Russian Cyber Actors Scramble to Offset Fallout From Ukraine War
Actors Exchange Views, Advice on Economic Options
On Russian language Deep and Dark Web forums, well-regarded threat actors scramble to exchange ideas on how to maneuver within the new economic and political constraints since the onset of the war in Ukraine. As a result, actors will likely rely on institutions in geopolitically indifferent or friendly allied countries. Immediate concerns center around the fate of cryptocurrency funds and potential strategies to exchange them for fiat currency that can be spent. Causing further unease is the perception that only cryptocurrencies can be sent or wired to Russia for financial support.
- One noteworthy and longstanding Russian language Dark Web forum member on Exploit[.]in offered their unfiltered opinion on European Union sanctions and why they decided to move to Dubai: “Who gives a f*** what they want. I went to Dubai where I can get cash for any crypto under the sun. Moreover, opening a bank account here is not a huge deal.”
- When challenged with a concern regarding potential outrageous fees charged to cash out crypto, the unphased actor responded, “Well it seems to me that with the volatility of Bitcoin (BTC), who cares about the exchange fees at the moment. It's the pinnacle of greediness…just put all your money in a bank account in Dubai.”
Moving to Dubai
This sentiment was echoed in a separate forum thread in which actors discussed the best way to send money to Russia, another signal from cyber actors that the ramifications of geopolitical decisions trickle down into the underground economy and force financial realignment. Forum members that participated in the thread agreed that cryptocurrency was the most reasonable way to send funds to Russia, save one actor that advocated to, “...invest in Dubai, until war is over [sic], I hope it will be soon.”
- This community has left at least one unresolved; the SWIFT (The Society for Worldwide Interbank Financial Telecommunication) ban will likely impact the ability to withdraw or send money to or from Russian majority state-owned bank, Sberbank.
Send Crypto — not Money — to Russia; Invest in Dubai
How (Not) to Withdraw Money from Sberbank
Worries Mount Over Fate of Ruble, Rush to Crypto
Russian banks only issue Russian rubles and as the currency continues its decline, notorious actors are discussing how to minimize financial loss. Among the considerations, they discuss laundering rubles through specific Russian and peer-to-peer (P2P) exchanges into stablecoins–cryptocurrencies that attempt to offer some pricing stability. They do this by pegging their value to an external asset, such as the U.S. dollar — suggesting that underground cyber actors are looking to native Russian exchanges to skirt Western sanctions, then get access to hard currency and maximize their spending power. At the moment, there are few, if any, restrictions preventing private exchanges from converting assets from one currency to another. Actors are leveraging this knowledge to avoid attribution and move funds almost at will. The only calculated downside is the loss of funds from exchange fees, but this hardly concerns most actors facing the possibility of losing access to Western financial institutions.
- Responding to a post about the exchange of Russian rubles to U.S. dollars, longtime Russian language Dark Web forum actor, Expolit[.]in, laid out a method for converting Russian rubles to U.S. dollar-backed stablecoins using trusted Russian language exchange, bestchange. The actor further cautioned that the exchange rate to convert rubles to dollars was so outrageous that you would be lucky to find a trustworthy person to do it for you.
Ruble to Crypto Method to Minimize Losses
What’s Next
Although the fallout from Russia’s invasion into Ukraine intensifies by the day, cyber actors are prepared to pivot and adapt in near real-time to offset any temporary disruptions to their current financial gains. They plan to accomplish this by finding methods that use stable financial institutions to minimize their personal financial losses. Once they have safely exchanged rubles for cryptocurrency, they will then look to convert digital currency into hard currency — most likely into U.S. dollars — that can be offshored in non-Russian banks to be spent, saved, and one day, repatriated from a financial safe harbor.
Adam Darrah
Adam Darrah is an experienced intelligence analyst skilled in putting international affairs into a cultural and political context. Before joining ZeroFox, Adam served as Director of Intelligence at Vigilante and InfoArmor. Previously, he spent eight years working for the U.S. government coordinating across several federal agencies to fill critical knowledge gaps on national security priorities, which helped form his specialization in Central Eurasian political, security and intelligence issues. Adam holds a bachelor’s and master’s degree in Russian from the University of Utah and the University of Arizona, respectively. He is married to his high school sweetheart and has three children. When he is not working, Adam enjoys spending time outside in the beautiful Black Hills of South Dakota with family and friends.
Tags: Cybersecurity, Threat Intelligence