Loading story…
Russian authorities have begun to alter their longstanding approach to cybercriminals operating within their borders, marking a significant change in the global cyber threat landscape. Historically, Russia has been known as a safe haven for cybercriminals, with state institutions either ignoring or actively collaborating with these actors, provided they did not target Russian interests. However, recent developments indicate a partial crackdown on certain segments of the cybercriminal underground. This shift is attributed to increased pressure from Western law enforcement, including major operations such as Operation Endgame, which targeted ransomware operators and their infrastructure in Russian jurisdictions. In response, Russian law enforcement has conducted high-profile arrests and seizures, signaling a departure from its previous policy of noninterference. Leaked communications and investigative reports reveal that some cybercriminal leaders have maintained relationships with Russian intelligence services, sometimes providing data or services in exchange for protection or impunity. The resulting environment has led to a breakdown of trust within the cybercriminal ecosystem, with affiliates expressing concerns about scams, impersonation, and selective law enforcement targeting. Ransomware groups have responded by implementing stricter vetting processes, rebranding, and adopting decentralized communication platforms to reduce the risk of infiltration. Western governments have simultaneously hardened their stance against ransomware, introducing policies such as ransom payment bans, mandatory incident reporting, and even preemptive cyber operations against adversary infrastructure. These policy changes have coincided with diplomatic maneuvers, including prisoner swaps, highlighting the geopolitical value of high-profile cybercriminals. Analysts suggest that Russia's new approach is a calculated response to international pressure and evolving cyber defense capabilities in the West. The implications of this shift are far-reaching, potentially altering the operational landscape for both cybercriminals and defenders worldwide. The partial revocation of safe harbor for low-level hackers may lead to increased risk and unpredictability within the Russian cybercriminal community. At the same time, the enduring ties between organized crime and elements of the Russian state suggest that high-value actors may still enjoy a degree of protection. The ongoing transformation of Russia's cybercriminal ecosystem is being closely monitored by threat intelligence professionals, as it may influence global cybercrime trends and the effectiveness of international law enforcement collaboration. The situation remains fluid, with future developments likely to impact both the scale and nature of cyber threats emanating from Russia.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Flare published research concluding that legal consequences for Russian-speaking cybercriminals vary sharply by nationality, geography, and state policy rather than crime severity alone. The report said Russia selectively manages offenders, Ukraine has increased cooperation with Western partners since 2022, and many arrests occur when suspects travel abroad.
Europol reported that Ukrainian authorities targeted a suspected administrator of a major Russian-speaking cybercrime forum. The suspect was described as a long-time cybercrime figure who allegedly earned more than EUR 7 million by facilitating illegal activity on the platform.
Recorded Future's Insikt Group published 'Dark Covenant 3.0,' assessing that the Kremlin now selectively suppresses low-level cybercriminals while preserving or leveraging more useful actors as a deniable geopolitical tool. The report framed Russian cybercrime as an extension of statecraft rather than a purely criminal problem.
Leaked communications cited in the reporting showed coordination and protection relationships between prominent Russian cybercriminals and Russian intelligence services. The disclosures reinforced the assessment that some higher-value groups continue operating with state tolerance or support.
Check Point Research published a report on the Banshee macOS stealer, including analysis that it had incorporated code taken from macOS XProtect. This introduces a distinct malware research development not covered in the existing timeline.
As crackdowns and international disruption increased, Russian cybercriminal groups adapted by decentralizing operations and tightening internal security. Public recruitment for ransomware-as-a-service affiliates declined on dark web forums, with access moving toward semi-closed, trust-based networks.
International law enforcement pressure, including Operation Endgame, disrupted parts of the Russian cybercrime ecosystem. The operation contributed to fewer ransom payments, increased pressure on infrastructure and service providers, and broader instability in the ransomware market.
According to the cited Recorded Future research, Russia shifted around 2023 from largely tolerating resident cybercriminals to more actively managing the ecosystem, including selective and often choreographed arrests of lower-level actors. The actions were described as limited and aimed more at signaling control and managing reputation than dismantling the broader cybercrime market.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
flare.io
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceresearch.checkpoint.com
Open sourcego.recordedfuture.com
Open sourceeuropol.europa.eu
Open sourceassets.sophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
International and national law enforcement actions were reported targeting a range of cybercrime activity, including ransomware, extortion, and large-scale fraud. SentinelOne summarized multiple cases: Dutch authorities arrested a man accused of attempting to extort officials after receiving sensitive documents by mistake and refusing to delete them; Polish authorities detained a suspect linked to the **Phobos** ransomware-as-a-service ecosystem as part of Europol-coordinated **Operation Aether**, seizing materials such as stolen credentials and access information; and **Operation Red Card 2.0** (coordinated through Interpol/AFJOC) resulted in hundreds of arrests across multiple African countries, along with seizures of devices, takedowns of malicious sites, and recovery of funds tied to investment fraud and mobile-money/loan scams. Separately, Security Affairs’ weekly newsletter highlighted additional ongoing cyber risk items that align with the same broad theme of active cybercrime and enforcement pressure, including an **FBI warning** about a surge in **ATM jackpotting** losses and reporting on **Operation Red Card 2.0**. Other items in the Security Affairs roundup (e.g., additions to CISA’s KEV catalog, vendor/software issues, and various malware reports) were presented as a curated link list rather than a single unified incident. A SOCRadar profile on the China-attributed **Lotus Blossom** espionage group and a Tom’s Hardware historical piece on the first computer search warrant are not part of the law-enforcement disruption story and do not materially support the same specific event narrative.
Jun 29, 2026
Law enforcement agencies have intensified their efforts against major ransomware groups, leading to significant disruptions in the global ransomware ecosystem. In Q2 2025, prominent ransomware-as-a-service (RaaS) groups such as LockBit and RansomHub either ceased operations or stopped publishing victim data, resulting in a fractured landscape previously dominated by a few powerful actors. This shift was largely attributed to coordinated international law enforcement operations, which in May 2025 dismantled over 300 malicious servers, shut down more than 650 domains, and issued arrest warrants for at least 20 individuals connected to ransomware and initial access malware infrastructure. The takedown of LockBit’s infrastructure in late 2024 under Operation Cronos set a precedent, demonstrating the vulnerability of even the most prolific ransomware groups when faced with unified global action. As a result, the ransomware ecosystem became more fragmented, with smaller, agile actors attempting to fill the void left by the dismantled groups. Concurrently, the profitability of ransomware attacks has declined due to evolving regulations, including bans on ransom payments, further pressuring threat actors. Despite these setbacks, LockBit has attempted a resurgence, announcing a strategic alliance with other major ransomware groups, Qilin and DragonForce, in Q3 2025. This coalition aims to share techniques, resources, and infrastructure, potentially restoring LockBit’s reputation among affiliates and increasing the operational capabilities of all involved groups. The emergence of LockBit 5.0, capable of targeting Windows, Linux, and ESXi systems, marks a technological advancement in their toolkit, first advertised in September 2025. Qilin, now the most active ransomware group, claimed over 200 victims in Q3 2025, with a particular focus on North American organizations. The alliance between LockBit, Qilin, and DragonForce is expected to trigger a surge in attacks, especially on critical infrastructure and sectors previously considered low risk. The ongoing evolution of the ransomware threat landscape underscores the dynamic interplay between law enforcement actions and the adaptability of cybercriminal groups. The future trajectory of ransomware will likely depend on the continued effectiveness of law enforcement operations and the ability of threat actors to reorganize and innovate. Organizations are advised to remain vigilant, as the threat landscape remains volatile and unpredictable. The collaboration among major ransomware groups signals a potential escalation in both the scale and sophistication of future attacks. The global cybersecurity community must continue to coordinate efforts to counter these evolving threats and mitigate their impact on critical sectors.
Jun 29, 2026
U.S. and allied officials have tied multiple high-profile cyber incidents to Russian-linked actors, including the **SolarWinds** espionage campaign, follow-on targeting of roughly 150 organizations flagged by Microsoft, and newer phishing operations aimed at **Signal** and **WhatsApp** users. The activity has also intersected with politically sensitive investigations, including an FBI review of claims that hacked files were involved in a Trump campaign-related incident, underscoring how state-aligned intrusion and influence operations continue to overlap with espionage and credential theft. At the same time, Russian-speaking cybercriminal ecosystems have remained a major source of disruption through ransomware and fraud. A prominent Russian-speaking ransomware gang was reported to have gone offline, even as ransomware attacks hit public-sector and healthcare victims including Dallas police and court websites and MedStar hospitals. Separate financially motivated operations also showed the breadth of the threat landscape, from the takeover of high-profile Twitter accounts in a bitcoin scam to large-scale phishing campaigns impersonating **E-ZPass** and **USPS**, prompting legal action by Google against an alleged Chinese scam ring.
Jul 12, 2026