{ "id": "7374a472-d9c0-41bb-b490-ea55d2ced7b9", "created_at": "2026-04-06T00:22:12.00724Z", "updated_at": "2026-04-10T13:11:48.753385Z", "deleted_at": null, "sha1_hash": "285656477f8f40a47b2686729bdb2252938394f5", "title": "Operation Destabilise: NCA disrupts $multi-billion Russian money laundering networks with links to, drugs, ransomware and espionage, resulting in 84 arrests", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 3827019, "plain_text": "Operation Destabilise: NCA disrupts $multi-billion Russian money\r\nlaundering networks with links to, drugs, ransomware and\r\nespionage, resulting in 84 arrests\r\nBy cms-user23\r\nArchived: 2026-04-05 18:44:13 UTC\r\nAn international NCA-led investigation - Operation Destabilise - has exposed and disrupted Russian money\r\nlaundering networks supporting serious and organised crime around the world: spanning from the streets of the\r\nUK, to the Middle East, Russia, and South America.\r\nInvestigators have identified two Russian-speaking networks collaborating at the heart of the criminal enterprise;\r\nSmart and TGR.\r\nOperation Destabilise is being revealed today as the US Department of the Treasury’s Office of Foreign Assets\r\nControl (OFAC) announces sanctions against the Russian-speaking men and women at the head of these networks,\r\nas well as four businesses linked to TGR.\r\nA seventh individual, who was a global money laundering facilitator with strong links to one of the networks, has\r\nalso been arrested by the NCA’s international partners.\r\nAs well as enabling UK-based criminals, Smart and TGR used their global reach to launder money for\r\ntransnational crime groups such as the Kinahans. The notorious family-run crime syndicate, responsible for\r\nhttps://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nPage 1 of 6\n\ntrafficking drugs and firearms into the UK and around the world, were sanctioned by the US in 2022.\r\nThey also helped Russian clients to illegally bypass financial restrictions to invest money in the UK, threatening\r\nthe integrity of our economy. From late 2022 to summer 2023 the Smart network was used to fund Russian\r\nespionage operations.\r\nNCA-coordinated activity has so far led to 84 arrests, with many already serving prison sentences, as well as the\r\nseizure of over £20m in cash and cryptocurrency.\r\nOperation Destabilise uncovered a complex scheme, whereby the networks collect funds in one country and make\r\nthe equivalent value available in another, often by swapping cryptocurrency for cash.\r\nThis provides a mutually beneficial service, streamlining the movement of cash generated by crime groups in the\r\nWest, while simultaneously laundering crypto for cyber criminals, and helping Russian oligarchs and elites to\r\nbypass sanctions.\r\nThe UK was a key hub, and the NCA worked closely with partners across UK law enforcement to conduct a series\r\nof operations linked to Destabilise. Investigators witnessed exchanges taking place at scale across the country\r\nwhere street-level cash handovers were followed almost immediately by a movement of cryptocurrency of the\r\nsame value.\r\nAfter being paid in crypto in exchange for their cash, criminal gangs would use the virtual currency to reinvest in\r\ntheir illicit business, buying more drugs or firearms without the need to move any physical money across borders.\r\nThe financial service provided to such groups perpetuated their violent activity, enabling them to cause serious\r\nharm to communities across the UK.\r\nEtt fel inträffade.\r\nDet går inte att köra JavaScript.\r\nRob Jones, Director General of Operations at the National Crime Agency, said:\r\n“Operation Destabilise has exposed billion-dollar money laundering networks operating in a way previously\r\nunknown to international law enforcement or regulators.\r\nhttps://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nPage 2 of 6\n\n“For the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals, and\r\ndrugs gangs on the streets of the UK. The thread that tied them together – the combined force of Smart and TGR –\r\nwas invisible until now.\r\n“The NCA and partners have disrupted this criminal service at every level. We have identified and acted against\r\nthe Russians pulling the strings at the very top, removing the air of legitimacy that enabled them to weave illicit\r\nfunds into our economy.\r\n“We also took out the key coordinators that enabled the cash-based element of their operation in the UK, making it\r\nextremely difficult for them to operate here and sending a clear message that this is not a safe haven for money\r\nlaundering.”\r\nNik Adams, T/Assistant Commissioner of City of London Police and NPCC lead for economic crime, said:\r\n“The networks disrupted by Operation Destabilise were hidden in plain sight, operating from within our\r\ncommunities, moving vast sums of money linked to the drugs trade and serious violence on our streets.\r\n“Money laundering causes untold harm to the British public, it deprives society of legitimate funds that pay for\r\nschools, hospitals and social services. Under Destabilise, the NCA, alongside policing and other partners, has led\r\nUK law enforcement efforts to make our streets safer. Community intelligence and neighbourhood policing play a\r\nvital role in how we identify and tackle those causing the greatest harm in our communities, and together we can\r\nensure crime doesn't pay.”\r\nEkaterina Zhdanova\r\nhttps://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nPage 3 of 6\n\nSmart is headed up by Ekaterina Zhdanova, who worked closely with Khadzi-Murat Magomedov and Nikita\r\nKrasnov to facilitate money laundering.\r\nTGR is run by George Rossi, his second in command Elena Chirkinyan, and Andrejs Bradens (also known as\r\nAndrejs Carenoks).\r\nAll six have now been sanctioned by OFAC in the US.\r\nSmart and TGR have particularly strong links into the Russian financial sector and, whilst funds were often routed\r\nthrough the Middle East, their combined global reach extends through over 30 countries\r\nMany of the money laundering transactions were brokered by Zhdanova and Magomedov. Krasnov would work\r\nwith courier networks in the UK to arrange for the cash to be collected, then arrange for it to be converted.\r\nTGR and Smart coordinated their activity, with members of the TGR group receiving large volumes of cash on\r\nbehalf of Zhdanova and facilitating the conversion, making the equivalent value available in cryptocurrency.\r\nOne cash courier network investigated conducted cash handovers in 55 different locations across England,\r\nScotland, Wales and the Channel Islands, over a four-month period. They did so on behalf of at least 22 suspected\r\ncriminal groups operating in the UK.\r\nA London-based cash courier in this network was being directed by Zhdanova and Krasnov, resulting in over £15\r\nmillion in criminal cash being laundered. The courier was sentenced to four years and four months in prison in\r\n2022.\r\nAnother investigation uncovered an extensive cash courier network led by another two London-based criminals,\r\nwho coordinated with Krasnov. They managed couriers to launder over £12 million in the UK in a two-and-a-half\r\nmonth period, as well as coordinating similar operations across Europe. Both men were jailed for a combined total\r\nof over ten years in 2024. One courier linked to this network was arrested by An Garda Siochana (AGS) in Ireland\r\nand sentenced to 3 years imprisonment.\r\nThe NCA-led operational activity in the UK did not go unnoticed by the criminal networks. In late 2022 and early\r\n2023 members of the networks investigated were believed to have reservations over operating in London and, in\r\nlate summer 2024, Russian-speaking laundering networks in the capital were charging high-commission rates and\r\nbelieved that it was difficult to work in the city.\r\nThis activity has also been extremely costly to the networks, who are assessed to operate on very low profit\r\nmargins - often charging as little as 3% commission for the amount laundered. Based on this figure, they would\r\nneed to launder around £700m for free to pay back the £20m seized by the NCA and partners.\r\nhttps://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nPage 4 of 6\n\nGeorge Rossi \u0026 Elena Chirkinyan\r\nSmart and TGR provide a service that enables Russian elites, and designated individuals and entities to access\r\nWestern economies that would otherwise be denied to them through sanctions or other financial restrictions.\r\nIn 2023, Elena Chirkinyan of the TGR Group was involved in concealing the transfer of funds out of Russia, most\r\nlikely to support the activities of a Russian-language media organisation in the UK. These funds are alleged to\r\nhave originated from Russia Today (RT), and the entity that owns RT is sanctioned by the UK.\r\nIn March 2022, Zhdanova worked with members of TGR to move over £2million into the UK for a Russian client,\r\nmasking the source of the funds and bypassing ‘know your customer’ checks to purchase properties.\r\nSiam Expert Trading Company Ltd., a Thailand-based company associated with Bradens that was sanctioned by\r\nOFAC today, facilitated the export of electronic components to Russia.\r\nThe networks also support Russian cyber criminals to launder their illicit profits. In 2021, Zhdanova laundered\r\nover $2.3million of suspected ransoms paid in crypto by victims to the Ryuk ransomware group. The NCA\r\nassesses that the group, members of which were sanctioned by the UK in 2023, was responsible for extorting at\r\nleast £27m from 149 UK victims, including hospitals, schools, businesses and local authorities. However, their\r\ntrue impact is likely to be much higher.\r\nSmart and TGR’s crypto addresses showed regular exposure to Garantex, the crypto exchange service that was\r\nsanctioned by the UK and US in 2022. Garantex has been linked to payments to companies for components of\r\nweapons used by Russia in its invasion of Ukraine.\r\nOperation Destabilise has been delivered in close collaboration with UK law enforcement and international\r\npartners including OFAC, the Federal Bureau of Investigation, the Drug Enforcement Agency, the French\r\nhttps://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nPage 5 of 6\n\nDirection Centrale de la Police Judiciaire, and AGS in Ireland. The NCA also worked closely with authorities in\r\nthe UAE to disrupt related money laundering activities.\r\nSecurity Minister, Dan Jarvis said: \r\n“Illicit finance inflicts immense harm around the world and this major global operation marks a significant step\r\nagainst economic crime.\r\n\"Led by the National Crime Agency working with Border Force, Op Destabilise has exposed Russian kleptocrats,\r\ndrug gangs and cyber criminals - all of whom relied on the flow of dirty money.\r\n\"The UK and its allies will continue to work together to crack down on illicit finance and the criminality it\r\nenables.\"\r\n4 December 2024\r\nSource: https://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-wi\r\nth-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nhttps://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.nationalcrimeagency.gov.uk/news/operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests" ], "report_names": [ "operation-destabilise-nca-disrupts-multi-billion-russian-money-laundering-networks-with-links-to-drugs-ransomware-and-espionage-resulting-in-84-arrests" ], "threat_actors": [ { "id": "d90307b6-14a9-4d0b-9156-89e453d6eb13", "created_at": "2022-10-25T16:07:23.773944Z", "updated_at": "2026-04-10T02:00:04.746188Z", "deleted_at": null, "main_name": "Lead", "aliases": [ "Casper", "TG-3279" ], "source_name": "ETDA:Lead", "tools": [ "Agentemis", "BleDoor", "Cobalt Strike", "CobaltStrike", "RbDoor", "RibDoor", "Winnti", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "aa73cd6a-868c-4ae4-a5b2-7cb2c5ad1e9d", "created_at": "2022-10-25T16:07:24.139848Z", "updated_at": "2026-04-10T02:00:04.878798Z", "deleted_at": null, "main_name": "Safe", "aliases": [], "source_name": "ETDA:Safe", "tools": [ "DebugView", "LZ77", "OpenDoc", "SafeDisk", "TypeConfig", "UPXShell", "UsbDoc", "UsbExe" ], "source_id": "ETDA", "reports": null }, { "id": "f6f95b20-4c86-4e09-b82d-c9ef72fed729", "created_at": "2024-03-12T02:02:11.297739Z", "updated_at": "2026-04-10T02:00:04.991462Z", "deleted_at": null, "main_name": "[Unnamed groups: Russia]", "aliases": [ "Operation Destabilise" ], "source_name": "ETDA:[Unnamed groups: Russia]", "tools": [], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434932, "ts_updated_at": 1775826708, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/285656477f8f40a47b2686729bdb2252938394f5.pdf", "text": "https://archive.orkl.eu/285656477f8f40a47b2686729bdb2252938394f5.txt", "img": "https://archive.orkl.eu/285656477f8f40a47b2686729bdb2252938394f5.jpg" } }