UK-led operation dismantles huge Russian cybercrime network: 84 arrested, $25 million seized

An international operation dubbed “Destabilize” has disrupted illicit Russian money laundering and cash courier networks and an underground crypto exchange linked to ransomware, drugs, and espionage, the UK National Crime Agency (NCA) announced.

The NCA-led operation exposed the Smart and TGR Groups, two illicit finance networks that enable Russian elites to circumvent international sanctions and support Russian cybercriminals in laundering their illicit profits. The Smart network was also used to fund Russian espionage operations.

The Department of the Treasury’s Office of Foreign Assets Control (OFAC) also sanctioned five individuals and four entities associated with the TGR Group. The NCA's international partners have also arrested a seventh individual, a global money laundering facilitator.

“NCA-coordinated activity has so far led to 84 arrests, with many already serving prison sentences, as well as the seizure of over £20m ($35 million) in cash and cryptocurrency,” the NCA said.

Complex criminal networks collect funds in one country and make the equivalent value available in another, often by swapping cryptocurrency for cash. This streamlines the movement of cash generated by crime groups in the West and helps oligarchs bypass sanctions.

The UK was a key hub for this activity. The billion-dollar money laundering networks operated in a way previously unknown to authorities or regulators and were hidden in plain sight, within communities.

Investigators witnessed exchanges taking place at scale across the country. Street-level cash handovers were followed almost immediately by a movement of cryptocurrency of the same value. Smart and TGR are strongly linked to the Russian financial sector, and their global reach extends to over 30 countries.

“For the first time, we have been able to map out a link between Russian elites, crypto-rich cybercriminals, and drug gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR – was invisible until now,” said Rob Jones, Director General of Operations at the NCA.

“The NCA and partners have disrupted this criminal service at every level.”

The Smart group is headed up by Russian money launderer Ekaterina Zhdanova. She directed a London-based cash courier, which laundered over $19 million. She also helped launder over $2.3 million of suspected ransoms paid in crypto by victims to the Ryuk ransomware group and worked with members of TGR to move over $2 million.

TGR is run by Ukrainian national George Rossi. The group is suspected of concealing the transfer of funds out of the sanctioned Russian state-owned media organization Russia Today (RT) to support the activities of a Russian-language media organization in the UK.

TGR helps integrate illicit financial schemes into the global financial system, including money laundering, unregistered exchanges of cash and crypto, and a pre-paid credit card service. The aim is to obfuscate the source of funds.

“Smart and TGR’s crypto addresses showed regular exposure to Garantex, the crypto exchange service that was sanctioned by the UK and US in 2022. Garantex has been linked to payments to companies for components of weapons used by Russia in its invasion of Ukraine,” the NCA said.

OFAC also sanctioned Andrejs Bradens, a Latvian national, who is associated with multiple TGR Group companies, and two of Zhdanova’s affiliates: Khadzi-Murat Dalgatovich Magomedov and Nikita Vladimirovich Krasnov.

In one of the cases the NCA and international partners arrested a series of couriers linked to Semen Kuksov and his associates, who are believed to operate an underground cryptocurrency exchange.