New TRM Report Reveals Russian-speaking Groups Dominate Ransomware

According to new research from TRM Labs, Russian-speaking threat actors play an outsized role in most types of crypto-enabled cybercrime occurring throughout the world today—including ransomware, drug sales on darknet markets, and activity on illicit crypto exchanges.

• Ransomware: Russian-speaking ransomware groups accounted for at least 69% of all crypto proceeds from ransomware in 2023, exceeding USD 500 million
• Darknet markets: Russian-speaking darknet markets comprised 95% of all crypto-denominated illicit drug sales on the dark web in 2023
• Sanctions: Inflows to just one Russia-based crypto exchange, Garantex, accounted for over 80% of crypto volumes belonging to all sanctioned entities internationally 

Many of these actors are known to operate from inside Russia or to hold links to the Kremlin. And some even actively use crypto to procure foreign equipment for the Russian war effort.

“Comrades in Crime: Exploring the Russian-speaking illicit crypto ecosystem” explores recent trends in how Russian-speaking threat actors and entities operate within the crypto ecosystem, based on TRM’s latest threat and blockchain intelligence. The report’s findings include:

• A breakdown of Russian-speaking shares of ransomware proceeds and attack revenues
• Examples of how Russian-speaking threat actors have leveraged Ransomware-as-a-Service (RaaS)
• Russian-speaking vs. Western darknet market (DNM) sales volumes
• Crypto volumes sent to wallets linked to Russian and Chinese entities involved in the manufacturing, transport, and sale of military and dual use equipment and critical components

Get your copy of the complete report here.