San Diego FBI takes down Russian botnet

Authorities in San Diego announced that they have dismantled a Russian botnet known as RSOCKS following a six-year investigation.

Germany, the Netherlands, and the UK were also involved in the takedown, which involved millions of hacked devices around the world. Compromised devices included wireless radio links, time clocks, networking equipment, audio/video streaming devices, Raspberry Pi micro-computers, smart garage door openers. Rsocks’ Twitter account claimed to have access to more than 8 million devices.

The search warrant (see below) shows the operators of the Russian RSOCKS botnet sold access to compromised devices via a website hosted at Vultr in West Palm Beach, Florida. Vultr is owned by The Constant Company, LLC.

According to the search warrant, the storefront at RSOCKS.net allowed customers to rent access to a pool of proxies for a day, a week or per month. Costs ranged from $30 per day for access to 2,000 proxies to $200 per day for access to 90,000 proxies.

Customers then used these proxies to mount large-scale attacks, known as credential stuffing, that allowed them access to legitimate users’ online accounts, such as social networking and email accounts. Victims included “a university, a hotel, a television studio, an electronics manufacturer, as well as home businesses and individuals,” according to the warrant. The victims are not named. Rsocks.net and other associated domains have been seized by the FBI.

RSOCKS was operated by “a highly sophisticated Russia-based cybercrime organization,” San Diego FBI Special Agent in Charge Stacey said in a news release. Domain history for rsocks.net shows it was registered in 2015 by Rsocks Ltd., a UK company. UK corporate filings identify Rsocks Ltd.’s director as Vyacheslav Zainullin, a 29-year-old citizen of Kazakhstan.

Here’s the search warrant:

Russian Money in UK Politics

In The Godfather, Part II, mobster Hyman Roth is asked by reporters why he moving to Israel.

“I’m a retired investor living on a pension, and I wished to live there as a Jew in the twilight of my life,” Roth explains.

Sergey Kopytov

Sergey Kopytov is a retired Ukrainian politician living out the twilight of his life in eastern Europe. Like the fictional Hyman Roth, Kopytov invests in hotels. Except Kopytov’s hotels are not located in Cuba, but rather in the Crimean Peninsula, where he served briefly as finance minister in the pro-Russia Ukraine Party of Regions.

The Hyman Roth of the Godfather Part II was looking for a man who wants to be president of the United States. Roth had the cash to help elect him. “We’re bigger than U.S. Steel,” Roth says.

The very real Sergey Kopytov may been looking for a man who wanted to be the UK Prime Minister. And like Roth, Kopytov had the cash to help make it happen.

A $630,225 donation to the UK’s Conservative Party in February 2018—money helped install Boris Johnson in the prime minister’s office at 10 Downing Street—came from Kopytov, according to a bank alert sent to the National Crime Agency.

The bank alert, which tracked the flow of funds from Russia to Britain, was first obtained by The New York Times. It also was detailed in the latest issue of the UK magazine, Private Eye.

“We were able to trace a clear line back from this donation to its ultimate source,” an official at Barclays Bank wrote on January 2021. That “ultimate source” was Sergei Nikolaevich Kopytov.

If true, this raises troubling questions about Russian influence in UK elections. As in the United States, UK political parties are barred from accepting contributions from foreigners. The Conservative Party donation, however, was given a sheen of respectability. It was made in the name of Kopytov’s son-in-law, Ehud Sheleg. The Israeli-born Sheleg is a UK citizen and owner of a posh London art gallery, and a former treasurer of the Conservative party.

“I believe that the flow of funds which began with a $2.5 million payment from Kopytov to his daughter Liliya, and which ended with the $630k donation to the Conservative party was designed to conceal its origins from an impermissible donor and therefore the people responsible for designing the flow of funds committed an offense which potentially qualifies as a criminal offense,” the Barclays banker wrote in the alert. Sheleg’s wife, the former Liliya Kopytova, is a former Miss Ukraine 30 years his junior.

Ehud Sheleg

“Kopytov can be stated with considerable certainty to have been the true source of the donation,” the alert states. It adds: “Kopytov is a Russian resident and there is no indication that he has a UK passport or is on the UK electoral roll.”

It’s part of a pattern of Russian money and influence flowing into the UK Conservative Party. Boris Johnson played tennis in 2014 with Lubov Chernukhin, the wife of a Russian former minister, in exchange for a £160,000 donation. Chernukhin donated almost £2 million to the Conservatives.

Even as the Kremlin meddled in UK elections and sent assassins to kill two former Russian spies living in England, Boris Johnson defended his decision to take questionable money connected to Russia. “It’s very important that we do not allow a miasma of suspicion about all Russians in London—and indeed all rich Russians in London—to be created,” Johnson told the BBC. The future prime minister made those remarks in March 2018, one month after Sheleg’s donation to Johnson’s party and mere days after the poisoning of retired military intelligence officer Sergei Skripal.

A lawyer for the Shelegs told The New York Times that the couple received millions from Kopytov in the weeks before the 2018 donation. But that was “entirely separate” from the campaign contribution. The explanation given was that Kopytov’s money, which derived from a property sale, repaid a loan made to Sheleg by his family’s trust.

Liliya Kopytova

In May 2018, Ehud Sheleg gave another £750,000 donation to the Conservative party. (That donation was not covered in the bank alert.) He was named co-treasurer of the party three months later, and took over sole responsibility for the job the following year. Sheleg stepped down as the Conservative treasurer in 2021, a few months after Barclays filed its suspicious activity report. His representatives say there was no connection between the two events.

Sheleg was one of the biggest single donors to the Conservative party. In total, he gave £3.6 million to the Conservative Party, which got him knighted by the queen.

It remains unclear why nearly three years elapsed before Barclays filed its suspicious activity report about Sheleg’s 2018 contribution.

The $2.5 million that made its way to Sheleg began its journey in Kopytov’s Russian bank account. It then passed through Austria’s Raffeisen Bank, according to Private Eye. Raffeisen has the greatest exposure to Russia of any foreign bank, with €22.9bn of assets at risk. Readers of my book, Trump/Russia, will not be surprised to hear this as there’s a long history of dirty Russian money flowing through Raiffeisen. An infamous 2006 US State Department cable released by Wikileaks stated that that Raiffeisen served as a front for the Russian gangster Semion Mogilevich.

It took weeks for the $2.5 million to land in the Shelegs joint bank account in Britain. The day after it arrived, Sheleg made his contribution to the Conservative party.

The Barclays bank alert that sounded the alarm about Sheleg’s contribution states “that sources, including a Private Eye article note Ehud Sheleg’s close relations with Moscow… [and] connections with organized crime figures.”

Sheleg’s connections with Moscow including hosting the Russian ambassador to the UK in 2015. His organized crime ties relate to a franchise of his Halcyon art gallery in Cyprus. One of the men involved, Rustem Magdeev, is accused in UK court documents of having connections to organized criminals, a charge he denies.

The role of treasurer of the Conservative Party is often a springboard to the House of Lords, the upper house of British parliament. Seven of the last 10 treasurers were made barons.

An elevation to life peer may now be out of Sheleg’s reach. Questions have arisen in parliament about Sheleg and Kopytov. “Exactly what current and former links do the Sheleg-Kopytov family hold with key actors in the Russian state? Finally, has electoral law been broken and, relatedly, has our national security been compromised?” the chair of the Labour Party asked on the floor of the House of Commons last month. Stephen Kinnock, a Welsh MP who was threatened with a libel lawsuit for questioning Sheleg’s ties to Russia, asked when the former Conservative Party treasurer should be labeled a foreign agent.

In The Godfather, Part II, Hyman Roth’s plans to take over Cuba were foiled by Fidel Castro. Exposing Sergey Kapytov as the “ultimate source” of a Conservative Party donation may have foiled his plans as well.

Putin’s Architect

Lanfranco Cirillo (via Radio Free Europe)

Not long ago, Italian authorities raided a sumptuous villa in the northern Italian town of Roncadelle. Inside, the Guardia di Finanza seized a world-class art collection: paintings by Picasso, Cezanne, Kandinsky, Modigliani, Miro, and Chagall. Some 143 works in all. Outside, there was a large Botero cat statue. In the nearby town of Montichairi, authorities also seized a Eurocopter EC130, worth an estimated 2 million Euros.

The artworks, the helicopter, and the Roncadelle villa all belong to Lanfranco Cirillo, the 63-year-old architect who has designed homes for Russian President Vladimir Putin and 44 other Russian oligarchs. Cirillo is perhaps best known as the architect of Putin’s $1.4 billion palace on the Black Sea—which earned him the nickname of “Putin’s architect.” (Cirillo didn’t deny his work on the project, but would not confirm the palace’s links to the Russian president.)

A lifetime of living large off the oligarchs has caught up with Cirillo. He faces charges in Italy of income tax evasion, money laundering, and violating laws for the protection of cultural assets. According to investigators, Cirillo failed to pay some 50 million euros in taxes from 2013 to 2019 and is said to have laundered the proceeds. But he’s unlikely to ever be held to account. Cirillo lives in Russia, where he was granted citizenship under a 2014 decree granted by President Putin.

For years, Cirillo accumulated a fortune in obscurity. In 2014, he told La Repubblica that he had thousands of employees and invoiced in the hundreds of millions of dollars. “I arrived from Italy 20 years ago with a suitcase as a representative of furniture from Mascagni of Bologna. Today 42 of the 116 Russian billionaires in the Forbes list are my clients,” Cirillo said. He had done dachas and banks, plane interiors and 20,000-square-foot mansions. Once, he said, he saw an oligarch’s wife slap her husband at a dinner. But Cirillo couldn’t name names. His wealth was built on discretion.

Not surprisingly, Cirillo was a great admirer of Vladimir Putin. “Like 92–93 percent of Russia’s population, I love our president and I think he is the right man in the right place in the current world situation,” Lanfranco said in a 2016 interview. A picture of Putin hung on the wall of his office and could be found on his now-defunct website, abitalia.com. Does he still sing the praises of his hero? Sitting in his luxurious home on the Black Sea, does Cirillo cheer as Russian soldiers lay waste to Ukraine? Or does he worry that Russia’s president has brought his new home to the brink of ruin?

Cirillo was a bridge, one of many that existed between the Russia’s ultrawealthy elite and the West. He allowed Russia’s oligarchs to live in an illusion. Yes, they were in Russia, but they were surrounded by the luxuries of the West. He stuffed the oligarch’s homes and planes with the finest furniture and kitchen cabinets from Europe and the United Kingdom. The tentacles of this operation even reached into America. One of the main suppliers of materials for Putin’s Palace was a company Cirillo controlled called Medea Investment LLC, registered in Washington DC., according to a Russian whistleblower, Sergey Kolesnikov.

Compared to the obscene wealth that surrounded and enriched him, Cirillo saw himself as a bit player. His job was to help the obscenely rich live in the baronial splendor to which they felt their corruption had entitled them. He was just a simple, poor architect, as he famously recounted in a 2009 conversation with oligarchs that was obtained by the Russian publication New Times. “I’m an architect, a simple person, I’m poor, very poor, I spent 50 million today, getting 25 (illegible), I have minus 25 million 800 (thousand) euros, for me it’s a lot of money, almost everything earned,” Cirillo said. No doubt these were trivial sums for his clients.

The bridges that people like Cirillo built between Russia’s ultrawealthy and the West now lie in ashes. The flow of luxury goods has ended. There are no more artisans carving rococo ornaments. No more consultants installing dream kitchens with Viking ranges and Subzero fridges. The meticulously-designed megayachts are being seized. The Versailles-style ballrooms he designed now stand empty. The glittering illusion Cirillo once sold to the oligarchs has been swiftly replaced by the darkness of the Soviet days from which they had all sought to escape.

Where are the sanctions on Putin’s Children?

This post has been updated to reflect that neither Putin nor his daughters are listed as partners of a company that owns a Biarritz home where Igor Stravinsky once lived.

The Biden administration is going after the children of Russia’s oligarchs.

Among those sanctioned in recent days were the wealthy sons of Putin’s former judo sparring partner; the son of the Kremlin chief of staff; and the brother and sister whose dad runs the Kremlin-backed Wagner mercenary group.

“The aid of these individuals, their family members, and other key elites allows President Vladimir Putin to continue to wage the ongoing, unprovoked invasion of Ukraine,” the White House said.

But one pair of names is absent from the list: Katerina Tikhonova and Maria Vorontsova. These are the adult daughters of Vladimir Putin.

If the Biden administration is going after the children of the oligarchs, aren’t the children of Putin fair game?

Putin has always been extremely protective of his daughters. “I never discuss my family with anyone,” Putin said in 2015. It’s taken years just to learn the most basic facts about them.

Katerina, a dancer-turned-mathematician, and Maria, a pediatric endocrinologist, have stayed out of the spotlight and taken on different surnames to obscure their connection to the most powerful man in Russia. At the same time, they have reaped the benefits of the corrupt system that keeps their father in power.

Katerina and her former husband, Kirill Shamalov, amassed a corporate portfolio reportedly worth $2 billion before their divorce in 2018. (Shamalov was sanctioned by the US Treasury in 2018; the UK sanctioned him February 24.)

An investigation by Alexei Navalny’s Anti-Corruption Foundation found Katerina headed a foundation that developed lands owned by Moscow State University. Her foundation, Innopraktika, collected $7.8 million from Russian-state owned companies and $7.3 million from unknown sources in 2015-2016.

Maria Vorontsova in Japan (New Times)

Her older sister Maria also lived a life of luxury. Photos on social media showed her traveling the world, riding on expensive yachts, and hiring teachers abroad, according to an investigation by the Russian publication New Times.

Maria married a Dutch citizen named Jorrit Faassen, who worked at subsidiary of Gazprom. In 2010, while driving in Moscow, Faassen got into a confrontation with bodyguards of a Russian banker. Seven bodyguards forced Faassen’s BMW to stop, beat him with baseball bats, and damaged his car. The banker, Matvey Urin, had fucked with the wrong person. Faassen, described in media reports as a Putin family friend, remembered the license plate numbers of the bodyguards that attacked him. The next day, police arrested the businessman and the bodyguards. Weapons and drugs were found in their vehicles. Urin was sentenced to prison and his banks went out of business.

There are rumors that Putin had a “secret” third daughter with a cleaning woman-turned-multimillionaire, but Putin has never acknowledged the girl as his child.

Sanctioning the daughters would put Putin family assets in the West under the reach of sanctions.

One place to go looking for Putin’s assets in the West is in the French town of Biarritz, 15 miles up the coast from the Spanish border. This seaside resort town holds a special place in the hearts of the Putin family. In the summer of 1999, Putin was vacationing in Biarritz with his wife and daughters when he learned that President Yeltsin had anointed him as his chosen successor.

According to a report published February 26 by the French radio station Europe 1, Putin purchased a home on Rue de la Fregate in Biarritz where the Russian composer Igor Stravinsky once lived. Putin reportedly paid around $400,000 for the home in 1996, at which time he worked in the St. Petersburg mayor’s office on a pittance salary. The radio station says the French secret services confirmed the report. Europe 1 says the property is held in the name of one of Putin’s daughters.

Update: I spoke with Michael Anthony, who is listed as an officer of SCI Chalet les Rochers, the French company that controls the property on Rue de la Fregate. Anthony heads Anthony & Cie, a private wealth management advisory firm in France that serves ultra-wealthy clients. Anthony checked his records and tells me that neither Putin nor his daughters are partners of SCI Chalet les Rochers. He declined to name the listed partner(s), citing client confidentiality.

Katerina and her ex-husband, Kirill Shamalov, owned a different home in Biarritz. The seaside house was acquired for 4.5 million Euros in 2012 from one of Putin’s old friends, Gennady Timchenko. It’s not clear who owns the house on Avenue du General MacCroskey today. The French company that owns the house is in turn owned by a Monaco company, SCP Alta Maria, whose beneficiaries cannot be revealed, even on request.

The home on Avenue de General MacCroskey

Lyudmila Putin, Katerina’s and Maria’s mother, also spends time in Biarritz. Lyudmila was married to Putin for three decades before they divorced in 2013.

Putin’s ex-wife has come almost every year to Biarritz to “take the waters,” both before and after her divorce, Alexandre de Miller de La Cerda, Russia’s honorary consul in Biarritz, told TIME. “She stops either at the Miramar” – one of the town’s most luxurious hotels – “or in the house that belongs to our mutual friend from Putin’s St. Petersburg circle.”

Lyudmila acquired a $7.46 million home in Anglet, next to Biarritz, six months after divorcing Putin, OCCRP reported. The Anglet home is in the name of her second husband, a St. Petersburg businessman almost 20 years her junior. In recent days, the gate of the Anglet home was marred with graffiti reading ‘Putin suka!’ (a vulgar insult in Russian), ‘Putin’s mafia’ or ‘Slava Ukraíne’ (Glory to Ukraine).

Meanwhile, the US Treasury keeps noting how the Russians it is sanctioning are close to Putin’s daughters. Kirill Dimitriev, the head of Russia’s sovereign wealth fund who was sanctioned last week is close to Katerina and her ex-husband, the US Treasury noted in its release. It’s clear that being close to Putin’s daughters is part of being in the inner, inner Kremlin circle.

So why sanction the oligarchs’ children, and not Putin’s daughters? Is the US worried that it will be too much of a provocation for an already unstable man?

A Tale of Two Oligarchs

This was a bad week for the Russian oligarch Alisher Usmanov.

First, Usmanov had his $600 million yacht, the Dilbar, seized by German authorities. Now, Usmanov, a reputed gangster and early Facebook investor, will have to say goodbye to his luxurious English properties after the UK joined the Americans and the European Union in sanctioning him. He will also have to give up his years-long quest to own a British football club. Usmanov ended the week on the sanctions lists of the US, UK, and the European Union.

It was a different story his fellow oligarch Roman Abramovich, who shares Usmanov’s taste for megayachts and storied English football franchises. Abramovich has somehow managed to avoid any sanctions at all.

Abramovich describes himself “a successful Israeli-Russian entrepreneur and businessman.” Alexei Navalny, the jailed Russian opposition leader, puts him at the top of the list of 35 kleptocrats and human rights abusers primarily responsible for looting the Russian state and repressing human rights.

“It is a mystery to me why Roman Abramovich has not yet been sanctioned,” remarked British MP Chris Bryant, who has been bringing this issue up every chance he gets. Bryant told the House of Commons that Abramovich “is terrified of being sanctioned.” Rumors are swirling that Abramovich is selling the 15-bedroom mansion in London’s Kensington Palace Gardens he bought for £90m in 2009.

Bryant read earlier from a leaked Home Office document from 2019:

“As part of [Her Majesty’s Government]’s Russia strategy aimed at targeting illicit finance and malign activity, Abramovich remains of interest to HMG due to his links to the Russian state and his public association with corrupt activity and practices. An example of this is Abramovich admitting in court proceedings that he paid for political influence. Therefore, HMG is focused on ensuring individuals linked to illicit finance and malign activity are unable to base themselves in the UK and will use the relevant tools at its disposal (including immigration powers) to prevent this.”

UK Prime Minister Boris Johnson slipped up last month when he told Parliament that Abramovich “is already facing sanctions.” He later said he “misspoke.”

Abramovich earned his massive fortune by acquiring Russian state resources at bargain-basement prices during the vicious “aluminum wars” of the Yeltsin era. He and his partners acquired a majority stake in the oil giant SIbneft in 1995 for $100 million. Abramovich sold Sibneft a decade later to the state-owned gas giant Gazprom for $13 billion in cash. He also acquired a 50 percent stake in the aluminum giant Rusal, which he sold to Oleg Deripaska.

In court papers filed in London, Abramovich admitted agreeing to pay billions of dollars for political favors and protection fees to obtain his stakes in the former Soviet Union’s mineral wealth, the Times of London reported.

Abramovich insists he’s not, as he has been described, “Putin’s cashier.” Journalist Catherine Belton wrote in her indispensable book, Putin’s People, that Putin directed Abramovich to buy England’s Chelsea football club in 2003 for $240 million to build a beachhead into British society. That earned Belton a libel lawsuit from Abramovich. (The case was settled after the book’s publisher agreed to amend the text to include the oligarch’s denials and make clear that the claim that the oligarch bought Chelsea on Putin’s orders was not a statement of fact.) Abramovich announced this week that he will be selling Chelsea FC.

The UK has always been slow to take action against Russian oligarchs. But there’s no sense of urgency in the United States either to sanction such a tempting target.

President Biden, in his State of the Union address Tuesday, warned oligarchs that America was coming for their ill-gotten gains. “We are joining with our European allies to find and seize your yachts your luxury apartments your private jets,” Biden said.

Abramovich owns a fleet of yachts, including the $500 million Eclipse, one of the world’s biggest. The Eclipse has two helicopter pads, 24 guest cabins, two swimming pools, and a disco hall. It also features a German-built missile defense system, which has led to speculation that the yacht really belongs to Putin. But as I write this, the Eclipse is sailing the Caribbean unmolested.

The Eclipse

Abramovich also owns a fleet of private plans. His Boeing 787 Dreamliner is in Dubai today.

Nothing is stopping Abramovich from flying to New York where he is combing three adjacent buildings to build the biggest single-family home in Manhattan. Or he can head to Colorado where he owns nearly $50 million worth of properties around Aspen. He has an 11-bedroom house on 200 acres of land in Snowmass purchased in 2008 for $36.375 million, according to property records. Abramovich also purchased a 5,492-square-foot ski-in, ski-out house on 1.8 acres of land in Snowmass Village for $11.8 million.

Wherever he goes, Abramovich smartly gives to charities to buy goodwill. If you stroll past the Jewish Community Center in Aspen, you’ll see Abramovich’s name proudly displayed on the front of the sandstone facade. Israel’s Channel 12 reported that, before Russia invaded Ukraine, the chairman of the Yad Vashem Holocaust Memorial Museum, the Ashkenazi chief rabbi of Israel, and representatives of several other major Israeli organizations and charities appealed to the US ambassador to Israel, urging Washington not to impose sanctions on Abramovich. In late February, Yad Vashem, Israel’s Holocaust authority, announced a donation from Abramovich, said to be in the eight figures. This may be why the sanctions on Abramovich have been slow in coming.

I understand why Israeli charities want to protect a major source of funds. But as the investors now holding worthless shares of Sberbank know all too well, corrupt money should never be trusted.