The recent historic prisoner swap between the US and Russia has raised concerns about the release of some prominent Russian cybercriminals.
On August 1, 2024, the US and Russia took part in a historic prisoner swap. The 24-person deal is the largest prisoner swap since the end of the Cold War, including trades from Germany, Slovenia, Norway and Poland. The actual trade took place in Ankara, Turkey - meaning that seven countries participated in the event.
The swap involved the release of American journalist Evan Gershkovich, Paul Whelan, a corporate security executive, and other dissidents, including Vladimir Kara-Murza, a Pulitzer Prize-winning writer and critic of the Kremlin, Oleg Orlov, and several associates of Alexei Navalny, the late anti-corruption activist who led an opposition to Russian President Vladimir Putin. Before his death in February 2024, Navalny was considered for an exchange, but the plans fell through. Whelan had also been involved in previous talks for a prisoner exchange - most recently with Viktor Bout, but this trade proceeded with Brittney Griner.
In exchange for these individuals, eight Russians were released. Vadim Krasikov, a specialist assassin held in Germany on a 40-year murder sentence, and rumored to be a member of Vladimir Putin’s KGB, was the centerpiece of the deal. Several notable cybercriminals were among the others:
Roman Seleznev received a 27-year sentence in 2017 for organizing a $50 million cyber fraud ring, along with selling over 2 million credit card numbers on the black market (making him $170 million richer). Seleznev’s father is Valery Seleznev, a “close political ally” of Vladimir Putin.
Vladislav Klyushin was serving a nine-year sentence beginning in 2023 for a “$93 million hack-to-trade conspiracy”; Klyushin also has ties to the Kremlin. He owned M-13, an IT company that was used by the Russian government.
Their sentences have been cut short, along with those of Vadim Konoshchenok (arrested for smuggling U.S. electronics and ammunition to support Russia’s war efforts against Ukraine), Artem Dultsev and Anna Dultseva (arrested for espionage in Slovenia), Pablo González (arrested on suspicion of espionage in Poland) and Mikhail Valerievich Mikushin (arrested on suspicion of espionage in Norway).
The release of these prisoners, particularly the Russian cybercriminals, has caused some concern. Russia threat actors have been launching a significant number of cyber attacks across Europe, targeting critical infrastructure sectors. Additionally, some of the cybercriminals who worked with the prisoners being released were never apprehended - like Ivan Ermakov who worked with Klyushin but also played a role in hacking and spreading false information aimed at international anti-doping agencies, sports federations, and anti-doping officials (possibly connected to the Olympics after a doping scandal). There may be more Russia-based cyber attacks in the future as a result of these actors being released, perhaps emboldening others who see themselves as protected from the reach of international law enforcement.
This momentous prisoner swap can be called a “feat of diplomacy”; it won freedom for several political prisoners and others who were wrongfully incarcerated in Russia. Still, the trade may have serious implications for future threats in the cybersecurity landscape.