The Collective Response to Russia’s Ukraine Invasion

Yesterday, the government rolled out two hacking indictments from last year as part of its effort to use legal documents to expose Russian spying operations. While the indictments are important speaking documents, I realized from the response that the subset of journalists who focus primarily on cybersecurity were unaware that this effort was part of a larger effort to demonstrate Russia’s spying that DOJ (and, surely, other agencies of the IC) have been pursuing since the Russian invasion.

So I wanted to start collecting all instances here as a way to see the entire package of what DOJ is doing. I’ll try to keep this up-to-date.

February 22, 2022: Treasury sanctions Russian banks

Individual targets include Denis Aleksandrovich Bortnikov, Petr Mikhailovich Fradkov, Vladimir Sergeevich Kiriyenko.

(press release)

February 24, 2022: Treasury sanctions Russian banks

Targets include Sberbank, VTB, Gazprom, Rostelecom, Alfa Bank, Sergei Sergeevich Ivanov, Andrey Patrushev, Ivan Sechin (the latter sons of key oligarchs).

(press release)

February 25, 2022: Treasury sanctions Putin and Sergei Lavrov

(press release)

February 28, 2022: Treasury sanctions Kirill Dmitriev

Targets include Dmitriev and RDIF.

(press release)

US expels 12 Russian diplomats at UN.

March 3, 2022: Treasury sanctions key Putin cronies

Targets include Alisher Burhanovich Usmanov, Nikolay Petrovich Tokarev, Yevgeniy Prigozhin and their families.

(press release)

March 3, 2022: US v. Jack Hanick

November 4, 2021 sealed indictment against a former Fox employee who helped sanctioned oligarch Konstantin Malofeyev set up some media outlets to push Russian propaganda. Hanick was arrested in the UK on February 3, 2022 and is being extradited. (press release; my post)

SDNY 21-cr-676

March 7, 2022: US v. Elena Branson

March 7, 2022 complaint against the one-time chair of the Russian Community Council of the USA. Branson attempted to set up meetings with Trump. (press release; my post)

SDNY 22-mj-2178

March 11, 2022: Treasury sanctions Oligarchs

Targets include Dmitri Peskov and his family, Viktor Feliksovich Vekselberg, and the VTB board.

(press release)

March 14, 2022: US v. Andrey Muraviev

September 17, 2020 indictment against the funder for Lev Parnas’ cannabis donations, Andrey Murviev. The S2 indictment is otherwise identical to the S1 indictment obtained the same day, though with Muraviev identified. (press release; my post)

SDNY 19-cr-725

March 17, 2022: Treasury creates task force to target Oligarchs

(press release)

March 18, 2022: Baltic states expel diplomats

Baltic states expel 10 diplomats.

March 24, 2021: Treasury sanctions targeting industrial base

Sanctions targeting military industrial complex, Duma members, Herman Oskarovich Gref.

(press release)

March 24, 2022: US v. Evgeny Viktorovich Gladkikh

June 29, 2021 indictment against Evgeny Gladkikh for Triton hacking operations targeting refineries and other energy facilities

(press release)

DC 21-cr-442

March 24, 2022: US v. Pavel Aleksandrovich Akulov

August 26, 2021 indictment against three FSB officers working as part of the Dragonfly or Berzerk Bear hacking group for targeting ICS systems.

(press release)

KS 21-cr-20047

March 29, 2022: Europeans expel diplomats

Ireland expels 4 “diplomats.”

Lithuania expels

March 31, 2022: Treasury focuses on sanctions-evasion network

Treasury adds sanctions against companies used to evade sanctions, four key Russian tech companies, and the head of the organization for which Gladkikh works, TsNIIKhM’s General Director, Sergei Alekseevich Bobkov and itsDeputy General Director, Konstantin Vasilyevich Malevanyy.

April 4, 2022: FBI and Spanish authorities freeze Viktor Vekselberg’s yacht, Tango

FBI and Spanish authorities freeze Viktor Vekselberg’s yacht, Tango, for sanction violations and money laundering efforts to evade those sanctions.

Also Germany expels 40 “diplomats” and France expels 35.

April 5: Dmitry Pavlov and Hydra Market

DOJ charged Dmitry Pavlov and, with German assistance, shut down the Hydra Market to which he leased a server.

(press release)

April 6: Semion Meogilevich, Konstantin Malofeyev, additional sanctions on Sberbank, Alfa Bank, and Putin, Medvedev, and Lavrov’s families, Cyclops Blink

Department of State offers a $5 million reward for information leading to Semion Mogilevich’s arrest.

FBI wanted poster

DOJ charged Konstantin Malofeyev under the mirror charges to those against Jack Hanick.

(press release)

The White House added sanctions to Sberbank and Alfa Bank, added new restrictions on US investments in Russia, and added family members of Putin, Medvedev, and Lavrov’s families.

(press release)

DOJ rolled out the shut-down, in March, of the Cyclops Blink botnet run by Sandworm.

March 18 warrant

March 23 warrant

(press release)

April 14: Aleksandr Mikhaylovich Babakov

(press release)


April 20: Malofeyev’s network

Treasury sanctions Malofeyev’s family, sanctions-evasion, and influence networks

(press release)

April 26: Sandworm

State offers a $10 million reward for six hackers involved in the Sandworm NotPetya attack.

(press release)

May 5: Pursuant to a US warrant, Fiji seizes Oligarch Suleiman Kerimov’s yacht

Fiji seized the $300 million yacht pursuant to a US based warrant.

(press release)

September 30: Treasury sanctions a ton of Duma and Federation members

These sanctions were prepared as a response to Russia’s claim to have annexed additional parts of Ukraine.

19 replies
  1. WilliamOckham says:

    I’ve been wondering about this. The pattern is obvious. I almost made a joke on Twitter about how there really were sealed indictments, they were just all of Russians…

    • emptywheel says:

      I’m not sure sure. I imagine there are other sealed indictments or complaints, but of people you have to arrest.

      And then there are things like the hypothetical Rudy charges and the Assange extradition, both intimately tied to all this, which are really delicate.

    • emptywheel says:

      Also one reason I started this is bc Durham has submitted two requests for CIPA extensions that cite Ukraine.

      It seems like the CI experts at DOJ and FBI have higher priorities than Durham’s little witch hunt.

      • earthworm says:

        Do you think the sanctions could affect/tip the balance in American political campaigns, with respect to dark money flows drying up?

        • klynn says:

          One side of me says, “Yes!” Another side of me thinks International Christian charity non-profits will funnel cryptocurrency to other “Christian” non profits that will provide dark money.

        • timbo says:

          It already had some effect vis-a-vis the implosion and infighting at the National Rifle Association, at least in parallel. How is that funding to various “conservative” causes being replaced?

  2. jaango1 says:

    Thanks, Marcy!

    This is good news.

    A couple years ago, and Putin had his military cyber force hack the America’s major business entities, and to include in this Big Hack 50 social commentaries sites, and one included the Chicano Veterans Organization, and which was followed by over 400 hacks from the frothy Putin wannabees. And the end result was that the internet platform being utilized by the CVO, was tossed out onto the street. As such, the appropriated law enforcement agencies adopted their attitude for ‘we can’t be bothered.’

    Therefore, the feds announcing via their press releases, gives us a tad of satisfaction, this this political picture now on the upswing.

  3. Leoghann says:

    I counted 17 named individuals. Add in the sanctioned family members, and however many are on the couple of corporate boards that were mentioned, and it looks like 40-50 already under sanctions. I saw a piece last night saying that the Swiss seem to be taking part in some of the sanctions.

  4. mospeck says:

    Berzerker Bear is good to go and so are a lot of the other GRU spooks like APT28, but what about the young Russian soldier joes who just ran over their colonel with a tank? It for sure looks like they must have gotten pretty agitated, and oh man, it just reminds you of the old fragging incidents, and that history could again be repeating itself. History could even be stuck in a loop right now and on endless repeat (for ex just this morning my black cat walked past me twice)

    Sharp young Navalny investigative reporter makes a strong case that how could anyone but not be impressed by vlad’s double helo pad private yacht? And that vlad’s dick is bigger than any of the other siloviki dicks’ dicks (yea, sailor talk, but being a sailor must say I’m impressed and expect likewise so are vlad’s FSO deckhands).

    But what if the lucky lottery winner conscripts just follow the Ukrainian signs that say hey you’re alive today but dead tomorrow and it’s time to go home ..who knows? Maybe it’s even the Russian kids time to shine. Maybe they get their own 1960s with even good music even

  5. KM Williams says:

    It would be great if the US Gov’t sanctioned FOXnews and their ghastly talking head Russia sympathizers.

  6. mospeck says:

    vlad, Sleepy Joe says that you gotta go. But then you are true blue beautiful formidable ultrapowerful short timer king who’s able to end the world with forty five hundred nukes. Also btw how do you manage to walk in the rain between the raindrops? The Moscow radio towers are asking where have all the little girls gone

Comments are closed.