Operation Destabilise, Authorities Dismateled Cybercriminals Money Laundering Network

In a major international operation codenamed “Operation Destabilise,” law enforcement agencies have successfully dismantled sophisticated Russian money laundering networks that served cybercriminals, drug traffickers, and sanctioned Russian elites worldwide.

The operation, led by the National Crime Agency (NCA), exposed two primary Russian-speaking networks known as Smart and TGR, which operated across the UK, Middle East, Russia, and South America. The U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) has imposed sanctions on the networks’ leadership and four associated businesses.

The complex scheme converted cryptocurrency to cash across multiple countries, enabling criminal groups to move illicit funds without physical border crossings. The networks collected funds in one location and made equivalent values available elsewhere, primarily through cryptocurrency exchanges.

Smart, headed by Ekaterina Zhdanova, and TGR, led by George Rossi and Elena Chirkinyan, facilitated the laundering of billions of dollars. In one notable case, Zhdanova laundered over $2.3 million in ransomware payments from the Ryuk cybercrime group, which had extorted at least £27 million from 149 UK victims, including hospitals, schools, and local authorities.

Free Webinar on Best Practices for API vulnerability & Penetration Testing:  Free Registration

The operation’s success has been substantial:

• 84 arrests made
• Over £20 million in cash and cryptocurrency seized
• Operations disrupted across 30 countries
• Multiple high-profile convictions, including courier network operators

Rob Jones, Director General of Operations at the NCA, emphasized the unprecedented nature of the operation: “For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals, and drugs gangs on the streets of the UK.”

The networks also helped Russian clients illegally bypass financial restrictions to invest in the UK. In one instance, Zhdanova collaborated with TGR members to move over £2 million into the UK for a Russian client, circumventing standard financial checks for property purchases.

The investigation revealed connections to Garantex, a sanctioned cryptocurrency exchange service linked to payments for components of weapons used in Russia’s invasion of Ukraine. The operation was conducted in collaboration with multiple international agencies, including the FBI, DEA, French Direction Centrale de la Police Judiciaire, and Irish An Garda Siochana.

Security Minister Dan Jarvis highlighted the operation’s significance: “This major global operation marks a significant step against economic crime,” adding that the UK and its allies will continue their efforts to combat illicit finance and related criminal activities.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar