• Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
MUST READ

LameHug: first AI-Powered malware linked to Russia’s APT28

 | 

5 Features Every AI-Powered SOC Platform Needs in 2025

 | 

Broadcom patches critical VMware flaws exploited at Pwn2Own Berlin 2025

 | 

Stormous Ransomware gang targets North Country HealthCare, claims 600K patient data stolen

 | 

United Natural Foods Expects $400M revenue impact from June cyber attack

 | 

Cisco patches critical CVE-2025-20337 bug in Identity Services Engine with CVSS 10 Severity

 | 

UNC6148 deploys Overstep malware on SonicWall devices, possibly for ransomware operations

 | 

Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16)

 | 

Salt Typhoon breach: Chinese APT compromises U.S. Army National Guard network

 | 

Former US Army member confesses to Telecom hack and extortion conspiracy

 | 

CVE-2025-6554 marks the fifth actively exploited Chrome Zero-Day patched by Google in 2025

 | 

DDoS peaks hit new highs: Cloudflare mitigated massive 7.3 Tbps assault

 | 

U.S. CISA adds Wing FTP Server flaw to its Known Exploited Vulnerabilities catalog

 | 

Android Malware Konfety evolves with ZIP manipulation and dynamic loading

 | 

Belk hit by May cyberattack: DragonForce stole 150GB of data

 | 

North Korea-linked actors spread XORIndex malware via 67 malicious npm packages

 | 

FBI seized multiple piracy sites distributing pirated video games

 | 

An attacker using a $500 radio setup could potentially trigger train brake failures or derailments from a distance

 | 

Interlock ransomware group deploys new PHP-based RAT via FileFix

 | 

Global Louis Vuitton data breach impacts UK, South Korea, and Turkey

 | 
  • Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
  • Home
  • Breaking News
  • Cyber Crime
  • Operation Destabilise dismantled Russian money laundering networks

Operation Destabilise dismantled Russian money laundering networks

Pierluigi Paganini December 05, 2024

Operation Destabilise: The U.K. National Crime Agency disrupted Russian money laundering networks tied to organized crime.

The U.K. National Crime Agency (NCA) disrupted Russian money laundering networks linked to organized crime across the U.K., Middle East, Russia, and South America as part of an operation called “Operation Destabilise.”

“An international NCA-led investigation – Operation Destabilise – has exposed and disrupted Russian money laundering networks supporting serious and organised crime around the world: spanning from the streets of the UK, to the Middle East, Russia, and South America.” reads the announcement published by NCA. “Investigators have identified two Russian-speaking networks collaborating at the heart of the criminal enterprise; Smart and TGR.”

Operation Destabilise, revealed today, led to OFAC sanctions against Russian-linked money laundering leaders. The U.S. Treasury’s OFAC sanctioned five individuals and four entities tied to the TGR Group for aiding Russian elites in sanctions evasion, including via digital assets.

Ekaterina Zhdanova (Smart) and George Rossi (TGR), along with their key associates, have been sanctioned by OFAC for facilitating money laundering operations.

Operation Destabilise money laundering

“Through the TGR Group, Russian elites sought to exploit digital assets—in particular U.S. dollar-backed stablecoins—to evade U.S. and international sanctions, further enriching themselves and the Kremlin,” said Acting Under Secretary for Terrorism and Financial Intelligence Bradley T. Smith, “The United States, alongside our allies and partners, remains committed to disrupting any effort by Russia to use digital assets or other illicit financial schemes to accrue, store, and transfer their ill-gotten gains.”

Russian-speaking networks Smart and TGR laundered money for UK criminals, the Kinahan cartel, and Russian clients evading sanctions. Their network also funded Russian espionage. NCA efforts led to 84 arrests, prison sentences, and the seizure of £20m in both cash and cryptocurrency.

The Telegraph reported that the investigation was launched after a driver was stopped on the M1 with more than £250,000 in cash led to the downfall of a multi-billion Russian money laundering system.

“Two multi-billion pound networks, which helped launder criminal cash obtained by Russian hackers through Britain via drug gangs, have been exposed in an international sting.” reads The Telegraph. “Run by two Russian millionaires whose organisations have connections with Moscow’s bullet-resistant glass-clad Federation Tower, the network has been used by hackers to free up cash and assets. The system also helped fund Russian spies in other countries, as well as assisting individuals and organisations seeking to bypass sanctions imposed following Vladimir Putin’s invasion of Ukraine.”

According to NCA, Smart and TGR are both linked to Russia’s financial sector, the two businesses laundered funds through 30+ countries. Zhdanova and Khadzi-Murat Magomedov brokered deals, while Krasnov handled UK couriers. A courier network, directed by Zhdanova and Russian national Nikita Vladimirovich Krasnov, laundered £15M, with Fawad Saiedi jailed for 4+ years.

In November 2023, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Ekaterina Zhdanova for her role in laundering and managing virtual currency on behalf of Russian elites, ransomware operators, and other threat actors.

“Through key facilitators like Zhdanova, Russian elites, ransomware groups, and other illicit actors sought to evade U.S. and international sanctions, particularly through the abuse of virtual currency,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. “We remain focused on safeguarding the U.S. and international financial system against those who seek to exploit this technology, among other illicit finance risks in the virtual assets ecosystem.”

Zhdanova also helped Russians to evade sanctions imposed on Russia after the invasion of Ukraine, including an unnamed oligarch. Zhdanova moved $100 million to the United Arab Emirates, on behalf of the Russian oligarch.

According to the Department of the Treasury’s OFAC, Ekaterina Zhdanova in March 2022 assisted a Russian client in obfuscating their source of wealth in order to transfer over $2.3 million in Western Europe through a fraudulently opened investment account and real estate purchases. 

Zhdanova also supported individuals connected with the Russian Ryuk ransomware gang. In 2021, she laundered over $2.3 million on behalf of a Ryuk ransomware affiliate that obtained the funds from victim payments.

“Illicit finance inflicts immense harm around the world and this major global operation marks a significant step against economic crime.” Security Minister, Dan Jarvis said. “Led by the National Crime Agency working with Border Force, Op Destabilise has exposed Russian kleptocrats, drug gangs and cyber criminals – all of whom relied on the flow of dirty money.”

“The UK and its allies will continue to work together to crack down on illicit finance and the criminality it enables.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – money laundering, Operation Destabilise)


facebook linkedin twitter

Cybercrime Hacking hacking news information security news IT Information Security Operation Destabilise Pierluigi Paganini Security Affairs Security News

you might also like

Pierluigi Paganini July 18, 2025
LameHug: first AI-Powered malware linked to Russia’s APT28
Read more
Pierluigi Paganini July 18, 2025
5 Features Every AI-Powered SOC Platform Needs in 2025
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

    recent articles

    LameHug: first AI-Powered malware linked to Russia’s APT28

    APT / July 18, 2025

    5 Features Every AI-Powered SOC Platform Needs in 2025

    Security / July 18, 2025

    Broadcom patches critical VMware flaws exploited at Pwn2Own Berlin 2025

    Security / July 18, 2025

    Stormous Ransomware gang targets North Country HealthCare, claims 600K patient data stolen

    Data Breach / July 17, 2025

    United Natural Foods Expects $400M revenue impact from June cyber attack

    Security / July 17, 2025

    To contact me write an email to:

    Pierluigi Paganini :
    pierluigi.paganini@securityaffairs.co

    LEARN MORE

    QUICK LINKS

    • Home
    • Cyber Crime
    • Cyber warfare
    • APT
    • Data Breach
    • Deep Web
    • Digital ID
    • Hacking
    • Hacktivism
    • Intelligence
    • Internet of Things
    • Laws and regulations
    • Malware
    • Mobile
    • Reports
    • Security
    • Social Networks
    • Terrorism
    • ICS-SCADA
    • POLICIES
    • Contact me

    Copyright@securityaffairs 2024

    We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
    Cookie SettingsAccept All
    Manage consent

    Privacy Overview

    This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
    Necessary
    Always Enabled
    Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
    Non-necessary
    Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
    SAVE & ACCEPT