Russian Government Now Actively Managing Cybercrime Groups: Security Firm

SecurityWeek reports that Russian cybercriminals are no longer merely tolerated but are being actively managed by the state, according to Recorded Future’s third Dark Covenant report published on 23 October 2025. The research describes a shift since 2023 in which the Russian authorities have coordinated arrests and prosecutions, while using cybercrime as a geopolitical instrument and a commercial enterprise, albeit with selective enforcement when threats to state interests arise.

It notes that operations such as Endgame targeted services used by ransomware operators, resulting in arrests and asset seizures, including roughly 100 individuals and $16 million, but that senior operators with ties to security services were less frequently pursued. The report also highlights that threat actors have moved to decentralised operations to evade surveillance, and that direct task coordination between cybercrime groups and Russian intelligence has been revealed in leaked communications.

According to the report, Russia remains a ‘safe haven’ for high-value actors, even as law enforcement focuses on money services and lower-tier operators to balance external pressure with strategic value.