John Z Black

John Z Black Mar 31, 2026 Ransomware & Cybercrime #russia #flint24 #cybercrime #payment-card-fraud #stroganov #extradition #accountability #military-court

Russia just convicted 26 members of the Flint24 payment card fraud ring. The ringleader got up to 15 years. You’ll see headlines calling it a crackdown. It isn’t.

Aleksei Stroganov, alias “Flint,” ran the operation from 2014 until Russian authorities arrested him in 2020. Roughly 90 online shops, 60 locations raided across 11 regions, $432,000 seized. Real investigation. Real conviction.

He’s also been on the US Secret Service most-wanted list since early 2024. The charges: wire fraud, bank fraud, aggravated identity theft. Hundreds of millions of compromised payment cards and bank accounts. Conduct stretching back to at least 2007.

Here’s the problem. A domestic Russian conviction for conduct that overlaps with US charges effectively closes the door on extradition. Under the principle of non bis in idem, you can’t try someone twice for the same offense. Russia convicted him. Case closed, from their perspective. Whether he actually serves anything close to 15 years is a question they have no particular incentive to answer.

Russia periodically prosecutes cybercriminals who’ve drawn Western attention, especially when extradition pressure is mounting. The prosecutions are real. The effect is to resolve these cases in a jurisdiction where the US has no reach, under terms Russia controls.

There’s a meaningful difference between “Russia convicted cybercriminals” and “Russia made those cybercriminals permanently unavailable to Western justice.” This week, both things happened.

Read the full story on how Russia’s domestic prosecution strategy plays out and why it matters for international cybercrime accountability.