Author: Eternity Lab

The UK’s National Crime Agency (NCA) has exposed and disrupted two Russian money laundering networks that handled cash stolen by the Ryuk ransomware gang, among others.

Operation Destabilise took out the Smart and TGR criminal networks, which besides providing services to cyber criminals also played a key role in drugs and firearms trafficking into the UK.

The two networks also helped Russian clients bypass financial restrictions to invest money illegally in the UK, transferred money to support the activities of a sanctioned Russian-language media organisation, alleged to be banned propaganda network Russia Today (RT), and provided financial assistance to fund Russian espionage activities.

The NCA said it had also demonstrated clear links between the cryptocurrency addresses used by Smart and TGR, and sanctioned crypto exchange Garantex, which allegedly has links to payments made for weapons components for Russian troops in Ukraine.

“Operation Destabilise has exposed billion-dollar money laundering networks operating in a way previously unknown to international law enforcement or regulators,” said Rob Jones, NCA director general of operations.

“For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals and drugs gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR – was invisible until now.

For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals and drugs gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR – was invisible until now Rob Jones, NCA

“The NCA and partners have disrupted this criminal service at every level. We have identified and acted against the Russians pulling the strings at the very top, removing the air of legitimacy that enabled them to weave illicit funds into our economy,” he added.

“We also took out the key coordinators that enabled the cash-based element of their operation in the UK, making it extremely difficult for them to operate here and sending a clear message that this is not a safe haven for money laundering,” said Jones.

The NCA also named six key players in the two networks, all of whom have been sanctioned by the United States Office of Foreign Assets Control (OFAC) today: Ekaterina Zhdanova, Khadzi-Murat Magomedov and Nikita Krasnov, who between them led the Smart operation; and George Rossi, Elena Chirkinyan and Andrejs Bradens (aka Andrejs Carenoks), who headed up TGR.

The NCA said that dating back to 2021, Zhdanova played a key role in laundering $2.3m (£1.8m) of crypto-based ransoms paid to the Ryuk ransomware crew. The Ryuk gang – a predecessor to Conti – callously targeted health sector organisations in both the UK and US during the Covid-19 pandemic in 2020.

Members of Ryuk, sanctioned by the UK in 2023, were responsible for extorting over £27m from at least 149 known victims in the UK – the gang’s true impact was likely much higher.

“This is stellar work from the NCA, OFAC and partners, demonstrating the simple truth that paying ransoms contributes to crime on the streets in the UK and other countries,” said Don Smith, vice-president of threat intelligence at the Secureworks Counter Threat Unit.

“Paying ransoms is, and always has been, nothing more than putting funds in the hands of criminals,” he said.

84 arrests

NCA-coordinated activity against Smart and TGR has so far resulted in 84 arrests, with many individuals already behind bars and over £20m in assets seized.

The networks formed the core of a complex scheme that collected money in one jurisdiction and performed a series of crypto-for-cash swaps to make the equivalent value available elsewhere. In this manner, they were able to not only launder money for cyber criminals, but also streamline the movement of money made by other organised crime gangs and help Russian oligarchs and elites bypass sanctions.

This is stellar work from the NCA, OFAC and partners, demonstrating the simple truth that paying ransoms contributes to crime on the streets in the UK and other countries. Paying ransoms is nothing more than putting funds in the hands of criminals Don Smith, Secureworks Counter Threat Unit

The UK unwittingly played a key role as a hub for Smart and TGR, with investigators frequently witnessing in-person, street-level cash handovers, which were followed almost immediately by cryptocurrency movements.

After receiving their crypto funds back, the networks enabled criminals to reinvest in drugs or firearms without needing to move actual money across borders, perpetuating a cycle of violence and harm in Britain.

“The networks disrupted by Operation Destabilise were hidden in plain sight, operating from within our communities, moving vast sums of money linked to the drugs trade and serious violence on our streets,” said Nik Adams, T/assistant commissioner for City of London Police and National Police Chiefs’ Council lead for economic crime.

Cash couriers run by Smart and TCG used over 50 different locations in England, Scotland, Wales and even the Channel Islands over a four-month period, to swap funds for more than 20 distinct criminal groups. One of the couriers, Fawad Saiedi, who is now serving a four-year and four-month prison sentence, personally oversaw the laundry of £15m of funds.

A different group, coordinated by Krasnov, ran couriers to launder over £12m in just two-and-a-half months. Three individuals are currently serving time for these offences in the UK and Ireland.

The NCA also revealed how its investigation did not go unnoticed by the networks, with many members speaking openly about their reservations over operating in London as the agency and its partners slowly turned up the heat.

By summer 2024, a few short months ago, Russian money laundering networks in London were charging extremely high commission rates as it became harder and harder for them to work in the city. This proved costly to both groups, which were operating on extremely low profit margins.

Source

Liverpool’s Alder Hey Children’s NHS Foundation Trust has revealed that a shared service operated by itself and Liverpool Heart and Chest Hospital NHS Foundation Trust was the source of an INC Ransom intrusion that has affected patient data at both hospitals, as well as Royal Liverpool University Hospital.

The attack, which came to light on 28 November, has seen data exfiltrated from the Trusts’ IT systems, but is not linked to a separate ransomware attack against Wirral University Hospitals NHS Foundation trust, which unfolded a few days earlier and has been linked to the RansomHub crew.

In an update shared on 4 December, Alder Hey said: “Criminals gained unlawful access to data through a digital gateway service shared by Alder Hey and Liverpool Heart and Chest Hospital.

“This has resulted in the attacker unlawfully getting access to systems containing data from Alder Hey Children’s NHS Foundation Trust, Liverpool Heart and Chest Hospital, and a small amount of data from Royal Liverpool University Hospital.

The Trust said its investigation into exactly what data has been stolen is ongoing, and this may take some time. It warned that there was a possibility that the ransomware gang may publish the data before its investigation is complete, an indication that it is standing firm and resisting demands, as is public sector policy in the UK.

“As soon as we are able to update on the impact to people’s data, we will provide a further update. Work is continuing with the National Crime Agency to secure impacted systems and to take further steps in line with law enforcement advice. We are also following guidance from the Information Commissioner’s Office and will ensure that anyone impacted by this data breach is contacted directly and supported,” Alder Hey said.

It emphasised that its core frontline services remain unaffected and are running as usual – patients should still attend appointments as scheduled.

The Trust’s added that its recovery efforts were making strong headway, saying: “As part of our response to this threat we have made progress in securing impacted systems and ensuring the attackers do not have continued access. This means that we are in a position to begin to reconnect our systems when it is safe to do so.”

Was Citrix Bleed involved?

Alder Hey’s assertion that a digital gateway service served as the entry point for INC Ransom’s operators appears to confirm earlier reports – per Infosecurity – that the gang attacked a Citrix instance operated by the Trust.

If this was the case, the gang likely used a critical vulnerability in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway appliances, tracked as CVE-2023-4966, but more commonly known as Citrix Bleed.

Discovered towards the end of 2023, Citrix Bleed enables both session hijacking and data disclosure. It is one of the most widely exploited zero-days of the past 12 months and has been widely used in ransomware attacks – notably a number of high-profile incidents involving the LockBit gang. According to Secureworks’ intelligence, INC Ransom has also targeted it with great enthusiasm.

Rafe Pilling, director of threat intelligence at the Secureworks Counter Threat Unit, said: “Criminal gangs are opportunistic in the hunt for the next pay-out, the impact of their actions is not their concern. The fact that this is a highly specialist children’s hospital will not cause them to lose any sleep. We have previously seen Gold Ionic – the group that operates INC ransomware – hit NHS Dumfries and Galloway. These attacks on front line healthcare underline that this sector, is a vulnerable target and must be protected.

“INC ransom was one of the most active threat groups the Secureworks CTU observed over the past year, having started operating in July 2023. Its victims are predominantly based in the US, however it’s global reach is growing. Its victims represent a wide range of sectors, but the most common are industrial, healthcare and education organisations.”

Source