NCA Disrupts Russian Money Laundering Network Linked to Espionage, Hacking, Drugs

Officers from the National Crime Agency arrive at a property of a man who is accused of being a member of a group arranging small boat crossings, in Grays, Essex, England, on June 19, 2023. Aaron Chown/PA Wire

The National Crime Agency (NCA) has brought down two multi-billion pound Russian money laundering networks which supported cyber crime, drug smuggling, and espionage operations.

The international NCA-led investigation, named Operation Destabilise, exposed a system where criminal networks collected funds in one country and exchanged it in another, often by swapping cryptocurrency for cash.

The NCA said on Wednesday that Operation Stabilise was its largest money laundering investigation in a decade, resulting in 84 arrests and £20 million seized.

The system was run by two Russian-speaking networks called Smart and TGR, which the agency says has “strong links” to the Russian financial sector.

The combined global reach of the two groups was over 30 countries spanning Europe, the Middle East—through which funds were often routed—and South America.

Smart is headed by Russian national Ekaterina Zhdanova, who worked with Khadzi-Murat Magomedov and Nikita Krasnov to facilitate money laundering.

George Rossi, a Ukrainian national born in Russia, runs TGR, along with his second-in-command Elena Chirkinyan and Andrejs Bradens (also known as Andrejs Carenoks).

All six have been sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control.

Zhdanova was arrested in France and the whereabouts of Rossi is unknown.

Rob Jones, the director-general of operations at the NCA, said: “For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals, and drugs gangs on the streets of the UK.

“The thread that tied them together—the combined force of Smart and TGR—was invisible until now.”

UK ‘Key Hub’ for Laundering

Investigators described the UK as a “key hub” of laundering activity for the networks and witnessed exchanges where street-level cash handovers were followed by a movement of digital currency of the same value.

The NCA said that once the exchanges were made, criminal gangs would use the digital funds to buy drugs and firearms which fuelled the narcotics trade and violence on the streets of Britain.

One London-based cash courier, Fawad Saiedi, was being directed by Smart’s Zhdanova and Krasnov, with exchanges resulting in £15 million being laundered. Saiedi was later sentenced to four years and four months in prison.

In another investigation on cash courier networks, the NCA exposed laundering operations led by Semen Kuksov and Andrrii Dzektsa, coordinated by Krasnov, where over £12 million was laundered in the UK in two and a half months.

Undated photo of Ekaterina Zhdanova. NCA

The three managed similar courier operations across Europe.

Jones said the NCA and its partners have disrupted the network “at every level,” taking out key coordinators who enabled the cash-based element of the operation in the UK.

He added that it will now be “extremely difficult” for the network to operate in the UK and that the result of Operation Destabilise sends “a clear message that this is not a safe haven for money laundering.”

Spying and Ransomware

The NCA said that both TGR and Smart helped oligarchs and designated individuals and entities from Russia bypass sanctions and access economies in the West.

From late 2022 to the summer of 2023, Smart was used to fund Russian espionage operations, getting money to spies based in other countries.

Investigators also revealed the network’s support of cyber criminals laundering their profits.

Undated handout photo issued by the National Crime Agency of Fawad Saiedi who is said to have laundered more than £15 million for a multibillion-dollar money laundering network run by two Russian millionaires. National Crime Agency/PA Wire

“In 2021, Zhdanova laundered over $2.3 million of suspected ransoms paid in crypto by victims to the Ryuk ransomware group. The NCA assesses that the group, members of which were sanctioned by the UK in 2023, was responsible for extorting at least £27m from 149 UK victims, including hospitals, schools, businesses and local authorities,” the agency said.

Security Minister Dan Jarvis said Operation Destabilise “exposed Russian kleptocrats, drug gangs and cyber criminals—all of whom relied on the flow of dirty money.”

“The UK and its allies will continue to work together to crack down on illicit finance and the criminality it enables,” Jarvis said.

Increased Cyber Threats

The revelation of the extent of the cyber crimes follows the National Cyber Security Centre’s (NCSC) warning that cybercriminal gangs and hostile state actors—namely Russia, China, Iran, and North Korea—were increasingly posing a threat to the UK.

The UK’s technical authority for cyber security said that Russia and Iran were engaging in “hostile cyber activity, not just to degrade, damage and compromise data and systems, but to support or trigger direct physical threat activity, broader espionage, and hybrid warfare activities.”

The NCSC said the two states were looking to encourage a new wave of “state-aligned hacktivism,” saying it had seen an increase in the focus on critical national infrastructure systems, “as hacktivist groups strike to compromise these systems for political effect and propaganda victories.”

PA Media contributed to this report.