The Bear and The Dragon: Analyzing the Russian and Chinese Cybercriminal Communities

The cybercriminal communities in Russia and China have emerged and evolved as a result of their respective regional cultures and circumstances. Understanding the underlying motives, dependencies, characteristics, and moda operandi of each community is critical in order to truly discern the threats they pose, and to preemptively prepare for the manner in which these threats could potentially evolve.

While these two ecosystems have historically remained separate, recently, the Russian and Chinese cybercriminal worlds seem to have collided in a fledgling alliance, with Russian-speaking dark web forums adapting their platforms to make them accessible to Mandarin- and English-speaking users, and Russian threat actors actively seeking to collaborate with their Chinese counterparts. Given Russian-speaking cybercriminals’ sophistication and their constantly evolving modus operandi, the transfer of this knowledge to Chinese threat actors is especially concerning.