Changes In

Vladimir Kropotov opens by explaining why the community is called Russian-speaking rather than Russian. The shared language lets actors from many countries collaborate without revealing where they are based, and these forums are often where new criminal tooling and business practices first appear.

The middle of the talk covers the forces driving change. Remote work and social media during the pandemic widened attack surfaces and pushed criminals into specialised roles, so one intrusion can now involve several groups, which makes attribution harder. Russia's war in Ukraine, sanctions and migration are presented as factors that eroded trust between groups, reshaped payment and logistics flows, and moved some services into EU territory. Infrastructure is shifting too, with hosting chosen by jurisdiction and residential proxies used to slip past anti-fraud checks. Stolen personal data, biometrics and AI tooling are described as enabling fake accounts and impersonation.

He closes by pointing to a longer white paper for more detail. The practical takeaway for defenders is that technical indicators alone can mislead when several specialised groups share one intrusion, and that identity checks and geographic signals weaken as fraud tooling matures.