A look at the loose alliance between Russia's criminal hackers and intelligence services that has been attacking Russia's perceived enemies since around 2005
On the night of August 8, 2008, Georgian troops started shelling Tskhinvali, the capital of South Ossetia, and then began their assault on the city. Tweets: @meduza_en , @democracyjourno , and @juliaioffe Tweets: Meduza / @meduza_en : Ten years ago today, the Russo-Georgian war kicked off. Here's how it sparked Moscow's recruitment of criminal hackers and possibly led to the hacking of the DNC in 2016. http://meduza.io/... http://twitter.com/... Anabelle / @democracyjourno : Sources say that ‘Russian intelligence agencies prefer not to keep many “technical experts” on staff, opting instead to supervise freelancers whom they find on hacker online forums and through criminal cases against hackers and credit-card fraudsters.’ http://meduza.io/... Julia Ioffe / @juliaioffe : Ten years ago today, Russia invaded Georgia. It was a turning point in how the Kremlin used cyber warfare. An excellent—and extremely relevant—report from the inimitable @danya_turovsky. https://meduza.io/...
Context & Ripple Effects
The Meduza piece closes a loop that earlier coverage opened: Russian hacking began as simple credit card schemes, was taken over by organized crime in the 2000s, and then fused with government teams — an evolution mapped in detail by BuzzFeed's history of Russian hacking. The report's core claim is structural rather than episodic: Moscow prefers to supervise freelance hackers recruited from forums and criminal cases instead of staffing its own technical experts, a model that took shape after the 2008 Russo-Georgian war and may have fed into the 2016 DNC hack.
First-order effects
- Russian intelligence gains deniable offensive capacity on demand — criminal crews execute campaigns against perceived enemies while the Kremlin keeps few in-house experts to expose.
- Targets in Russia's orbit, Georgia chief among them, absorb sustained intrusion campaigns: a later investigation found years of breaches reaching the Foreign Ministry, Finance Ministry, and central bank (the Georgian ministry hacks).
Second-order effects
- Western governments respond by burning the alliance's cover through attribution — the US and allies publicly tied the Cadet Blizzard crew to Russia's GRU Unit 29155, the unit linked to coups and assassinations (Cadet Blizzard's GRU unmasking).
- Defenders mirror the outsourcing model: a quiet partnership between US tech companies, NATO intelligence, and Ukrainian hackers helped blunt Russia's offensive cyber capabilities during the invasion.
Third-order effects
- The state-criminal boundary keeps dissolving in both directions — the same recruitment logic now extends to volunteer hackers in the Russia-Ukraine war whose identities and locations are unverifiable, making state responsibility harder to prove or deter.
- If supervision-by-proxy remains cheaper and more deniable than in-house units, cyber conflict consolidates around loose networks of deniable operators, forcing attribution and alliance-building to become the primary countermeasures for targeted states.
The trend: State cyber power is migrating from in-house military units toward supervised networks of criminal and volunteer hackers, trading control for deniability.