Russian Government Protection Framework, v2

An Exploitation Framework for LE and IC Analysts

FBI · DOJ · USSS · DIA · CIA · FinCEN · Treasury

March 2026 | Version 3.0

Developed by Reno

Executive Summary

Russia’s ransomware ecosystem is not just tolerated by the state, it is actively structured, protected, and in many cases directed by it. This document examines seven Russian government entities through a single lens: how each one protects cybercriminals, what breaks that protection, what we can do about it, and what will blow back on us if we push the wrong way. Updated May 2026: Mintsifry Order No. 1174 (registered 22 May 2026) expanded SORM collection requirements to mandate real-time linkage of passport data, home addresses, tax IDs, bank account details, and geolocation to every IP address on Russian infrastructure. Concurrently, Russia crashed its own banking system in April 2026 — briefly eliminating electronic payments nationwide — while enforcing VPN restrictions, demonstrating willingness to accept macroeconomic self-harm to extend internet control. Neither development changes the analytical framework in this document. Both strengthen its core premise: FSB has comprehensive technical visibility into domestic criminal infrastructure and maintains a deliberate policy of non-enforcement. The “Russia didn’t know” counter-argument is now categorically untenable.

This is not a document about Russian law enforcement. It is a document about Russian institutional behavior, and how to exploit the gaps, contradictions, and internal pressures within that behavior to degrade the ecosystem from the inside out.

Entities covered:

• FSB, architect of the protection ecosystem; recruits, tasks, and shields elite actors
• MVD / Department K, primary domestic enforcer; constrained by FSB but the highest-confidence mid-tier lever available
• Rosfinmonitoring, financial intelligence mapping node; feeds CBR and MVD; Egmont-suspended but domestically motivated
• CBR, non-attributable financial friction via 115-FZ banking controls; no court order needed
• FNS, tax authority; exposes lifestyle and income gaps without triggering FSB protection reflexes
• GRU, military intelligence; uses cybercrime as a strategic tool; sets the scope boundary for this framework
• SVR, foreign intelligence; lower ransomware footprint but relevant infrastructure and personnel overlap

The single most important principle in this framework:

Direct pressure on FSB-shielded actors, public attribution, extradition requests, media naming campaigns, reliably activates protection rather than degrading it. The highest-ROI approach routes pressure through domestic financial and legal frameworks that register as bureaucratic friction rather than foreign interference. This is not a soft option. It is how you avoid handing FSB a reason to shield an actor it might otherwise discard.

Engagement Triggers and Blowback Risk

This section covers the actions that consistently cause Russian agencies to protect, absorb, or redirect cybercriminals rather than suppress them. These are not theoretical risks, they are documented patterns drawn from post-2022 enforcement history. Every entity section in this document references these triggers. Read this first.

The core problem with getting this wrong isn't that the action fails. It's that the action makes the target harder to reach, sometimes permanently. FSB absorption of an actor is not reversible through additional pressure, it requires dismantling the protection relationship before re-engaging the criminal.

Protection Activation Triggers

These are the actions that flip an actor from criminal liability to protected asset in FSB's calculus:

The Public Outing Track, Using Domestic Exposure Against Protected Actors

One of the most effective tools against FSB-protected actors is public exposure of their non-cyber domestic crimes, not their ransomware activity. This is the Conti/Black Basta/Nefedov model: surface financial misconduct, fraud, drug use, corruption, or other domestic law violations through investigative journalism channels (OCCRP, Bellingcat, iStories, Meduza) rather than through official attribution.

Why this works: when an actor's domestic misconduct becomes publicly visible, FSB faces a calculus shift. Shielding a known criminal whose crimes are embarrassing to the regime costs more than it returns. The protection value of that actor declines. In some cases FSB will distance itself, or competing FSB factions will surface the liability to weaken the protecting officer.

What's required for this to work:

• The domestic crime must be genuine and documentable, fabrication risks are high if the exposure is later challenged
• The framing must be domestic Russian harm, not Western victim harm, 'he defrauded Russian citizens' lands differently than 'he hacked American hospitals'
• The exposure channel must not carry a visible foreign government fingerprint, investigative journalism outlets create domestic scandal framing without official attribution
• Timing matters: expose after financial and tax pressure is in place, not before, the combination is more destabilizing than either alone

Blowback conditions for this track:

• If the actor's domestic crime exposure is traced back to Western intelligence sourcing, it activates the foreign interference protection reflex, the opposite of the intended effect
• If the actor's domestic misconduct also implicates FSB officers directly, FSB may act to silence the exposure rather than distance from the actor
• Do not use this track on actors with confirmed GRU operational nexus, the mechanism doesn't apply to state employees

Sequencing for Minimum Blowback

Actions should be sequenced from lowest to highest blowback risk. Low-risk actions first establish the domestic framing that makes higher-risk actions viable without activating protection reflexes.

FSB, Federal Security Service

The FSB is the architect of Russia's cybercrime protection ecosystem. It doesn't merely tolerate ransomware actors, it recruits, tasks, shields, and when necessary, sacrifices them. Understanding FSB's behavior requires understanding that FSB is not a unified institution. It is a collection of competing factions, officers with divergent financial interests, and units in active competition for political favor. This internal fragmentation is as important as FSB's aggregate power, because it is exploitable.

Technical visibility note (updated May 2026): Every analytical argument in this section that rests on FSB’s awareness of domestically resident criminal actors is materially strengthened by Mintsifry Order No. 1174, registered 22 May 2026. Under SORM’s existing architecture, FSB has had real-time access to domestic internet traffic since SORM-2 (1998). Order No. 1174 extends this: all operators of technological communications networks with internet identifiers (ASNs) must now link passport data, home addresses, tax IDs, bank account details, and real-time geolocation coordinates to assigned IP addresses, with additional collection of domains accessed and user logins. FSB has statutory access to this dataset without a court order. Any assertion that FSB lacked the technical means to identify a domestically resident criminal actor operating on Russian internet infrastructure is no longer supportable. The protection model described throughout this document reflects a deliberate choice against a backdrop of comprehensive technical visibility — not a consequence of surveillance limitations.

How FSB Protects Cybercriminals

The krysha ("roof") model is the primary protection mechanism. An FSB officer or unit provides protection to a criminal actor in exchange for financial payment, intelligence collection capacity, or strategic operational capability. The relationship is transactional, not ideological.

FSB Internal Factions, The Exploitable Contradiction

FSB is not a single decision-maker. Competing units, the 13th Service (SIGINT), 16th Center (foreign intel), 18th Center (domestic cyber), have divergent interests, and individual officers compete for political favor, resources, and criminal financial relationships. This matters operationally because:

• An officer whose protected criminal actor becomes an attribution risk is a liability to competing FSB units, not an asset
• Surfacing one officer's criminal financial exposure to competing FSB units is a more achievable objective than seeking unified FSB cooperation
• When a protected actor repeatedly gets disrupted despite protection, the protecting officer looks operationally incompetent, which activates internal FSB factional pressure
• Officers with Western asset exposure face counterintelligence scrutiny from within FSB, which can be triggered deliberately

The goal is not to get FSB to cooperate as an institution. The goal is to create conditions where specific FSB factions or leadership figures find it in their interest to act against a specific officer's protection relationship. These are different and more achievable objectives.

FSB Officer Liability Track

FSB officers maintaining krysha relationships with high-volume ransomware actors accumulate financial exposure that doesn't match their declared government salary. Building this profile is an open-source and financial registry analytic task, it requires no HUMINT to initiate.

What Triggers FSB to Withdraw or Weaken Protection

FSB protection is not unconditional. These are the conditions under which it degrades:

• The protected actor's OPSEC failures create a documented link between a specific FSB unit and a high-profile operation, particularly U.S. critical infrastructure or healthcare, giving competing units leverage against that officer's unit
• The officer's financial exposure becomes visible in domestic Russian media or through FNS/Rosfinmonitoring processes, creates pressure on FSB leadership to demonstrate institutional integrity
• The actor repeatedly gets disrupted despite protection, makes the officer look ineffective and the protection relationship a waste of institutional resources
• The actor creates domestic harm that is visible enough to attract MVD attention, puts the protecting officer in the position of blocking domestic enforcement on behalf of a visibly harmful actor
• Kremlin signals the actor is a liability, typically follows regime-level embarrassment or diplomatic cost that exceeds the actor's strategic value

Do / Caution / Never

MVD / Department K, Ministry of Internal Affairs

MVD Department K is the highest-confidence actionable lever in this framework for mid-tier actor disruption. It's the primary domestic cyber enforcement body, but it operates under FSB override authority on anything deemed national security. That constraint is real, but it also has clear boundaries. For actors without confirmed FSB affiliation, MVD is responsive, quota-driven, and reachable through structured intelligence packages.

Post-2022, MVD enforcement has become more performative, arrests spike after major Western operations, but outcomes tend toward lenient sentences and early releases. The metric that matters is not conviction rate. It's forum fragmentation, affiliate panic, reconstitution delay, and operational tempo decline.

How MVD Operates Within the Protection Ecosystem

MVD sits below FSB in the ecosystem hierarchy. FSB can override MVD enforcement on any case it deems a national security matter, which in practice means any actor with RIS affiliation, current krysha, or strategic utility. Outside that protected tier, MVD operates with genuine arrest and prosecution authority.

• MVD enforces based on arrest and seizure metrics, quota pressure is a real institutional driver
• MVD is reputationally sensitive to domestic media scrutiny on cases involving Russian victims
• MVD has interagency rivalry with FSB, it will enforce where FSB has no stake, partly as a competitive dynamic
• FNS and Rosfinmonitoring referrals feed MVD without triggering FSB review, the domestic financial framing is the key
• MVD enforcement windows open after major Western operations, the 30-90 day window following a Western takedown or sanctions action is when MVD is most responsive to structured packages

MVD and BPH / IAB / Money Launderer Targeting

Bulletproof hosting providers, initial access brokers, and OTC money launderers sit in MVD's enforcement lane without FSB protection in most cases. These actors are the connective tissue of the ransomware ecosystem, and they are more accessible than the ransomware operators themselves.

Enforcement Pattern, Post-2022

Do / Caution / Never

Rosfinmonitoring, Federal Financial Monitoring Service

Rosfinmonitoring is Russia's Financial Intelligence Unit and the primary domestic node for mapping crypto-to-fiat laundering flows. It doesn't make arrests. What it does is feed the CBR and MVD pipelines that create financial friction and enforcement referrals. Its Egmont membership was suspended in December 2022, which cut off direct Western FIU intelligence exchange, but its domestic institutional incentives remain strong independent drivers.

The core analytical value here is the pipeline it sits in: blockchain intelligence → Rosfinmonitoring flag → CBR 115-FZ freeze → MVD referral. Rosfinmonitoring is the node that connects crypto-chain analytics to domestic Russian enforcement. Treat it as a mapping and routing node, not an enforcement body.

How Rosfinmonitoring Intersects the Ransomware Protection Structure

• Mandatory reporting from VASPs and banks on transactions over 600K RUB feeds the FIU database, post-2024 VASP regulations expanded this significantly
• Ransomware proceeds converting BTC to rubles through OTC brokers generate transaction patterns that meet 115-FZ suspicious transaction thresholds
• Rosfinmonitoring flags feed CBR for banking-level freezes and MVD for criminal referrals, neither requires a court order at the flagging stage
• The Egmont suspension limits direct Western FIU-to-FIU exchange, but the Belarus FIU remains the only credible back-channel to Rosfinmonitoring post-2022
• Rosfinmonitoring has genuine domestic institutional motivation: ransom proceeds draining the ruble economy, sanctions evasion overlap, and regime stability concerns all align with its mandate

Structural Constraint Note (cross-reference EDP Module 14): The pipeline described above reflects Rosfinmonitoring’s theoretical function and domestic incentive structure. EDP Module 14 assesses this pathway as structurally constrained in practice for ransomware-connected flows for two reasons: first, Rosfinmonitoring operates within the same state protection framework (Dark Covenant) that provides implicit tolerance for high-value ransomware operators; second, Russian financial intelligence cooperation has historically been selectively responsive, actionable for cases the Kremlin wants pursued, not for protected actors. Treat Rosfinmonitoring as a routing node and formal channel to maintain, not as a reliable primary disruption mechanism for ransomware-connected flows. [ANALYST INFERENCE]

OTC Broker and Money Launderer Coverage

OTC brokers are Rosfinmonitoring's most actionable targets in the ransomware ecosystem. They sit at the intersection of the crypto and ruble economies, and their transaction patterns are exactly what 115-FZ is designed to surface.

Do / Caution / Never

CBR, Central Bank of Russia

The Central Bank of Russia is not a ransomware enforcer. It’s a financial control mechanism that can be used to create friction against ransomware cashout operations without naming individuals, without court orders, and without triggering FSB protection reflexes. That makes it the stealthiest disruption vector in the framework. Structural update (February 2026): FSB demanded that major Russian banks install SORM equipment on their mobile applications, classifying bank apps as “organisers of the distribution of information” under Russian communications law. Banks that refused were removed from the whitelist of services permitted to function during FSB-directed mobile internet shutdowns. This creates a new dependency: Russian banks now operate within the same SORM compliance architecture as telecoms, which means FSB has intercept access to bank application traffic in addition to the 115-FZ financial friction mechanisms already covered here. The pipeline from Rosfinmonitoring flag to CBR 115-FZ freeze is unchanged, but the SORM layer adds a parallel FSB visibility channel into domestic financial institution communications that did not exist before 2026.

The mechanism: ransomware actors must convert BTC proceeds to rubles to access the Russian domestic economy. That conversion, typically through OTC brokers and CIS-linked exchanges, is the point of maximum vulnerability. A Rosfinmonitoring flag on the destination ruble account triggers a CBR 115-FZ instruction to the receiving bank. The bank freezes the account. No arrest, no prosecution, no public naming, no FSB trigger.

115-FZ as a Disruption Tool

• Banks report transactions over 600K RUB flagged as suspicious; CBR can order blocking without court process
• Extended to VASP transactions post-2022, directly intersects ransomware ruble inflows
• War sanctions evasion context has heightened CBR AML scrutiny across the board, ransomware actors using the same crypto-fiat infrastructure as sanctions evaders face collateral friction
• No attribution required, the friction registers as a compliance action, not a law enforcement action
• CBR's institutional motivation is genuine: correspondent banking relationships with Western banks are the CBR's primary vulnerability to external pressure, and it actively seeks to protect them

The Pipeline

CBR doesn't generate its own intelligence. It acts on Rosfinmonitoring flags and correspondent banking pressure. The pipeline looks like this:

Correspondent Banking Pressure

CBR's external vulnerability is correspondent banking relationships with Western financial institutions. This is the external pressure lever that reinforces the domestic 115-FZ pipeline:

• OFAC designation of OTC brokers and CIS-linked exchanges triggers de-risking by Western correspondent banks, CBR-supervised Russian banks that rely on those relationships have strong institutional incentive to comply with 115-FZ more aggressively
• FATF grey-listing pressure on Russia creates compliance burden that increases CBR AML scrutiny across all suspicious transaction categories, ransomware cashout flows benefit from this collateral friction
• This track does not require Russian cooperation, it operates through Western financial system control points

Do / Caution / Never

FNS, Federal Tax Service

FNS is the highest-confidence, lowest-blowback domestic lever in the framework. Tax exposure doesn't trigger FSB protection reflexes the way cybercrime attribution does. It exploits a structural gap between what an actor earns from ransomware and what they can declare to the Russian tax authority, and that gap is enormous for most mid-to-high-tier actors living in Russia.

FNS has no arrest power. Its value is as an exposure and referral node that feeds MVD without geopolitical sensitivity, and as a domestic harm framing tool that makes actors liabilities to the Russian state rather than assets of it.

How FNS Creates Pressure on Protected Actors

Ransomware actors living in Russia must spend their proceeds domestically. Real estate, vehicles, business ownership, and consumer spending all create a financial footprint that FNS digital audits can surface. The gap between declared income, often zero or minimal, and visible assets constitutes the basis for an Art. 198 referral without requiring any attribution of the underlying ransomware activity.

• Post-2022 war economy pressures have heightened FNS institutional motivation, domestic revenue protection is a genuine driver, not just a framing convenience
• FNS digital audit platform (nalog.ru) has expanded significantly, cross-referencing property registries, corporate ownership, and banking records is now largely automated
• Shell company and front business exposure through Art. 199 (organizational tax evasion) is a separate but parallel track, corporate registry analysis (egrul.nalog.ru) surfaces nominee-held entities
• FNS referrals to MVD for laundering charges (Art. 174.1) do not require FNS to identify the predicate cybercrime, laundering of unspecified proceeds is sufficient to open an MVD file

FNS and the Public Outing Track

FNS lifestyle data, property holdings, vehicle registrations, corporate interests, is also the raw material for investigative journalism exposure of cybercriminal actors and their FSB handlers. The Conti/Nefedov model demonstrated how domestic financial misconduct exposure through journalism channels creates domestic embarrassment that FSB cannot easily suppress without acknowledging the underlying relationship.

• Build the lifestyle intelligence package from open Russian registries before approaching any referral channel
• FNS referral and investigative journalism exposure are complementary, the referral creates a domestic paper trail; the journalism creates public pressure that makes ignoring the paper trail politically costly
• The FSB officer liability track (see FSB section) uses the same FNS methodology applied to the protecting officer rather than the criminal actor, lifestyle inconsistency on a government salary is the entry point

Do / Caution / Never

GRU, Main Directorate of the General Staff

The GRU section serves as a scope boundary for this framework as much as it serves as an analytical target. GRU-nexus actors are not accessible through the domestic Russian institutional levers that make up the rest of this document. Understanding who falls into GRU overlap, and recognizing it early, is operationally critical precisely because the approach for those actors is fundamentally different.

GRU's relationship with ransomware differs from FSB's krysha model. GRU does not recruit and protect criminal freelancers the same way. It deploys cybercrime capabilities as strategic military tools, particularly destructive operations (NotPetya, wiper campaigns) using ransomware-style deployment as cover. The actors are state employees, not co-opted civilians.

GRU Ecosystem Intersection Points

Do / Caution / Never

SVR, Foreign Intelligence Service

SVR has a lower direct footprint in ransomware operations than FSB or GRU, but it intersects the ecosystem through infrastructure overlap and the initial access broker market. SVR's primary cyber operations target government, defense, and diplomatic networks (APT29 / Cozy Bear / SolarWinds). Like the GRU section, this primarily serves as a scope boundary, but the IAB market overlap makes it relevant for analysts building infrastructure and access broker targeting packages.

SVR Ecosystem Intersection Points

Do / Caution / Never

Integrated Disruption Strategy

The entity sections above are most valuable when applied as a coordinated framework, not as isolated actions. This section describes the compounding feedback loop, the three referral tracks, and the measurement framework that ties everything together.

The Compounding Feedback Loop

Each pressure cycle strengthens the next. This is the mechanism that turns individual actions into ecosystem degradation:

The Three Referral Tracks

Three parallel tracks, operated simultaneously, produce compounding pressure without triggering FSB protection reflexes:

Measurement Framework

Don't measure effectiveness by Russian prosecution or conviction rates. Measure by ecosystem health indicators:

Quick Reference