Russian-speaking hackers from CIS countries have become one of the leading forces in international cybercrime related to digital assets. According to a recent report by TRM Labs, they are responsible for a significant portion of ransomware revenues and also dominate the darknet markets.
The scale of criminal activity
TRM Labs' research found that Russian-speaking attackers are responsible for 69% of ransomware revenues, which amounts to more than $500 million in 2023. The two largest operators of these malicious services, Lockbit and ALPHV/Black Cat, brought in about $320 million to their coffers.
In addition to ransomware, Russian-language darknet marketplaces (DNMs) account for about 95% of the traffic from drug sales worldwide. The leading platform among them is Kraken Market, operated by operators from the CIS. In 2023, the three largest Russian-language DNMs processed transactions totaling $1.4 billion in cryptocurrency, while the entire Western darknet ecosystem processed less than $100 million over the same period.
The role of cryptocurrency exchanges
OFAC-listed Estonian cryptocurrency exchange Garantex also plays a significant role in this ecosystem. For 2023, it handled 82% of cryptocurrency volumes linked to sub-sanctioned organizations around the world. A significant portion of these funds were linked to Chinese military equipment and component manufacturers. Since 2021, Garantex has processed approximately $85 million in transactions linked to PRC and Russian Federation wallets.
Ties to state structures
According to TRM Labs, some Russian-speaking attackers have ties to the Kremlin and actively use cryptocurrency to purchase foreign equipment for Russian military needs. This confirms analysts pointing to the use of cryptocurrency to circumvent international sanctions and purchase military equipment.
Global trends in cybercrime
Not only Russian-speaking hackers pose a threat in cyberspace. Earlier, Elliptic experts discovered a fraudulent online marketplace with a turnover of $11 billion in cryptocurrencies linked to Cambodia's ruling Hong family. Also, Immunefi's report for the period from April to June 2024 showed that the crypto industry lost about $572.7 million due to hacker attacks and fraud.
Conclusion
Russian-speaking hackers from CIS countries continue to play a key role in international cybercrime. Their activities cover a wide range of illicit operations, from ransomware to drug trafficking on darknet markets. Their sophisticated schemes involving cryptocurrency exchanges and ties to government agencies make them particularly dangerous and influential on a global scale.
