FSB officer imprisoned for protecting Russian cybercriminals
A Russian FSB counterintelligence officer was sentenced to nine years in prison for accepting $1.7 million in bribes to shield cybercriminals from prosecution, revealing Russia's protection-racket dynamics with criminal hackers.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
In February 2022, Russian MVD investigators arrested six hackers in Perm operating major credit card theft shops (Trump's Dumps, Sky-Fraud, Ferum Shop) selling stolen US cardholder data. The arrest exposed that FSB officer Grigory Tsaregorodtsev had been accepting bribes from these criminals since 2016 in exchange for protection from prosecution. In April 2024, a Russian court sentenced Tsaregorodtsev to nine years imprisonment, a 320 million ruble fine, property confiscation, and an eight-year post-release ban from government service.
This case illuminates Russia's opaque cybercriminal ecosystem and the "social contract" between the Kremlin and hackers: focus on foreign targets, avoid undermining Kremlin objectives, and remain responsive to government requests. Rather than signaling a crackdown on cybercrime, Tsaregorodtsev's prosecution reflects that he failed to deliver promised protection when the hackers were arrested—the hackers subsequently exposed him to authorities. The case demonstrates that Russian state security officers engaging with cybercriminal groups receive no guaranteed protection if caught, with outcomes depending on connections, operational significance, and interagency dynamics.
Defenders should note that Russian cybercriminals continue generating an estimated 74% of global ransomware revenue and serve as a talent pool for state-sponsored operations. The FSB and other Russian security services maintain ongoing relationships with criminal groups for both deniable operations and targeted attacks, particularly against foreign government and US Democratic Party infrastructure.
Mentioned in this report
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs