The high-stakes world of Russian-speaking cybercriminals

Once brilliant coders armed with advanced skills, Russian-speaking tech-savvy youth are now the masterminds behind a global cybercriminal empire. This is how it happens.

Operating across borders like a rogue multinational, the Russian-speaking cyber underground has turned digital crime into a highly organized ecosystem that churns out ransomware, digital fraud, and fake identities with assembly-line efficiency.

A new report from cybersecurity firm Trend Micro has just cracked open the DNA of the cyber underground.

“The Russian-speaking underground has cultivated a distinctive culture that blends elite technical expertise with strict codes of conduct, reputation-based trust systems, and collaboration that rivals legitimate enterprises,” said Fyodor Yarochkin, co-author and researcher at Trend Micro.

“This isn’t just a collection of criminals – it’s a resilient, interconnected community that has adapted to global pressure and continues to shape the future of cybercrime.”

The report indicates a new wave of Russian cybercriminals jacking IoT devices, exploiting telecom signaling networks, and slipping through routers. Thanks to AI, they can now spin up fake digital identities using leaked biometric data and PII.

Then there’s the part where organized crime bleeds into state-sponsored espionage. Sanctions, the Russia-Ukraine war, and fractured alliances have turned cybercriminals into freelancers for nation-states – whether they realize it or not.

Some groups are hacking for profit and politics in the same breath, launching ransomware attacks that double as digital warfare. With the ongoing conflicts, hacktivism has been booming, with changing priorities in cybercrime.

It’s not just about stealing data anymore. It’s about rewriting the rules of power in the digital age – one breach at a time.

Why are Russian-speaking hackers the ones causing the ripples?

The cyber underground is the product of a deep-rooted, post-Soviet hacker culture that grew out of math-heavy education systems and early digital networks like FidoNet, their version of proto-internet before the rest of the world logged on.

“You learn how to write programs, you learn about computer architecture, but once you graduate, there are not so many opportunities to actually apply those skills,” explains Yarochkin.

“You basically end up with having a large number of highly educated individuals and not enough proper jobs to fulfill. That was probably one of the reasons why they started being creative and went into the semi-criminal or criminal schemes.”

Combine technical skills with the disillusionment of luxury lifestyles flashing across screens while their parents scraped by on state salaries, and you get an entire generation of technically gifted, highly motivated young people asking a simple question: “Why not take a shortcut?” The system taught them how to break things – it just didn’t expect them to do it so well.

The underground welcomes them early. By the time some teens are still fumbling through exams, their peers in the cybercrime scene are already running phishing campaigns or cracking software for pocket money. The barrier to entry is low – no degree required. Just skills and a VPN.

Many of these actors juggle university studies or day jobs in IT, not because they need the salary, but because staying employed or enrolled helps keep the cops off their backs.

Meanwhile, their real income comes from forums, stolen data, and whatever today's malware flavor of the week is. It’s a double life that feels less like “breaking bad” and more like a logical career move.By spending several years in this environment, threat actors can obtain the significant experience, practical knowledge, and skills to be an important part of underground supply chains.

The code of ethics in the criminal underground

It’s not just technical know-how that makes this scene tick – it’s a mindset forged in chaotic environments.

“This isn’t just a marketplace – it’s a structured society of cybercriminals where status, trust, and technical excellence determine survival and success,” says Vladimir Kropotov, also a co-author of the research and researcher at Trend Micro.

Years of navigating bureaucratic decay and a culture of systemic mistrust have made paranoia a survival skill. If you want to get into cybercrime, you’d better speak the right slang, show your criminal “CV,” and prove you’re not law enforcement in disguise.

“You cannot build your reputation without interactions. But when you interact, you need to know exactly the right slang, the cultural specifics,” says Kropotov.

The community is fiercely guarded, with gatekeeping tactics that go as far as cultural CAPTCHAs – puzzles only someone who grew up in the region could solve.

“You need to be open if you're a foreigner. At least you will get some trust. When you use Google Translate to reply to some messages, it will be clear that you are not a native speaker, that you are not culturally aware,” continues the researcher.

But once you're in? It’s like any other tight-knit crew. Closed ranks, shared tips, and mutual protection – until someone breaks the code. Collaboration between criminals is also a survival strategy. From malware rentals to account cracking kits, the underground has evolved its own bizarre but efficient version of a trust economy.

In the absence of real-world accountability, a hard-to-build reputation becomes the backbone of every transaction. Many underground platforms lean on moderators, escrow services, and arbitration systems to keep deals from turning into dumpster fires.

Forum admins, moderators, and escrow agents rely on trust to keep the whole shady ecosystem functioning. Sellers treat reputation like branding, using it to scale operations and justify steep price tags. Buyers can usually get away with staying low-profile unless they’re after high-value goods like zero-days or bespoke fraud schemes, where sellers get picky about who they deal with. Then there are the watchers and strangers – passive users, law enforcement lurkers, researchers, or journalists.

And of course, the bottom feeders: scammers. They prey on other cybercriminals, copying seller posts, tweaking contact info, and vanishing once they’ve cashed out.

The cybercrime job market

Mature forums come with entire sections dedicated to job listings, with roles ranging from low-key to high-stakes felonies.

You won’t find office perks here, but you will find color-coded risk ratings: “green” or “white” gigs are the underground’s version of entry-level internships – relatively safe, verified, and unlikely to land you in a cell.

“Gray” means you’re playing with fire, but maybe not enough to get burned unless you screw it up. “Black” is exactly what it sounds like. A high-risk, full-send criminal activity that will definitely put your name on someone’s watchlist.

There’s a career path here, too, where the whole setup mirrors the corporate world You might start out as a mule, moving dirty money from point A to point B. Play your cards right, and soon you’re the one running phishing scams or managing a crew of other mules.

What are the key underground services?

Every forum, darknet marketplace, or Telegram channel primarily runs on the same fuel: profit. If you’re in the game, chances are you’re either selling a service, buying one or somewhere in between.

Over time, cybercriminals figured out it’s safer to steal small amounts from a lot of people than to take a huge sum from one victim – less noise, less risk, and far fewer people chasing them down.

There are multiple services that keep the dark economy running. Scams are managed like startups, with structured teams, Telegram-based workflows, and cold-calling squads hustling victims out of their money. Phishing is another booming service, with devs cloning banking sites and tailoring campaigns.

While ransomware is officially banned on many forums because it is “too loud, too hot” and attracts unwanted attention, ransomware gangs continue to quietly buy tools, recruit new members, and use regular marketplaces to keep the whole machine moving.

Over time, ransomware attacks have become more aggressive, moving from simple data locking to stealing and leaking data, public shaming, and even attacks meant simply to cause damage. Criminals also target Web3 platforms, hijacking Discords and impersonating NFT projects to drain wallets.

Beyond the keyboard, things get even grittier. Violence-as-a-service is now part of the ecosystem, with forums offering everything from SIM-jacking and stalking to real-world attacks.

With demand growing for hacked cars, insider data, and intelligence-gathering services that tap into city surveillance or telecom databases, the line between digital and physical crime is getting blurrier by the day.

War is changing cyber underground dynamics

Geopolitical unrest is tearing apart long-standing codes of conduct in the Russian-speaking cybercrime scene. As conflicts like the Russia-Ukraine war and the Nagorno-Karabakh tensions spill across former USSR territories, the golden rule “do not work in RU” has become increasingly elastic, with underground forums tolerating posts that target Russia, Ukraine, or both.

Criminals are recalibrating their moral compasses, prioritizing ideology, vengeance, and survival over legacy allegiances, and in the process, exposing the hidden political and geographic affiliations that used to stay buried beneath layers of anonymity.

“Initially, there was no division. Are you based in Ukraine? Are you based in Russia? Are you based in Kazakhstan? We like basically collaborate as a group, but when the war started, you could see a very obvious ideological split. Some of the groups started supporting completely the Russian agenda, others operate on the Ukrainian side,”

explains Kropotov.

The appearance of job postings openly recruiting cyber operators to hit Russian targets – or Ukrainian ones – underscores just how deeply polarized the underground has become. It’s not just about money anymore; it’s about picking a side.

Before the war, some of the data circulating in underground markets – like access to city street cameras, building security feeds, or even the personally identifiable information (PII) of government employees – was largely considered disposable by criminal groups. “It wasn't very useful because what do you do? You get access to a camera. You get to watch the camera,” Krapotov explained.

But that calculus shifted dramatically once war broke out. Suddenly, these seemingly mundane assets became powerful tools for military intelligence. City cameras, for instance, could now be used to effectively identify a target and guide drones in enemy territory.

This transformation sparked a spike in interest in accessing remote routers and surveillance systems in enemy-held areas. The PII of military personnel also gained new strategic value, with some campaigns using it for psychological operations, such as mass messaging campaigns to either military personnel or their relatives in order to discourage them from participating in the war.

There is also the rise of hacktivism.

“Pretty much any NATO country would be a legitimate target for a hacktivist attack just because they are part of the Southern Alliance,”

says Kropotov.

As these digital warriors turn into mercenaries for ideology, governments are learning to exploit the chaos. State-aligned actors are increasingly using the criminal underground as a gray market for dirty work that’s both quick and deniable.

By outsourcing attacks to forums crawling with ransomware operators and infostealers, state agencies keep their hands clean while ratcheting up pressure on their adversaries.

At the same time, the presence of these actors is freaking out old-school criminals who don’t want the heat of a nation-state vendetta messing with their monetization pipelines. This growing paranoia is visible in forum threads where members call out suspicious requests tied to contested border regions.

Meanwhile, as sanctions tighten and home turf becomes unstable, many cybercriminals are skipping town – but they’re not retiring. They’re relocating to the EU, Southeast Asia, and beyond, bringing their skillsets with them. Of course, problems travel with them to the new geographies.

The bonds with Chinese threat actors are also noticeably tightening. Russian-speaking forums are evolving into multilingual bazaars, where Chinese-speaking groups now openly post, buy exploits, and offer access to compromised networks worldwide.