Allegedly irrelevant to the ongoing Russian-Ukraine war, the notorious darknet marketplace AlphaBay says they are excluding Russian countries from their malicious trading operations. Based on reports, the marketplace would rule out Armenia, Belarus, Kazakhstan, and Russia, including all Kyrgyzstan-related activities.
An AlphaBay member, who goes by the alias DeSnake, clarified that their decision to exclude Russia and its allied countries is not associated with the sanctions executed against Russia amid the current war, thus stressing the mandate is mainly due to their team members being based in a state under the Commonwealth of Independent States (CIS).
The states under the CIS include Russia and other former Soviet countries like Armenia, Belarus, Moldova, Azerbaijan, Kazakhstan, Kyrgyzstan, Tajikistan, and Uzbekistan. As added by DeSnake, the strategy had long been practised by the trading sector, including other dark web forum platforms, malware groups, chat rooms, and other cybercriminal groups.
AlphaBay members would refuse to assist transactions from the CIS-involved countries, including not attending to dispute resolutions and other services.
Cybersecurity experts say most ransomware organisations have avoided operating in Russia or other states under the CIS. Furthermore, the top ransomware groups analysed by researchers are reportedly not running campaigns within countries from the CIS even if they actively operate from other countries during threat research.
When ransomware is launched within a country under the CIS, the threat group responsible for the operation would either apologise or give up decryption keys for free over the impacted CIS-associated territory. For instance, a ransomware gang Avaddon had once expressed their regret for running a campaign within Armenia and offered a system fix for free.
The US has not imposed any extradition treaty against Russia; thus, Russian threat operators should be at ease, providing they would avoid performing malicious activities in countries under the CIS.
Furthermore, the AlphaBay member, DeSnake, disclosed that their clients might abuse the dark web platform’s anonymity to evade restrictions, making them risk their business operations and be taken down and seized if discovered.
