How Russian hacking evolved: simple credit card schemes in the '90s, takeover by organized crime in the '00s, and now joint criminal and government hacker teams
SAN FRANCISCO — Just past 8 a.m. on March 14, police trod quietly through the snow to the double-fronted doors of Karim Baratov's lavish home in Ancaster, Ontario. Tweets: @miriamelder , @sheeraf , @sheeraf , and @thegrugq . Thanks: @ravichandrans25 Tweets: Miriam Elder / @miriamelder : Morning must-read from @sheeraf: How the US woke up and stopped helping Russia ID its best hackers https://www.buzzfeed.com/... pic.twitter.com/KbIWOTIZ6M Sheera Frenkel / @sheeraf : Russian hackers tell @BuzzFeedNews about being forced to hack on behalf of the Russian State: https://www.buzzfeed.com/... Sheera Frenkel / @sheeraf : On how the Russian government recruits local hackers: “It's a knock on your door and maybe a knock on your ass.” https://www.buzzfeed.com/... The Grugq / @thegrugq : It is amusing how frustrated the FBI is by what is so obvious to outside observers. http://www.buzzfeed.com/... Thanks: @ravichandrans25
Context & Ripple Effects
This BuzzFeed investigation lands at the hinge of an arc the corpus has been tracing for years: [[a:915359|Russia bolstering its cyberwarfare apparatus by recruiting convicted hackers, scientists, and outside firms]], and the loose alliance between Russia's criminal hackers and its intelligence services that has targeted perceived enemies since around 2005. The piece adds the ground-level view — hackers describing being forced to work for the Russian state — alongside the police raid on Karim Baratov in Ancaster, Ontario, and the report that the US stopped helping Russia identify its top hackers.
Why it matters: the same month this published, the FBI was already investigating the suspected Russian hack of the DNC that fed an email trove to WikiLeaks ([[a:872017]]). The story reframes those operations not as isolated intrusions but as the output of a deliberate criminal-government merger two decades in the making.
First-order effects
- Individual hackers like Baratov now sit at the intersection of two pressures: coercion by the Russian state on one side and Western law enforcement raids on the other, ending the era when criminal hacking talent could operate outside geopolitics.
- The US decision to stop helping Russia identify its best hackers converts what was bilateral law-enforcement cooperation into open adversarial posture toward the Kremlin's hacker pipeline.
Second-order effects
- The FBI's DNC investigation shows where the merged criminal-state capability gets deployed — against political targets whose exposure then forces Western governments to respond through public attribution rather than quiet channels.
- Other states study the model: China's evolving approach to state-sponsored hacking explicitly borrows from Russia and Iran while increasingly relying on private-sector hackers ([[a:970026]]), spreading the proxy-hacker structure beyond Russia.
Third-order effects
- If the pattern holds, attribution collapses as a deterrent: when criminal crews act as state instruments, sanctions and indictments aimed at 'hackers' hit state policy, and responses must shift to collective defense — the direction the later US-NATO-tech-company partnership with Ukrainian hackers took ([[a:980121]]) and the eventual unmasking of GRU Unit 29155 behind Cadet Blizzard confirmed ([[a:874611]]).
- The long-run structural shift is a two-tier internet threat landscape where state-directed operations wear criminal camouflage, forcing every government to treat ordinary cybercrime as potential intelligence activity.
The trend: State and criminal hacking are converging into a single instrument of national power, with Russia as the template and other governments adapting the model.