Rublevka Team

Rublevka Team is a Russian-speaking cybercriminal cryptocurrency theft operation active since 2023 that specializes in affiliate-driven wallet-draining fraud. The group is commonly described as a traffer team and operates a scalable scam-as-a-service model that lowers the barrier to entry for affiliates by providing turnkey tooling, automation, and operational support. Known aliases include rublevka and rublevka_team, with Rublevka Team being the most widely recognized name. The operation focuses on social engineering rather than traditional network intrusion. Its campaigns direct victims to spoofed cryptocurrency-themed landing pages that impersonate trusted brands, exchanges, wallets, token launches, giveaways, and airdrops. These pages prompt users to connect their wallets and sign malicious transactions, enabling theft of cryptocurrency assets. Rublevka Team initially targeted The Open Network ecosystem and later shifted heavily toward Solana, where its campaigns reportedly generated most of its known revenue. The group has been assessed as responsible for more than $10 million in stolen cryptocurrency. Rublevka Team provides affiliates with Telegram-based bots, landing-page generators, cloaking and filtering controls, hosting and domain options, automated notifications, and payout mechanisms. Its platform has been advertised as supporting more than 90 wallet types and multiple asset classes within the Solana ecosystem, including tokens, NFTs, and staked assets. The operation also uses evasion features such as white-page presentation, scanner discrimination, access restrictions based on geography or network characteristics, and rapid infrastructure rotation. The group maintains an organized affiliate ecosystem with private Telegram channels for chat, operational updates, landing-page distribution, and profit tracking. Reporting indicates it uses leaderboard-style performance tracking and high affiliate revenue shares, reflecting a mature cybercrime business model analogous to ransomware-as-a-service structures. Rublevka Team has also been associated with Russian-language underground forums including LolzTeam, with additional presence on Exploit and XSS. Rublevka Team is notable for using custom obfuscated JavaScript wallet-drainer logic embedded in phishing pages instead of relying primarily on infostealer malware. Its tradecraft emphasizes brand impersonation, wallet-specific social engineering, automation, and anti-detection measures. The group exemplifies the industrialization of Web3-focused financial cybercrime through reusable tooling, affiliate enablement, and service-based fraud operations.