A Marriage of Crime and Power

For decades, Russia’s security services—FSB (the successor to the KGB), GRU (military intelligence), and SVR (foreign intelligence)—have cultivated deep ties with criminal organizations.

These relationships stretch back to the Soviet Union, when the KGB used criminals for smuggling, assassinations, and money laundering.

But after the USSR collapsed, organized crime exploded, and rather than cracking down, Russian authorities co-opted these networks.

Today, criminal syndicates function as outsourced operatives, carrying out cyberattacks, laundering propaganda money, and even orchestrating assassinations at the Kremlin’s behest.

Cybercriminals, Money Launderers, and Digital Saboteurs

Russian cybercrime isn’t just about hacking bank accounts—it’s a key tool in modern warfare.

Groups like Evil Corp, Cozy Bear (APT29), and Fancy Bear (APT28), all linked to Russian intelligence, engage in ransomware attacks, election interference, and targeted disinformation campaigns.

Here’s how these operations work:

  • Cyber Attacks as Propaganda Tools: Leaked emails, deepfake videos, and manipulated content are spread across Western media to create chaos and distrust.
  • Illicit Money Flows: Criminal networks launder dirty cash to fund fake news websites, social media trolls, and covert influence campaigns.
  • Trafficking and Blackmail: Human and drug trafficking operations help secure kompromat (blackmail material) on politicians, journalists, and business leaders.

This isn’t just about politics—it affects businesses, stock markets, and personal data security.

Every ransomware attack, every phishing scheme, and every fake news campaign has real economic consequences.

Evil Corp

Founded in Russia, Evil Corp has been identified as one of the most prolific cybercriminal syndicates globally.

Led by Maksim Yakubets, the group is notorious for deploying the Dridex malware, which has been used to steal over $100 million from financial institutions worldwide.

Their operations are characterized by sophisticated phishing campaigns that deliver malware designed to harvest banking credentials and facilitate unauthorized fund transfers.

Despite international sanctions and arrest warrants, Evil Corp continues to adapt, recently integrating with other ransomware platforms like LockBit to evade detection and sustain their illicit activities.

Cozy Bear (APT29)

Cozy Bear, also known as APT29, is a cyber espionage group attributed to Russia's Foreign Intelligence Service (SVR).

Active since at least 2008, Cozy Bear has targeted government networks, research institutions, and political organizations, notably infiltrating the Democratic National Committee in 2015.

Their tactics include spear-phishing and the use of sophisticated malware to establish long-term access within networks, enabling the exfiltration of sensitive data.

The group's involvement in the SolarWinds supply chain attack, which compromised multiple U.S. federal agencies, underscores their capability and the strategic threat they pose to national security.

Fancy Bear (APT28)

Fancy Bear, or APT28, is a Russian cyber espionage unit believed to be associated with the Russian military intelligence agency GRU.

Known for its aggressive operations, Fancy Bear has been implicated in numerous high-profile attacks, including the 2016 breach of the Democratic National Committee and subsequent election interference efforts.

Their methods often involve spear-phishing, credential harvesting, and deploying malware to exfiltrate data.

The group's activities are not limited to political targets; they have also conducted cyber operations against military and security organizations, underscoring their role in advancing Russia's geopolitical interests through cyber warfare.

These groups exemplify the fusion of state and criminal cyber activities in Russia, leveraging advanced technical capabilities to conduct operations that serve both financial motives and strategic state objectives.

Further Reading & Sources:

By understanding the operations and affiliations of these groups, readers can better grasp the complexities of cyber threats emanating from Russia and their direct implications on global security and personal data privacy.

When Crime Meets Propaganda

The Ukraine Conflict (2014–Present)

When Russia invaded Crimea and later backed separatists in Donbas, criminal networks were used to smuggle weapons and recruit mercenaries.

Simultaneously, massive disinformation campaigns flooded Western media, portraying Ukraine as a Nazi stronghold and painting Russia as a liberator.

The result? Political divisions, confused public opinion, and reduced support for Ukraine in key Western nations.

Election Interference: From Washington to Berlin

It’s no secret that Russian actors meddled in the 2016 U.S. presidential election, but the tactics have evolved.

In 2024, Germany reported an influx of Russian disinformation targeting its elections, designed to weaken support for Ukraine.

Fake NGOs, troll farms, and even fringe political groups were funded through laundered money, pushing divisive narratives to destabilize Europe’s political landscape.

The Wagner Group’s Shadow Empire in Africa

The notorious Wagner Group, a paramilitary organization closely tied to the Kremlin, doesn’t just fight wars—it runs propaganda empires.

In Africa, Wagner uses disinformation to prop up friendly regimes, demonize Western interests, and secure lucrative mining contracts.

Local media outlets, social media influencers, and even religious groups are co-opted to push pro-Russian narratives.

The NotPetya Cyberattack (2017)

In June 2017, a sophisticated cyberattack known as NotPetya was unleashed, initially targeting Ukrainian infrastructure.

This malware rapidly spread worldwide, affecting major corporations and causing an estimated $10 billion in damages.

Notably, companies like Maersk, a global shipping giant, experienced severe operational disruptions, leading to significant financial losses.

The attack was attributed to Russian state-sponsored actors, demonstrating the extensive reach and economic impact of such cyber operations.

The Colonial Pipeline Ransomware Attack (2021)

In May 2021, the DarkSide ransomware group, believed to operate from Eastern Europe, targeted the Colonial Pipeline, a major fuel pipeline in the United States.

This attack led to a six-day shutdown, causing fuel shortages and price spikes across the East Coast.

The incident highlighted the vulnerabilities in critical infrastructure and the potential for criminal groups, possibly with state affiliations, to cause widespread disruption.

The Assassination of Anna Politkovskaya (2006)

Anna Politkovskaya, a Russian journalist renowned for her investigative work on human rights abuses in Chechnya and criticism of the Kremlin, was assassinated in Moscow in 2006.

Her murder drew international condemnation and spotlighted the perilous environment for journalists in Russia.

While the direct involvement of state security services remains a subject of debate, the case underscores the potential nexus between state actors and criminal elements in silencing dissent.

The Belarus–European Union Border Crisis (2021–2022)

In 2021, a migration crisis emerged at the borders between Belarus and EU countries, notably Poland and Lithuania.

Belarusian authorities, with alleged backing from Russia, were accused of orchestrating the movement of migrants towards EU borders as a form of political pressure.

This hybrid operation combined elements of disinformation, statecraft, and exploitation of vulnerable populations, exemplifying the complex tactics employed in modern geopolitical conflicts.

These incidents illustrate the multifaceted strategies employed by Russian state actors and affiliated criminal networks, encompassing cyber warfare, targeted violence, and hybrid operations that blend traditional and non-traditional tactics.

Further Reading & Sources:

By examining these real-world examples, readers can gain a deeper understanding of how the convergence of state and criminal activities in Russia extends beyond abstract concepts, directly influencing global security, political stability, and economic well-being.

Why This Matters to You

This isn’t just about abstract politics—this is about your wallet.

Russian cybercriminals manipulate global markets, hack banks, and crash stock prices to serve Moscow’s interests.

Disinformation campaigns drive up gas prices by spreading false reports on oil supplies. Ransomware attacks cripple businesses, driving up insurance costs and consumer prices.

In short: disinformation isn’t just a problem for politicians.

It’s a problem for everyone who earns, saves, or spends money.

How to Fight Back

  • Verify Before You Share: Don’t spread information from questionable sources, especially on social media.
  • Support Independent Journalism: Disinformation thrives where real journalism is underfunded.
  • Strengthen Cybersecurity: Use strong passwords, enable multi-factor authentication, and be wary of phishing scams.

Further Reading & Sources

The battle against Russian disinformation isn’t just about spotting fake news—it’s about defending our economies, our democracies, and our financial security.

The next time you see a viral story, ask yourself: Who benefits from you believing it?

Did you read it to the end? Did you learn something today?

We need your help, so please be a dear and drop us a coffee or better yet, get a membership and join the fight against the corrosive propaganda weapon.

Every little bit helps.

How to Donate: