A massive international law enforcement effort, led by the UK’s National Crime Agency (NCA), has taken down two Russian-linked money laundering networks that were quietly supporting global criminals, including ransomware groups.
The operation, called Operation Destabilise, uncovered the intricate workings of the Smart network, led by Ukrainian George Rossi, and the TGR network, headed by Russian Ekaterina Zhdanova. Both networks were deeply involved in laundering millions for cybercriminals and helping Russian elites sidestep sanctions.
The investigation revealed that Zhdanova had laundered over $2.3 million in cryptocurrency in 2021, tied to ransom payments made to the infamous Ryuk ransomware group. Ryuk was once a major player in ransomware attacks before morphing into the Conti operation, which eventually splintered into smaller cybercrime factions in 2022. Together, the Smart and TGR networks were responsible for extorting at least £27 million from 149 UK victims, including hospitals, schools, businesses, and local authorities. However, officials believe the true scale of their impact is much larger.
This wasn’t a solo operation. The NCA worked closely with international partners, including the FBI, the U.S. Department of the Treasury, French and Irish law enforcement, and even authorities in the UAE, to dismantle these sprawling networks. According to Rob Jones, Director General of Operations at the NCA, this was the first time law enforcement was able to map the connections between Russian elites, crypto-powered cybercriminals, and even drug gangs in the UK. He described the operations of Smart and TGR as an invisible force that tied these groups together.
Zhdanova and other key players, like Elena Chirkinyan and Andrejs Bradens, have faced sanctions for their roles in these schemes. The networks didn’t just launder money for criminals—they also helped Russian elites move funds into Western economies, bypassing financial restrictions. One of their more curious activities involved funding a UK-based Russian-language media outlet believed to have ties to Russia Today, a network currently sanctioned in the UK.
The investigation also revealed links to Garantex, a crypto exchange previously sanctioned for facilitating illegal transactions on the Hydra Market dark web platform and supporting the purchase of components used in Russian weapons for the Ukraine conflict.
Operation Destabilise has not only disrupted these billion-dollar laundering networks but also exposed the hidden ties between global cybercriminals, Russian elites, and organized crime. For law enforcement, this marks a significant victory, but it’s also a stark reminder of the sophisticated methods these groups use to operate beneath the radar.
