An international investigation led by the UK’s National Crime Agency (NCA) has exposed and disrupted a high level Russian money laundering network that allegedly supports cyber-criminals in profiting from ransomware attacks.

According to the NCA, Operation Destabilise identified two Russian-speaking networks, Smart and TGR, collaborating at the heart of a criminal enterprise worth billions.

The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has subsequently announced sanctions against the men and women at the head of these networks, as well as four businesses linked to TGR, while a seventh individual with strong links to one of the networks has also been arrested by the NCA’s international partners.

The NCA claim that the networks have used their global reach to launder money for transnational crime groups, helped Russian clients to illegally bypass financial restrictions to invest money in the UK, and aided in the funding of Russian espionage activities. 

NCA-coordinated activity has so far led to 84 arrests, with many already serving prison sentences, as well as the seizure of over £20 million in cash and cryptocurrency.

The crime agency said that the investigation had uncovered a complex scheme, with the networks collecting funds in one country and making the equivalent value available in another, often by swapping cryptocurrency for cash.

This service allegedly allowed Russian oligarchs and elites to bypass sanctions, let criminals launder cryptocurrency, and helped streamline the movement of cash generated by crime groups in the West.

The NCA said that it had worked closely with partners across UK law enforcement to conduct operations linked to Destabilise, with investigators witnessing exchanges taking place at scale across the country involving street-level cash handovers followed almost immediately by the movement of cryptocurrency of the same value.

After being paid in crypto, the NCA claims that criminal gangs would then use the digital currency to reinvest in their organisations, with this illicit financial service allowing these groups to perpetuate their violent activity, and cause serious harm to communities across the UK.

One of the groups, Smart, has been linked by the NCA to the laundering of over $2.3 million (£1.8 million) in suspected ransoms paid in crypto by victims to the Ryuk ransomware group.

Recommended reading

• UK Businesses Face New Cyber-attacks Every 44 Seconds in Q2 2024
• Ransomware Crisis Escalating Globally, New Report Shows
• Over Half of Hacked UK Firms Pay Ransom

The NCA assessed that the ransomware group, members of which were sanctioned by the UK in 2023, was responsible for extorting at least £27 million from 149 UK victims, including hospitals, schools, businesses and local authorities, though noted that their true impact is likely to be much higher. 

“Operation Destabilise has exposed billion-dollar money laundering networks operating in a way previously unknown to international law enforcement or regulators,” said Rob Jones, director general of operations at the NCA.

“For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals, and drugs gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR – was invisible until now.”