The Russian spy that hacked the US financial markets

The Russian spy that hacked the US financial markets
Cybercriminal Vladislav Klyushin with his wife Zhannetta, who was one of the 26 prisoners exchanged by the US and Russia in the biggest prisoner swap since the Cold War. / bne IntelliNews
By Ben Aris in Berlin August 13, 2024

Vladislav Klyushin was released as part of the biggest prisoner swap completed on August 1, when Russians dissidents and US journalists were traded for a motley collection of spies, crooks and an assassin. Klyushin is a multi-millionaire hack-to-trade cybercriminal who made $93mn from stealing corporate information from some of the US’ biggest companies. But he is also a member of a shadowy network of hackers backed by the FSB that have penetrated the US financial markets and are making millions of dollars for themselves and their bosses in the Kremlin, according to an investigation by CNBC’s Eamon Javers, broadcast the day after the swap was completed.

Neither an overt spy nor an experienced hacker himself, Klyushin was well connected to the FSB and hired Ivan Yermakov, an experienced hacker who was already under two indictments in the US for cybercrime. In a testament to just how good Klyushin’s connections were, he was awarded the Russian Medal of Honour in June 2020 by President of the Russian Federation Vladimir Putin himself.

Yermakov is a spy. He is a former Russian military intelligence officer but was also wanted by the American government for his alleged involvement in the "Fancy Bear" hacking schemes aimed at interfering in the 2016 US presidential election, according to US prosecutors.

Klyushin set up an investment fund called M13 that says openly on its website that it works with the Russian presidential administration and also has had various unnamed oligarchs as investors. It was the FSB that put Klyushin onto the weakness in the US system that allowed him to make a fortune in just over a year: file agents.

A file agent is a piece of accounting software used by most large corporations where they upload their company financial results as part of the tax reporting process. There are about half a dozen file agent products on the US market and Yermakov hacked into two of them, giving M13 real-time access to the details of household name US corporations such as Tesla and other famous high-tech firms. Companies typically upload their information ahead of submitting it to the taxman, giving the hackers a crucial window to trade on any surprises in the numbers.

A team of traders at M13 could peruse the details of Tesla’s financials at their leisure before the company reported its results and released them to the public. On one occasion two years ago, Tesla surprised the market with exceptional strong growth figures. With a heads up on the good news, the M13 team invested millions in the stock ahead of the data release and watched Tesla share price rocket after the rest of the market found out about the good news – all done from the safety of a trading desk in Moscow where they remain untouchable. Klyushin made over $2mn on that transaction alone, CNBC reports.

The scheme is supported by the Kremlin, a former spy who defected to the US and who remained anonymous for his own safety, told CNBC. Keen to have a foothold in the US financial system, the FSB feeds what could be dozens of these hack-to-trade operations, with intelligence that gives them access to valuable insider information that allows them to get rich and manipulate the US market. The beauty of the scheme is that it costs the Kremlin nothing and indeed the anonymous spy claims that many senior FSB officials are investors in the schemes thereby enriching themselves – with the full knowledge and permission of the Kremlin. The system rewards its own.

Taking advantage of sensitive financial information has long become the preferred form of Russian corruption, and it remains largely legal. When rating agencies were going to upgrade Russia’s sovereign ratings, the market for its sovereign bonds would regularly spike, as the agencies routinely called the Kremlin an hour beforehand to forewarn officials of the good news.

And during the boom years, then Finance Minister Mikhail Kasyanov and later opposition leader who opposed Putin, earned the moniker “Misha 2%” for allegedly moving the debt of former Soviet republics up and down the repayment schedule, changing the price of the debt and allowing those forewarned of the change to cash in on the news.

And a generation of Moscow equity traders at the most respectable investment banks famously made themselves wealthy during the boom years in the noughties by “front running” their clients’ orders for years, until President Dmitry Medvedev finally outlawed insider trading in July 2010.

However, the remarkable performance of M13, and the big bets it was making ahead of startling corporate news, rang bells in Washington and was its eventual undoing; the FBI financial crimes unit watched the market for just this sort of trading pattern and opened an investigation.

The meticulous investigation finally uncovered the hack as Yermakov gave himself away. One of the quirks the FBI noticed is the hackers were always logging in to the file agent late at night, until they realised that time was lunch time in Moscow.

But Yermakov’s fatal flaw was to log into the US file agent but at the same time he had logged into his online music account from the same device to an account where he had used his real name.

Once the identities of the hackers had been established the investigation went up a gear. The FBI also hacked into the “unhackable” Threema messaging service used by M13 employees to chat and organise their social life. The service is considered to be extremely secure and designed from the ground up to generate as little data on servers as possible. Once they had access, the FBI could watch M13 completely unguarded conversations in real time. Klyushin regularly asked about business, what stocks were being traded and openly detailed their criminal activity. He even shared the names of some of the investors together with photos of their faces.

However, the US authorities were frustrated, as there was no way to arrest any of the M13 team, until Klyushin’s bravado got the better of him. An ambitious man, who was described by the investors as “always wanting more”, Klyushin loved the rich life and wanted to go skiing at the luxury resort of Zermatt in Switzerland. Unaware that the FBI had been tracking his every movement and tapping his phone and chats for more than a year, Klyushin discussed the trip with Yermakov and assured him that if he used a false name and passport there would be no problem.

Klyushin chartered a private jet and flew to Zermatt. As he walked across the tarmac at Sion to the helicopter waiting to take him up the mountain to the hotel on the peak, already dressed in skiing clothes and boots, Swiss police swooped and handcuffed him. Yermakov was also charged in the hack-and-trade scheme but never left Russia, putting him beyond the reach of the law.

After a short extradition process, Klyushin was moved to the US on December 19, 2021, where a court in Boston later sentenced him to nine years in jail for insider trading and wire fraud amongst a long list of other charges on February 14, 2023.

There he would have remained, except the FSB has made it clear that it takes care of its own. The key figure in August’s prisoner swap was Vadim Krasikov, an FSB hitman who had killed a Georgian-Chechen dissident in broad daylight and had been sentenced to life in jail in a German jail. Russian President Vladimir Putin made it very clear that Krasikov was the keystone to any prisoner exchange, as the FSB remains the foundation of his grip on power. If FSB operatives were going to be exchanged, then it was natural to include Klyushin in the arrangement.

Features

Dismiss