The UK’s National Crime Agency (NCA) has hit back hard against two major Russian money laundering networks, tackling funds linked to the notorious Ryuk ransomware gang.
They launched Operation Destabilise, shutting down the Smart and TGR networks. These groups didn’t just cater to cybercriminals; they also played a significant role in drug and gun trafficking in the UK. They helped Russian clients sidestep financial restrictions, funneled money to a sanctioned Russian media outlet, and even provided cash for Russian espionage operations.
According to the NCA, they’ve drawn clear connections between the cryptocurrency addresses of Smart and TGR and a crypto exchange called Garantex, which has ties to payments for military supplies for Russian forces in Ukraine. Rob Jones, NCA’s director general of operations, stated that this operation revealed billion-dollar money laundering operations that international law enforcement had not recognized before.
For the first time, they mapped out connections between Russian elites, crypto-enabled cybercriminals, and street gang operations in the UK. Jones emphasized the disruption of this criminal service at every level, targeting the top players and undercutting their legitimacy, making it far more difficult for them to operate in the UK.
The NCA identified six key figures from these networks, all of whom faced sanctions from the U.S. Office of Foreign Assets Control today. Ekaterina Zhdanova, Khadzi-Murat Magomedov, and Nikita Krasnov led Smart, while George Rossi, Elena Chirkinyan, and Andrejs Bradens (also known as Andrejs Carenoks) were at the helm of TGR.
Zhdanova, in particular, helped launder $2.3 million in cryptocurrency ransoms paid to the Ryuk crew across 2021. The Ryuk gang, which had targeted healthcare organizations during the pandemic in 2020, extorted over £27 million from at least 149 victims in the UK alone.
Don Smith from Secureworks highlighted the reality that paying ransoms fuels crime, reinforcing that funds ultimately end up in the hands of criminals.
So far, NCA’s crackdown has resulted in 84 arrests, with many already facing jail time and more than £20 million worth of assets taken. The networks were part of a complex scheme that shifted money across jurisdictions and used cryptocurrency exchanges to make cash available for various criminal enterprises, including enabling Russian oligarchs to bypass sanctions.
Investigators noted that the UK had unknowingly become a hub for these operations, observing numerous street-level cash handovers immediately followed by cryptocurrency transfers. This system allowed criminals to reinvest in drugs and weapons without having to move physical cash, perpetuating violence in the UK.
Nik Adams from the City of London Police pointed out how these networks operated right under the community’s nose, moving significant sums tied to the drugs trade and street violence. Smart and TGR relied on cash couriers across more than 50 locations throughout the UK and the Channel Islands, facilitating money laundering for over 20 different criminal groups in just four months.
One courier, Fawad Saiedi, now has a prison sentence of over four years for laundering £15 million. Krasnov’s group managed to launder more than £12 million in just two and a half months.
Interestingly, as NCA’s investigation ramped up, members of these networks grew anxious about operating in London. By mid-2024, many Russian networks were charging high commission rates, struggling to navigate the city’s tightening laws, cutting deeply into their already narrow profit margins.