Russian ransomware generates over $500m in crypto proceeds, TRM Labs says

TRM Labs analysts say Russian-speaking ransomware groups will account for around 70% of all crypto revenues from ransomware in 2023.

Russia to Become a Central Site for Ransomware Threat Actors in 2023 According to analysts at TRM Labs, Russian-speaking ransomware groups accounted for nearly 70% of all crypto revenue generated from ransomware. This alarming figure underscores Russia’s growing role in ransomware-related activities, with these groups generating nearly $500 million in crypto revenue.

According to the company’s latest report, two Russian ransomware operators — Lockbit and ALPHV/Black Cat — have collectively reported “at least $320 million” in attack revenue. TRM Labs notes that Lockbit, which is currently under sanctions, attacked big names like Boeing and the UK’s postal operator Royal Mail in 2023, while BlackCat/ALPHV targeted MGM Resorts and dental and medical supply distributor Henry Schein.

Crypto volumes tied to sanctioned entities worldwide | Source: TRM Labs

The report also highlights that nearly all of the world’s sanctioned crypto volume is concentrated in a single exchange, Garantex, headquartered in Russia. This Moscow-based sanctioned trading firm accounted for over 80% of crypto volumes associated with all sanctioned assets globally in 2023. These assets include crypto exchanges and entities subject to U.S. and international sanctions regimes.

According to the data, part of Garantex’s crypto volume goes to Chinese manufacturers that have been sanctioned for purchasing “military equipment and critical components used by Russian forces in Ukraine.”

“This equipment includes commercial UAVs, anti-UAV equipment, thermal optics, integrated circuits (ICs), GPS modules, and tantalum capacitors critical to the production of Russian weapons systems.”

TRM Laboratories

However, TRM Labs notes that “not all of this volume” relates to sanctioned assets and could also include broader cross-border cryptocurrency trade between Russia and China.

As Crypto.news previously reported, Russia is increasingly relying on crypto as a payment method to circumvent sanctions and continue cross-border trade. This trend continues despite crypto being banned as a legal tender within the country, creating uncertainty over the classification of these transactions.

Recently, the Russian parliament passed two crypto-related bills in the first of three readings. If passed, the laws would allow the use of crypto for international trade and officially recognize and regulate crypto mining. The legislative move comes after reports that Russian metals producers have begun using stablecoins in transactions with China due to severe restrictions on traditional payment methods due to sanctions.