alleged hacking offenses, is difficult. The Kremlin began restricting in 2022 publication of many previously open sources of judicial information, and multiple reports suggest the Russian Federal Security Service – the FSB, a Russian successor to the Soviet Union’s KGB – has threatened family members of suspects who talk to the media or human rights activists. In the majority of cases, authorities never name defendants, even after sentencing, said human rights organization First Department, run by exiled Russian human rights lawyer Ivan Pavlov, in a December 2024 report.

Here’s what First Department has been able to verify: From the start of the Russia-Ukraine War in February 2022, until mid-December 2024, Moscow arrested at least 1,000 citizens on treason charges tied to supporting a foreign nation. In 2024, Russian courts convicted 359 individuals for such treason, espionage or cooperation with foreigners.

Scamming Russians

Per official Russian pronouncements, authorities have arrested numerous citizens on charges of aiding Ukraine in the 40 months since President Vladimir Putin dispatched troops to conquer its European neighbor. Russian authorities may be seeking anything that helps them save face as the war drags on.

This type of subterfuge remains ongoing, at least according to official Russian news outlets.

Authorities warned Monday they uncovered a “fake intelligence-gathering competition,” disguised as a patriotic endeavor, really the work of Ukrainian intelligence. The competition requested individuals in the Novosibirsk region in Siberia share on various Telegram channels photos of bridges, railway crossings, industrial centers and transit interchanges. Participants competed for cash prizes, reported Russian newspaper Kommersant.

“The actual goal of the organizers is to collect information about the region’s infrastructure and provoke the region’s residents to transfer information to a foreign party to the detriment of the security of the Russian Federation,” the FSB said.

Separately, the FSB on Monday announced the arrest of four suspects, all in their 20s or early 30s, who allegedly “photographed and filmed transport and energy infrastructure facilities in the Chelyabinsk, Ivanovo and Tula regions,” as well as “set fire to law enforcement vehicles and damaged power transmission line supports,” at the behest of Ukrainian special services, Kommersant reported.

The suspects claimed to have fallen victim to telephone scammers, sending the fraudsters rubles worth $2,000 to $20,000 for alleged safekeeping, authorities said. After that, someone impersonating Russian law enforcement contacted them, accused them of financing the Ukrainian armed forces and demanded they set fire to facilities to help officials lure anti-establishment forces into the open, or facilitate “checking the anti-terrorist security of facilities” by photographing them.

Such photographs can be used to aid missile and drone strikes. The psychological impact of such operations is also notable.

The state of the Russian economy – likely shrinking and possibly on the verge of collapse – may also make for more willing recruits. “It used to be cash was king,” Thornton-Trump said. “Now at least with Russian hackers, maybe Ukraine’s bitcoins are king. Patriotic zeal is not a cure for hunger.”